Overview

overview

10

Static

static

10

3809affad6...d7.msi

windows7-x64

10

3809affad6...d7.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 14:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3809affad6dc10de4613edb2c172f47b641b0393270a129b24683ccd30fb39d7.msi

  • Size

    2.9MB

  • MD5

    4c2ccd8e957c65e8c7ef53c5147066c3

  • SHA1

    6cd11864dfe9f061c2a4e599304934d94f8c36e8

  • SHA256

    3809affad6dc10de4613edb2c172f47b641b0393270a129b24683ccd30fb39d7

  • SHA512

    8ef0ac1323c4a3da1e892892b46b71f08901aeb3142250144ce2514058ca593de9d05b88cfe502336dca4910bab2ede7023aa7c09364c60647cf50f3aa9749ff

  • SSDEEP

    49152:1+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:1+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3809affad6dc10de4613edb2c172f47b641b0393270a129b24683ccd30fb39d7.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1336
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1932
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C4882BE3113A8A0418B9380BE30E61AB
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC0CF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240632281 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2492
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC3CE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240632828 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4728
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC834.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240633937 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1444
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID3B2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636906 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3060
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 00690CD77CA184C5A63D7CAB5748116A E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4612
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4796
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4364
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000CDtpOIAT" /AgentId="0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:3944
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 0070012330DE489E7C9326914C3CF7C4 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{74D1842E-005C-45FD-934E-B0F233044E90}
          3⤵
          • Executes dropped EXE
          PID:4824
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8B215515-5923-4157-BCE1-983C85F1CBC0}
          3⤵
          • Executes dropped EXE
          PID:2992
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{73A5F068-F7CF-46E7-B731-B95D253C0E60}
          3⤵
          • Executes dropped EXE
          PID:444
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8CA0EEA-26D9-43BD-9508-410AA2B35CA8}
          3⤵
          • Executes dropped EXE
          PID:808
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1A35443F-D257-4D43-82F0-4FDBE08CB888}
          3⤵
          • Executes dropped EXE
          PID:2908
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8FF30869-9BB7-448C-AC7A-B253B2E3F9A2}
          3⤵
          • Executes dropped EXE
          PID:4620
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D35B937-D4C5-40CC-AF5D-CE959101FB3F}
          3⤵
          • Executes dropped EXE
          PID:4936
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{70460EF6-367E-4DCF-A9AB-C649FB2E5766}
          3⤵
          • Executes dropped EXE
          PID:4520
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D509ADBD-1B15-41E8-82C4-1F85E96F8673}
          3⤵
          • Executes dropped EXE
          PID:3012
        • C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe
          C:\Windows\TEMP\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_is1EBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3CF6A58-8DC1-4D5A-ABF5-2B85B7377876}
          3⤵
          • Executes dropped EXE
          PID:3700
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1460
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3528
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4852
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2908
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3168
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:464
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1536
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:508
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3996
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2380
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4416
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4272
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:760
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4848
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1448
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2880
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4600
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:724
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1924
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2884
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{815261CE-944B-4743-B30A-984932DE8E26}
          3⤵
          • Executes dropped EXE
          PID:3012
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8452481C-1FB7-4246-8F1D-4A428F73E94E}
          3⤵
          • Executes dropped EXE
          PID:828
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DEED58A7-A8AD-4ED7-B18C-DE9352AC9BD8}
          3⤵
          • Executes dropped EXE
          PID:2752
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{20DA45DE-F4DA-4E3F-ABB1-E258F8EFA555}
          3⤵
          • Executes dropped EXE
          PID:444
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4969B06-5AE9-42E2-A907-C3219951CFCD}
          3⤵
          • Executes dropped EXE
          PID:2920
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E35B7719-3C6D-4096-99AA-BB567A3C27E8}
          3⤵
          • Executes dropped EXE
          PID:4920
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C949955A-E063-478B-A74D-3016E99F9E51}
          3⤵
          • Executes dropped EXE
          PID:4936
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{144EEC00-2804-4011-821B-D1A457BA9BCD}
          3⤵
          • Executes dropped EXE
          PID:4652
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC2454F1-3096-47BE-97D6-1F1A47B5E2AD}
          3⤵
          • Executes dropped EXE
          PID:2636
        • C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
          C:\Windows\TEMP\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2766AE3-1643-4CD5-8DD1-7A25242C94BE}
          3⤵
          • Executes dropped EXE
          PID:1020
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{70DF060B-F9F2-4926-BF20-8BC5559FE702}
          3⤵
          • Executes dropped EXE
          PID:996
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ACB07561-A622-44B4-BDBE-461D2CD3E127}
          3⤵
          • Executes dropped EXE
          PID:2636
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F0F7403-1DBA-4946-972E-20C655BADE8A}
          3⤵
          • Executes dropped EXE
          PID:3700
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD5FE7B2-92CB-4321-9E2C-07F956FB8072}
          3⤵
          • Executes dropped EXE
          PID:2360
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E52706DB-70CD-4804-888D-13814CF8C5F8}
          3⤵
          • Executes dropped EXE
          PID:1616
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{777A8D9D-4AE8-4B3F-B871-1B0CDBA88B54}
          3⤵
          • Executes dropped EXE
          PID:1972
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DE553CA-4204-430C-A7FA-0251DC1D2C8F}
          3⤵
          • Executes dropped EXE
          PID:3664
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4125C106-3A6E-4CF1-8762-31E34736ADED}
          3⤵
          • Executes dropped EXE
          PID:1524
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0724B383-076A-4A6D-AF06-3AB2380D1229}
          3⤵
          • Executes dropped EXE
          PID:4512
        • C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe
          C:\Windows\TEMP\{ACC89240-7C00-444D-A601-13F30862994C}\_is35A3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C7AC014E-8491-4F29-883B-0830EF7982E5}
          3⤵
          • Executes dropped EXE
          PID:704
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4860
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4728
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3604
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:2992
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:1248
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4512
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA8F7526-0E20-48C8-BDA2-ABF00B41BF8C}
              3⤵
              • Executes dropped EXE
              PID:2692
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59B39FE6-B8FE-40CB-B80F-E8C5BACDB623}
              3⤵
              • Executes dropped EXE
              PID:4272
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{23E8C4AA-8F2F-42AF-A365-8244EECA186D}
              3⤵
              • Executes dropped EXE
              PID:4016
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41AAAC8D-AF7A-4420-A14E-036914C443DD}
              3⤵
              • Executes dropped EXE
              PID:4428
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A5DA1906-9B8E-4408-A754-D54B40EEDA00}
              3⤵
              • Executes dropped EXE
              PID:2636
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B72B67A0-6FDA-4D2E-8B45-4011B30EBF06}
              3⤵
              • Executes dropped EXE
              PID:436
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A6707EF8-EDDA-4260-A3F6-8B263359D891}
              3⤵
              • Executes dropped EXE
              PID:2924
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{27EC0041-2D95-4363-A5AF-5F283FB43CC6}
              3⤵
              • Executes dropped EXE
              PID:1616
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B584C64B-2812-4365-AF10-DB4143BA7605}
              3⤵
              • Executes dropped EXE
              PID:2328
            • C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe
              C:\Windows\TEMP\{6260CA9E-269E-4D89-9BF7-05D94FBEBF20}\_is4768.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{775E5606-4BF4-4B19-8E80-639BA6C8DCAF}
              3⤵
              • Executes dropped EXE
              PID:4920
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1524
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6997E557-DA0F-4BB3-87F6-1FE19EA81122}
              3⤵
              • Executes dropped EXE
              PID:1616
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{76ECFB75-9D54-4BD7-BDE3-40AAE34BC38E}
              3⤵
              • Executes dropped EXE
              PID:5108
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F2708804-276E-4B76-9764-CC16695985DC}
              3⤵
              • Executes dropped EXE
              PID:4848
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{734B090B-AC49-43EE-8594-EFDBB674D7BD}
              3⤵
              • Executes dropped EXE
              PID:2376
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ACD21554-BE84-4054-809D-75E817E800C9}
              3⤵
              • Executes dropped EXE
              PID:624
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C07ECCB3-5E9C-4487-9165-288E9AFD42DB}
              3⤵
              • Executes dropped EXE
              PID:2880
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{87505087-4048-4088-BD9C-B672FCE5C5C4}
              3⤵
              • Executes dropped EXE
              PID:444
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{595E694F-0596-4C12-9BC9-A618197E71A9}
              3⤵
              • Executes dropped EXE
              PID:2692
            • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
              C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{738253E9-D132-4D26-82C0-7E7FEB2A86A2}
              3⤵
                PID:996
              • C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe
                C:\Windows\TEMP\{F24C89D7-5CD4-451A-90CA-E380C4F6E6E1}\_is4A09.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{062401D3-FEA2-4D64-9DDA-6CC8B0291791}
                3⤵
                  PID:5088
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2992
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:436
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 3162702C295456B924A517BB4C3CDA11 E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:5580
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSI8E82.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240684734 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                    3⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:6008
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSI8F6D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240684906 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5928
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSI925C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240685640 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                    3⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5792
                  • C:\Windows\SysWOW64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5384
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3016
                  • C:\Windows\SysWOW64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:5588
                  • C:\Windows\syswow64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5296
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4712
                  • C:\Windows\syswow64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:6008
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIB186.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240693609 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:6016
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  PID:5532
                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="fe74cee1-efb6-440c-ba5b-be30ab85602d"
                  2⤵
                  • Modifies data under HKEY_USERS
                  PID:5416
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:4836
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1792
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:3556
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "4f3eb375-3ec3-4c68-a0ca-05e47d8b55ce" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000CDtpOIAT
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  PID:4452
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "c23d8003-4869-46f8-8c00-33c4fac28954" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000CDtpOIAT
                  2⤵
                  • Executes dropped EXE
                  PID:3172
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "615b6fa2-196d-468c-9c31-5e02f13cf0bd" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000CDtpOIAT
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1528
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2672
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:4580
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "cab924b1-9ae8-49ed-bdfc-e718b1e7dfd6" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000CDtpOIAT
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1076
                  • C:\Windows\TEMP\SplashtopStreamer.exe
                    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2724
                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3472
                      • C:\Windows\SysWOW64\msiexec.exe
                        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:116
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "d22c97e2-313d-4ef6-8e62-7d8cc5bb547a" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000CDtpOIAT
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3328
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious use of WriteProcessMemory
                PID:1556
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:1448
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "8568b9f8-db06-4676-a955-4b77e04bf04d" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000CDtpOIAT
                  2⤵
                  • Executes dropped EXE
                  PID:4612
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "84b8a4f7-4ad5-4f74-b56a-fd805ce020c6" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000CDtpOIAT
                  2⤵
                    PID:2456
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      3⤵
                        PID:3996
                        • C:\Windows\system32\cscript.exe
                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          4⤵
                          • Modifies data under HKEY_USERS
                          PID:1160
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "a6086802-ba62-4689-98c6-e649fc565598" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000CDtpOIAT
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Modifies data under HKEY_USERS
                      PID:2440
                      • C:\Windows\SYSTEM32\msiexec.exe
                        "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                        3⤵
                        • Modifies data under HKEY_USERS
                        PID:5440
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "1a9ca352-cef2-45f9-b5de-bba73862bef7" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000CDtpOIAT
                      2⤵
                      • Modifies data under HKEY_USERS
                      PID:4748
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=dd09f74ed96bbe814dd91f054ecfb569&rmm_session_pwd_ttl=86400"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3624
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "55714e44-6309-4dcd-a4a2-413be455ab70" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000CDtpOIAT
                      2⤵
                      • Drops file in Program Files directory
                      PID:2980
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "1eeeee47-5e1e-40c6-83fb-740b0ae78dc0" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000CDtpOIAT
                      2⤵
                      • Modifies registry class
                      PID:2360
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "a9315d12-26cc-44c4-a28e-ebbb262c2efc" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000CDtpOIAT
                      2⤵
                      • Drops file in System32 directory
                      PID:5760
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "ba410638-8fb3-4d08-bd1c-cdf126ddf46a" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000CDtpOIAT
                      2⤵
                      • Drops file in System32 directory
                      PID:3252
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "ad16ec3d-59f3-4211-816d-e8d8d0ef1587" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000CDtpOIAT
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      PID:5480
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "dc8ff35d-85a8-4f49-8f9f-f0309a2818e9" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000CDtpOIAT
                      2⤵
                      • Drops file in System32 directory
                      PID:6060
                      • C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe
                        "C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd dc8ff35d-85a8-4f49-8f9f-f0309a2818e9 agent-api.atera.com/Production 443 or8ixLi90Mf connect 001Q300000CDtpOIAT
                        3⤵
                          PID:600
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "8f386ec0-3910-4ccf-b462-8feaccdae9e6" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000CDtpOIAT
                        2⤵
                        • Drops file in System32 directory
                        PID:5256
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "0c2144f0-feec-4c1b-a175-cb7499c7cee2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000CDtpOIAT
                        2⤵
                        • Drops file in System32 directory
                        PID:5604
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "447de4de-f235-487a-84f3-dded33c1e154" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000CDtpOIAT
                        2⤵
                          PID:5888
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "133deb32-744b-4ee2-9ed0-8ebe05351404" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000CDtpOIAT
                          2⤵
                          • Drops file in Program Files directory
                          PID:5896
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                            3⤵
                            • System Time Discovery
                            PID:5660
                            • C:\Program Files\dotnet\dotnet.exe
                              dotnet --list-runtimes
                              4⤵
                              • System Time Discovery
                              PID:5788
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "fd676e3f-c81b-40a9-8da2-6b2494269109" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000CDtpOIAT
                          2⤵
                            PID:6040
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "f104a8a8-c6d6-4fa3-a6c6-193cc8505304" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000CDtpOIAT
                            2⤵
                            • Drops file in System32 directory
                            PID:5564
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2636
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                            2⤵
                            • Drops file in System32 directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:444
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                              -h
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:2884
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3608
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                4⤵
                                  PID:3996
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:804
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:2604
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                  SRUtility.exe -r
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4824
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:5740
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                  4⤵
                                    PID:5792
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ver
                                      5⤵
                                        PID:4900
                                      • C:\Windows\system32\sc.exe
                                        sc query ddmgr
                                        5⤵
                                        • Launches sc.exe
                                        PID:4712
                                      • C:\Windows\system32\sc.exe
                                        sc query lci_proxykmd
                                        5⤵
                                        • Launches sc.exe
                                        PID:1004
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                        5⤵
                                        • Drops file in System32 directory
                                        • Checks SCSI registry key(s)
                                        • Modifies data under HKEY_USERS
                                        PID:5844
                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                1⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:6084
                                • C:\Windows\System32\sc.exe
                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                  2⤵
                                  • Launches sc.exe
                                  PID:5512
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "2074c2bd-b347-46a6-acd1-90b2771205c3" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000CDtpOIAT
                                  2⤵
                                    PID:4392
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "810963a3-3f15-4e4c-852d-02e85d9f3998" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000CDtpOIAT
                                    2⤵
                                      PID:5796
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "74918492-f372-4e1a-b0b2-8d52eb2041ce" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000CDtpOIAT
                                      2⤵
                                        PID:1332
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "f469827e-4a11-46cb-8ba6-6d7979efa5be" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000CDtpOIAT
                                        2⤵
                                          PID:2256
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "b3c1fc8d-ce69-4b37-a986-f7b999784aea" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000CDtpOIAT
                                          2⤵
                                          • Drops file in Program Files directory
                                          PID:3424
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                            3⤵
                                              PID:2412
                                              • C:\Windows\system32\cscript.exe
                                                cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                4⤵
                                                • Modifies data under HKEY_USERS
                                                PID:5868
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "199f23ce-4a38-4dff-a6f7-852ffc1ee5d5" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000CDtpOIAT
                                            2⤵
                                              PID:5580
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "31a2dc0e-c986-4b2b-a467-1d4dfd55ed22" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000CDtpOIAT
                                              2⤵
                                                PID:4380
                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=dd09f74ed96bbe814dd91f054ecfb569&rmm_session_pwd_ttl=86400"
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5908
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "cdd93374-bf11-43b3-bea3-471e76e7e0b8" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000CDtpOIAT
                                                2⤵
                                                  PID:4048
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "0eec0a97-973f-48f0-858e-8905dffd164a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000CDtpOIAT
                                                  2⤵
                                                    PID:3928
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                      3⤵
                                                      • System Time Discovery
                                                      PID:4928
                                                      • C:\Program Files\dotnet\dotnet.exe
                                                        dotnet --list-runtimes
                                                        4⤵
                                                        • System Time Discovery
                                                        PID:6112
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "cef31d87-a314-4565-831f-5ef9cc67168d" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000CDtpOIAT
                                                    2⤵
                                                      PID:1336
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "aaf387b4-b41d-4412-9891-ef80a5bed657" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000CDtpOIAT
                                                      2⤵
                                                      • Writes to the Master Boot Record (MBR)
                                                      PID:6040
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "ab653402-2b42-4923-af7c-6946782ed913" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000CDtpOIAT
                                                      2⤵
                                                        PID:1700
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "a1b226c4-bd1b-476d-a1d0-a26f3651b3d1" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000CDtpOIAT
                                                        2⤵
                                                          PID:5560
                                                          • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                            "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd" "a1b226c4-bd1b-476d-a1d0-a26f3651b3d1" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000CDtpOIAT"
                                                            3⤵
                                                              PID:1452
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0496ae7b-1ba3-4fcb-b4dc-dae480fbe2dd "810963a3-3f15-4e4c-852d-02e85d9f3998" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000CDtpOIAT
                                                            2⤵
                                                              PID:5236
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            PID:2300
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000138" "WinSta0\Default" "000000000000014C" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              • Modifies data under HKEY_USERS
                                                              PID:5324
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000170" "WinSta0\Default" "000000000000014C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              • Modifies data under HKEY_USERS
                                                              PID:1572
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000170"
                                                              2⤵
                                                              • Drops file in Drivers directory
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              PID:5592
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                              2⤵
                                                              • Drops file in Drivers directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              PID:5484

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Execution

                                                          Persistence

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Privilege Escalation

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Defense Evasion

                                                          Modify Registry

                                                          1
                                                          T1112

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Subvert Trust Controls

                                                          1
                                                          T1553

                                                          Install Root Certificate

                                                          1
                                                          T1553.004

                                                          System Binary Proxy Execution

                                                          1
                                                          T1218

                                                          Msiexec

                                                          1
                                                          T1218.007

                                                          Credential Access

                                                          Discovery

                                                          Peripheral Device Discovery

                                                          2
                                                          T1120

                                                          Query Registry

                                                          4
                                                          T1012

                                                          System Information Discovery

                                                          3
                                                          T1082

                                                          System Location Discovery

                                                          1
                                                          T1614

                                                          System Language Discovery

                                                          1
                                                          T1614.001

                                                          System Time Discovery

                                                          1
                                                          T1124

                                                          Lateral Movement

                                                          Collection

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Config.Msi\e57c044.rbs
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            2e3e1870e1f1127a799a0f67a210cf60

                                                            SHA1

                                                            7ddaa8f26aa5abc489d664728f0b1b13b1a06fd3

                                                            SHA256

                                                            a2cc13003a10d43a8d0826eebd773248dd7b4892f2a3136f439cd30f600dbc8b

                                                            SHA512

                                                            2d673fa8f663ffc2c52ad7454e76580b55eaf93028a3620b3eef9f3b07337648587ad00022a4f3c067d4ae5075c08832690c8436b4bffc528f8994531b52a9bc

                                                            Download Submit

                                                          • C:\Config.Msi\e57c049.rbs
                                                            Filesize

                                                            74KB

                                                            MD5

                                                            e081790adb33f8ef294fb1be912b3ccf

                                                            SHA1

                                                            7bb9ed0b65cd10fe53fa9685d95c7c3a2d872d4f

                                                            SHA256

                                                            0cced86451170edb252eb00813056e9aeec104d9322acae3dc97959a0f5651cf

                                                            SHA512

                                                            3e6a2be79b9f5f3b2da5a05f573477fb38d82d726ea0779cc8ebe0319d37f12a66c129acafd738a0da63ed56a7acf5cd5858bb564813831079848d1edd945b12

                                                            Download Submit

                                                          • C:\Config.Msi\e57c04b.rbs
                                                            Filesize

                                                            464B

                                                            MD5

                                                            31d603bdc92e5456274cfb41c252420a

                                                            SHA1

                                                            ceca80b69df35efbb189c157a970af806d27eceb

                                                            SHA256

                                                            e6715dd98325787b425465e0412431925c96c8b2088ea03273a70a6c9657cf59

                                                            SHA512

                                                            d886621c9d2c84967096fded37badcde0dad6d6d8887b24b870454c00a7574d4b80fcabf4936ba3bed289b691cbed6c3a9fa1af4acad55c0bb7931df16923ff6

                                                            Download Submit

                                                          • C:\Config.Msi\e57c051.rbs
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            9d370e6efb83f8036d0313791e6f9041

                                                            SHA1

                                                            310485df3dc6246214d03bd230d391e03248f0cc

                                                            SHA256

                                                            1493646ddd8470349aaa1a493531ea6e0589c0109f1cf3a2905cc34f2cb4a8a8

                                                            SHA512

                                                            c20e606d7e1e7391071a963a0d801eb6be27826eedb4c6763ba18aeeed5a3551ef4a5b2d623d67db997683a20c1ac23cd1bc0e1dad465d8ad62a6a72b3318650

                                                            Download Submit

                                                          • C:\Config.Msi\e57c059.rbs
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            629980f4fb8575b4a9efd6799f36a044

                                                            SHA1

                                                            3595c046d76cea62405f4f462e4c725fbaa3bed7

                                                            SHA256

                                                            9ed638423761ce8ea7509c9dbcd26f1cbd69d21c78800670a6b0447774399fc6

                                                            SHA512

                                                            93053ef7cef47681ac6db11ff829abd80a8d62f2bc4600a03bcaa85fcf2a281d428b54022fc2a1b3f01f61d80d1ee12f2eb3d2cedb631c5ca4f064d95a3aacf4

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            337079222a6f6c6edf58f3f981ff20ae

                                                            SHA1

                                                            1f705fc0faa84c69e1fe936b34783b301323e255

                                                            SHA256

                                                            ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                            SHA512

                                                            ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                            Filesize

                                                            142KB

                                                            MD5

                                                            477293f80461713d51a98a24023d45e8

                                                            SHA1

                                                            e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                            SHA256

                                                            a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                            SHA512

                                                            23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            b3bb71f9bb4de4236c26578a8fae2dcd

                                                            SHA1

                                                            1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                            SHA256

                                                            e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                            SHA512

                                                            fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                            Filesize

                                                            210KB

                                                            MD5

                                                            c106df1b5b43af3b937ace19d92b42f3

                                                            SHA1

                                                            7670fc4b6369e3fb705200050618acaa5213637f

                                                            SHA256

                                                            2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                            SHA512

                                                            616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                            Filesize

                                                            693KB

                                                            MD5

                                                            2c4d25b7fbd1adfd4471052fa482af72

                                                            SHA1

                                                            fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                            SHA256

                                                            2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                            SHA512

                                                            f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                            Filesize

                                                            158KB

                                                            MD5

                                                            1922740d2479c7d0cd6fb57c3d739543

                                                            SHA1

                                                            877a807a396156be1d0c2782391cabc29ea15760

                                                            SHA256

                                                            20443f66e184311fd412158cb162e36b0172332cd6d401cec9ee5fe17df75e58

                                                            SHA512

                                                            d624bad0fcd8afc190a5de241da341a3f39d6aaa0e5eacdf8b14e8e74515b688f06e2cdc75da0634880ea98238a1d26cd2d2bfaedb6d92067dace99d0963975c

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\data\iot_conf.json
                                                            Filesize

                                                            189B

                                                            MD5

                                                            b16931b4932adff567052955075e04f1

                                                            SHA1

                                                            cc57b84c38bb823f952001e03b5f4584fda6df73

                                                            SHA256

                                                            57135bc14ef7765a60ba3cb2ac6ea81f221133ea5c368490420a8b8ba2b99d75

                                                            SHA512

                                                            a5977715a72725e570dd766813564c7965f6b539a64e18d55355c5e7474ceb9b27134959369d30587f8547bfb383ce5857d37e6e073fcf5740fba24e749fb9b3

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                            Filesize

                                                            157KB

                                                            MD5

                                                            63f830bc220b8af1381f2210fdf6a258

                                                            SHA1

                                                            5651a89b75ba320ba3133826c9fca7f5baa0fbbb

                                                            SHA256

                                                            a82eec1added638aa86d4e66f3b3789e8f7e40a15d0be3b01fbe50ca85b99f9c

                                                            SHA512

                                                            ae2884f99833f11a5ce73843bb675de13c3dd362602352b3e8d3f6815bc03fb9a681f0adfeb677fa575bf3395734fc9e07ea05896e8698f875f7a6b01276a31c

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                            Filesize

                                                            51KB

                                                            MD5

                                                            3180c705182447f4bcc7ce8e2820b25d

                                                            SHA1

                                                            ad6486557819a33d3f29b18d92b43b11707aae6e

                                                            SHA256

                                                            5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                            SHA512

                                                            228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                            Filesize

                                                            12B

                                                            MD5

                                                            eb053699fc80499a7185f6d5f7d55bfe

                                                            SHA1

                                                            9700472d22b1995c320507917fa35088ae4e5f05

                                                            SHA256

                                                            bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                            SHA512

                                                            d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                            Filesize

                                                            173KB

                                                            MD5

                                                            fd9df72620bca7c4d48bc105c89dffd2

                                                            SHA1

                                                            2e537e504704670b52ce775943f14bfbaf175c1b

                                                            SHA256

                                                            847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                            SHA512

                                                            47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                            Filesize

                                                            546B

                                                            MD5

                                                            158fb7d9323c6ce69d4fce11486a40a1

                                                            SHA1

                                                            29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                            SHA256

                                                            5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                            SHA512

                                                            7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                            Filesize

                                                            688KB

                                                            MD5

                                                            3ef8d12aa1d48dec3ac19a0ceabd4fd8

                                                            SHA1

                                                            c81b7229a9bd55185a0edccb7e6df3b8e25791cf

                                                            SHA256

                                                            18c1ddbdbf47370cc85fa2cf7ba043711ab3eadbd8da367638686dfd6b735c85

                                                            SHA512

                                                            0ff2e8dbfef7164b22f9ae9865e83154096971c3f0b236d988ab947e803c1ed03d86529ab80d2be9ff33af305d34c9b30082f8c26e575f0979ca9287b415f9f9

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            Filesize

                                                            27KB

                                                            MD5

                                                            797c9554ec56fd72ebb3f6f6bef67fb5

                                                            SHA1

                                                            40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                            SHA256

                                                            7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                            SHA512

                                                            4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                            Filesize

                                                            214KB

                                                            MD5

                                                            01807774f043028ec29982a62fa75941

                                                            SHA1

                                                            afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                            SHA256

                                                            9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                            SHA512

                                                            33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                            Filesize

                                                            37KB

                                                            MD5

                                                            efb4712c8713cb05eb7fe7d87a83a55a

                                                            SHA1

                                                            c94d106bba77aecf88540807da89349b50ea5ae7

                                                            SHA256

                                                            30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                            SHA512

                                                            3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                            Filesize

                                                            3.4MB

                                                            MD5

                                                            e010d1f614b1a830482d3df4ba056f24

                                                            SHA1

                                                            5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                            SHA256

                                                            98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                            SHA512

                                                            727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                            Filesize

                                                            389KB

                                                            MD5

                                                            5e3252e0248b484e76fcdbf8b42a645d

                                                            SHA1

                                                            11ae92fd16ac87f6ab755911e85e263253c16516

                                                            SHA256

                                                            01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                            SHA512

                                                            540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            95658e26b99ace22731f0b41cb21ac5d

                                                            SHA1

                                                            33cf18eca3f699b9c50432184cca8b5ee7d34224

                                                            SHA256

                                                            c3dc65e185f31c1a21caf406621459b1e3c2b4f405fe9b9f5819566622599904

                                                            SHA512

                                                            a7583c2cb7b003ca1f91d332799f41b0879ab4bd18a1d8b7238b04671062636e4b9dc7037563621df431322cc55990112ee74369236d39d2e3a40bd2cc4af579

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            Filesize

                                                            196KB

                                                            MD5

                                                            680bac4393da4dafe0100d9483d3b6e4

                                                            SHA1

                                                            ed211ef61232c5aacee7ca168659f02f9d4f4e53

                                                            SHA256

                                                            c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                                                            SHA512

                                                            5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            Filesize

                                                            56KB

                                                            MD5

                                                            0f33a7acb33960d1306ba418405d8264

                                                            SHA1

                                                            bc24c37727b00d514446c8b5fb6c04f36254a067

                                                            SHA256

                                                            a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                            SHA512

                                                            72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            9d1528a2ce17522f6de064ae2c2b608e

                                                            SHA1

                                                            2f1ce8b589e57ab300bb93dde176689689f75114

                                                            SHA256

                                                            11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                            SHA512

                                                            a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.2980.update
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            14ffcf07375b3952bd3f2fe52bb63c14

                                                            SHA1

                                                            ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                            SHA256

                                                            6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                            SHA512

                                                            14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            c260590c60a50f3c4d358ae14f2c979b

                                                            SHA1

                                                            0a474f1f41cd4fe4369728f4ff20d0a33f1bfc1a

                                                            SHA256

                                                            be86421c56f1571f33e163bc3b427e02d1443aed62e73f7eff2f8607f3147863

                                                            SHA512

                                                            63183d18f33aa2d163a3d415127402eec29d5f8850aae3477857a6b929d35680e723d4f341390ca7f8fb9ccb7cfa0a9f450ddb9ff22da1b30facef7edb8a8afb

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                            Filesize

                                                            2B

                                                            MD5

                                                            81051bcc2cf1bedf378224b0a93e2877

                                                            SHA1

                                                            ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                            SHA256

                                                            7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                            SHA512

                                                            1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                            Filesize

                                                            54KB

                                                            MD5

                                                            77c613ffadf1f4b2f50d31eeec83af30

                                                            SHA1

                                                            76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                            SHA256

                                                            2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                            SHA512

                                                            29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                            Filesize

                                                            334KB

                                                            MD5

                                                            2e2e6e6702fa92da8c08fa85617fa861

                                                            SHA1

                                                            bee96d85e39faa0d6f60fc797e0c4f0e9c01ed67

                                                            SHA256

                                                            565bbd4ed69c929cb00ce6552633382bfe46248b6e9db3293b9c031875c02b35

                                                            SHA512

                                                            35eaf569f94c69749308d30722589331ea1957f3a11f440b1eccc4aa32284681162128b2febef76c75181b49e5e57d780685a22e14e1900ffc7add3f83ac075e

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                            Filesize

                                                            71KB

                                                            MD5

                                                            5129e29d4d9a8ed94e04099622316b37

                                                            SHA1

                                                            be1c537ad5fc51bd28bd3ea23e16cbfbdaf01dfd

                                                            SHA256

                                                            17c1a413747e1dbf203f1824e45ddc0dc7afe4c529bca88cdb670f019d95db11

                                                            SHA512

                                                            7b8a1d79c069cdcbebd57255d11d96e13e291df8b99c15d6c969a66ef8af8639fac92e22b233b4b6f8b33a9c52ba2936fe59ecee2acf78c571f4920ea075e4bb

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                            Filesize

                                                            50KB

                                                            MD5

                                                            254dcbee3213189461b66e962ce8cc05

                                                            SHA1

                                                            cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                                                            SHA256

                                                            e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                                                            SHA512

                                                            7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            Filesize

                                                            32KB

                                                            MD5

                                                            db1db66ebd9b15b7dcd55374ea56ee5e

                                                            SHA1

                                                            c22897eb20900a66cf62023c37d6a7d1192aec3d

                                                            SHA256

                                                            0263a627bbea55a66deecd7a43f8537bb68b5f95bb3d4269d3e594bd1d851e64

                                                            SHA512

                                                            b56b2143a60e6153e7fb752029c72d78547d5253f32ecbd0dda5a8acc5c3859292e860162b11a041a37b4f618f4425484b4e2385d7e2c621c8cbced073e3a67e

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                            Filesize

                                                            56KB

                                                            MD5

                                                            e9794f785780945d2dde78520b9bb59f

                                                            SHA1

                                                            293cae66cedbc7385cd49819587d3d5a61629422

                                                            SHA256

                                                            0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                                                            SHA512

                                                            1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                            Filesize

                                                            588KB

                                                            MD5

                                                            17d74c03b6bcbcd88b46fcc58fc79a0d

                                                            SHA1

                                                            bc0316e11c119806907c058d62513eb8ce32288c

                                                            SHA256

                                                            13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                            SHA512

                                                            f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                            Filesize

                                                            204B

                                                            MD5

                                                            b8c5966180d58d47279bc8ab1eeba263

                                                            SHA1

                                                            30bc04f5f94e447f4ebdef0965831660b9de5740

                                                            SHA256

                                                            e7dea93435e17adec32e01471028f3addd9ac3d660d5e2b832a98cf67f1a9bcc

                                                            SHA512

                                                            3778b27bddc20a1df9c43ecf4addd51fd699cb1c44c3855f0e12fed136e885d6024c41de1f4e38484b6060a77e9267536e12ec823a408d586ca4d460bc3ec98a

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            1ef7574bc4d8b6034935d99ad884f15b

                                                            SHA1

                                                            110709ab33f893737f4b0567f9495ac60c37667c

                                                            SHA256

                                                            0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                            SHA512

                                                            947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            f512536173e386121b3ebd22aac41a4e

                                                            SHA1

                                                            74ae133215345beaebb7a95f969f34a40dda922a

                                                            SHA256

                                                            a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                            SHA512

                                                            1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                            Filesize

                                                            76KB

                                                            MD5

                                                            b40fe65431b18a52e6452279b88954af

                                                            SHA1

                                                            c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                            SHA256

                                                            800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                            SHA512

                                                            e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                            Filesize

                                                            80KB

                                                            MD5

                                                            3904d0698962e09da946046020cbcb17

                                                            SHA1

                                                            edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                            SHA256

                                                            a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                            SHA512

                                                            c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                            Filesize

                                                            92KB

                                                            MD5

                                                            918357c5c347e3ad0aa14abd4edc2f4a

                                                            SHA1

                                                            050f5e8c191c02f829fb34fae0f1968976053ae7

                                                            SHA256

                                                            5368fce35616037ef6dab669e77e36edeacaa12175b45bca894b2b7a335e2938

                                                            SHA512

                                                            dd2d92a12b5201cd30a8faf11d405a7ff86dd168c23a149d9c8f8615bfb4e56f194fce33204883eed16add34739a796a621c04e951f7f1bfec54280b73ff2425

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                            Filesize

                                                            7KB

                                                            MD5

                                                            362ce475f5d1e84641bad999c16727a0

                                                            SHA1

                                                            6b613c73acb58d259c6379bd820cca6f785cc812

                                                            SHA256

                                                            1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                            SHA512

                                                            7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                            Filesize

                                                            1.9MB

                                                            MD5

                                                            dc34fb149320b8344ef62548a634f290

                                                            SHA1

                                                            d5008caa155335ec563e47f00ab83c1b87ac732a

                                                            SHA256

                                                            5caeaa7a9f680c9e332d445b2a0b1679e028fe92ad3ed713c51a24acfc1eaed4

                                                            SHA512

                                                            97ccdbbff6b6ea6b644cabc285c0e6147c43f9b3fa451a8b7851fd0664dc9504fffe3223205f11ce2b3d6ba816891393a86aeecf86bd6daf06c889421a91192b

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            9a9b1fd85b5f1dcd568a521399a0d057

                                                            SHA1

                                                            34ed149b290a3a94260d889ba50cb286f1795fa6

                                                            SHA256

                                                            88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                            SHA512

                                                            7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                            Filesize

                                                            375KB

                                                            MD5

                                                            4a09a87d2004dac4b00687e9c9f15036

                                                            SHA1

                                                            c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                                                            SHA256

                                                            2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                                                            SHA512

                                                            f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                            Filesize

                                                            321KB

                                                            MD5

                                                            d3901e62166e9c42864fe3062cb4d8d5

                                                            SHA1

                                                            c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                            SHA256

                                                            dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                            SHA512

                                                            ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                            Filesize

                                                            814KB

                                                            MD5

                                                            9b1f97a41bfb95f148868b49460d9d04

                                                            SHA1

                                                            768031d5e877e347a249dfdeab7c725df941324b

                                                            SHA256

                                                            09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                            SHA512

                                                            9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            e74d2a16da1ddb7f9c54f72b8a25897c

                                                            SHA1

                                                            32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                            SHA256

                                                            a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                            SHA512

                                                            52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                            Filesize

                                                            11B

                                                            MD5

                                                            5eda46a55c61b07029e7202f8cf1781c

                                                            SHA1

                                                            862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                            SHA256

                                                            12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                            SHA512

                                                            4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                            Filesize

                                                            12B

                                                            MD5

                                                            5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                            SHA1

                                                            93012724e6cc0a298838aede678806e6c0c6517d

                                                            SHA256

                                                            a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                            SHA512

                                                            890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            4fbd84a16c25582a2b719a3634aa1575

                                                            SHA1

                                                            2a4c007725645596f511d17268e120dd9e7d89e1

                                                            SHA256

                                                            27f92025037365f596fb0f69b7af8f67614c7202b87f34fab0d856805684db13

                                                            SHA512

                                                            9149ab7a5f7629559e9cdda1f569350711b567fdd2a76537fe97d678678019f21a7a5c0d6304597142bccad9739429cfd2e11648f2b95e5a1c02b000bfd9c97f

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            f50362d347fd83f53cceaf044170f8a2

                                                            SHA1

                                                            e2872110cb794e7fd22e7e77c3663550ca5e1d57

                                                            SHA256

                                                            8f4038d544d4ab60d996e2192fe747dacf75274626d39251b6b61b409fda18d4

                                                            SHA512

                                                            dde5f42e76b6d3900a28422f3e9d5cfbc5a76f46dd18ea8656205ff2ea50c05acd2f5b8b74c6687aac7fedf077ef4536ee6ec9cb0da49171405c632f3b4c99b3

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                            Filesize

                                                            2.8MB

                                                            MD5

                                                            a7bf0da8e308248aefd69586e1f8a312

                                                            SHA1

                                                            f1df1b8f00087260c9c7c2ba46cb98903f98bf73

                                                            SHA256

                                                            b8c4a5ec9357ace0e98bf2e7550d691af280a387fc9636260ea6bc2c2b5b6ba6

                                                            SHA512

                                                            e9edd7b668136e3a16b070c13bedb5465ab1cee02cc84f84f40a80aca12cd3ce2a781724f53fecae891a390fc257bec727fb6e4756f644597785ff21107071fd

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                            Filesize

                                                            2.9MB

                                                            MD5

                                                            7805ea1a8dd15cac328b826efe38c2a9

                                                            SHA1

                                                            66ff8eafb2424717c4394bae28a8683db1244527

                                                            SHA256

                                                            7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                                                            SHA512

                                                            17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            6c6f85e896655a6eb726482f04c49086

                                                            SHA1

                                                            2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                            SHA256

                                                            e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                            SHA512

                                                            b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                            Filesize

                                                            541B

                                                            MD5

                                                            d0efb0a6d260dbe5d8c91d94b77d7acd

                                                            SHA1

                                                            e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                            SHA256

                                                            7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                            SHA512

                                                            a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                            Filesize

                                                            12B

                                                            MD5

                                                            213da2b23ec7ec5259829958b2cf42be

                                                            SHA1

                                                            5b7dfb867ed116395f0c8d8299d7357e1f5355fc

                                                            SHA256

                                                            eb70db8191a629c3c2a53d07ee68ce9e4a906defd701b4a08cab8a410df29457

                                                            SHA512

                                                            2b5500f9062c8c44ee4bb2ba81f4b0f948e07c1182525fbdc72a1ab6e304055e04100cce41dc3e68a7cec3557ed39a755eb1ef38e3db6cf56102f5a20e6601d2

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                            Filesize

                                                            646KB

                                                            MD5

                                                            0e6af651f8be91dc9dde2faab59c9a77

                                                            SHA1

                                                            f199693bb55864f8497227c1c14244ff3e6e423e

                                                            SHA256

                                                            895f2593cf3f365046f33e9cf5ebcb2a17e7af1c592decc82bfe8ff5d5653a20

                                                            SHA512

                                                            fd770888310dd2e58124eae49bdc6e715fde9b100010ef224e10f6a757629c2c55d12c0e4cede3f8cf8e89d1267e4820c9bf82df5f6263675ecc3596895da4af

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                            Filesize

                                                            570KB

                                                            MD5

                                                            b50834694383960830cf48d9836e1108

                                                            SHA1

                                                            adc80813181b98a8296befa2960a55f939f3bfee

                                                            SHA256

                                                            370a259808052366888284b0cc4c91ff8f23e8008003959b8d0efb1adbf00cd6

                                                            SHA512

                                                            f87be933e87275b000be031aa5df7536dfd5fe9b99a607ce0904f206e074d3a0687a00654b9b78edaa2fccf3d30526e0ee5bd7dcba4a5daafd6fc60eeaaa15c5

                                                            Download Submit

                                                          • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\d9c7afc64790f0a77a153492dd789e54
                                                            Filesize

                                                            16KB

                                                            MD5

                                                            b2e89027a140a89b6e3eb4e504e93d96

                                                            SHA1

                                                            f3b1b34874b73ae3032decb97ef96a53a654228f

                                                            SHA256

                                                            5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                            SHA512

                                                            93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                            Download Submit

                                                          • C:\ProgramData\chocolatey\config\chocolatey.config
                                                            Filesize

                                                            809B

                                                            MD5

                                                            8b6737800745d3b99886d013b3392ac3

                                                            SHA1

                                                            bb94da3f294922d9e8d31879f2d145586a182e19

                                                            SHA256

                                                            86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                            SHA512

                                                            654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                            Download Submit

                                                          • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                            Filesize

                                                            12KB

                                                            MD5

                                                            e2ee2818cf884e388aaafc6603f49d98

                                                            SHA1

                                                            45711227e6e830b7cfeb3250c52477174b0e62ac

                                                            SHA256

                                                            6aec29bcd2b6bee4740e68cd292e5206f77d09376e56bbae88113daa7c11b0eb

                                                            SHA512

                                                            fd3ca99dfe4848be0314e0a449d3af87ebd9c3988e4addf86f42407e070444679f52aa16095f14e0136723226f60fbc723e21e0b16d2c4268f7f6d9c3b3eba13

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            Filesize

                                                            471B

                                                            MD5

                                                            f3c6f090f58cee21def3cd3334cfa542

                                                            SHA1

                                                            d6fc5e0ee2c3a5433a5d8bf1c76ba14c26fac55f

                                                            SHA256

                                                            9e2ebb439e6a8e0bb85607310b7f5d6f296db6d569298ce00863d33586c610df

                                                            SHA512

                                                            96ee1c1301710a00dfea11fb90ebb4a3b841d6d1172b26edbb9e6dfa2056a9cbac4cb1fdf9e31a98b431a9c4df50aecca798a5a485a32d46fc8bc20c0a51a170

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            727B

                                                            MD5

                                                            3d68335565b19f8928f8a9147890344b

                                                            SHA1

                                                            ed6483c411360019dc2796b55b1e85b57cfd0d9d

                                                            SHA256

                                                            14ae2cba9450d35be5ece603b032b8278c6a347ecf10674ad47b245575294b42

                                                            SHA512

                                                            8b70ec16a7c842100c39e76407353405e4ec0b67bdff9b64337a89ced807fb80dc705e99b1f5ccda14e7d5242b10c9fca11ca97f5ce13d84f5b07e9a8a2fcd70

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            727B

                                                            MD5

                                                            9dc681719141d6285e1a886a66fdbb0d

                                                            SHA1

                                                            7c2120aa6819ae2e65085c333dc8a0d1a090f610

                                                            SHA256

                                                            1ea55bf0375c0bf1de623a165ef099c20b407a2fef923c8bd42bce03361fd989

                                                            SHA512

                                                            2f4752ee13ce897f6532935dacee382549fbc17bffab7d86e496b48380c4006a4098be89fb1765d6fc79d90fee03d6ced52cb02928272dbeb57d2588ef14aa63

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            Filesize

                                                            400B

                                                            MD5

                                                            48c7a291dc869a5b32dddb0b61fcd3ff

                                                            SHA1

                                                            045795ed2ef6ee6a1cafc1da0f3091eac92feba6

                                                            SHA256

                                                            39692e289709773ac48b1df27e8ba6dddcb7034c1439f36990de087581e022b9

                                                            SHA512

                                                            5b6386caf9d77331f2f99e7770197b1af9aeeede67ddfcaacaa00a0068fa682995605e2d516a4ebcbab96733ceece8d64261ad4f0a37bff620737587b3c5fd0c

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            404B

                                                            MD5

                                                            0615f5b20d4b2709d47b5dac51ac25eb

                                                            SHA1

                                                            cc43e90b92bc9fb64c2415616a7d762548e9caac

                                                            SHA256

                                                            54b1af3275245a53586a7878cf00c2e933ef6ee78f1407e3596a02b2c2232620

                                                            SHA512

                                                            668cdb66b77bdb152f0397eba39aa15fd282fe03884f316f6a0b118e9ed85e851d0960555e7ce0df1dd7497d5d55e969deb9bba14be7190e830e5011cfb78f21

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            412B

                                                            MD5

                                                            2fe3218825ac2a01e21fe529b4297978

                                                            SHA1

                                                            4ea5cf3ca89a8c761698bfc6342597d815496bc6

                                                            SHA256

                                                            2b2e51c463a1a82dea9cf08ba45ba0dcbd20a71ce090e095dc4241da21bd8f8e

                                                            SHA512

                                                            8babf3bd39fb775b5e7d9fc6c1159938eadb8714501b668d0fcf5d3cbadf7fe8eb9af2da6a05df0430a9760361f5a75bfd2c4781605deb346a166ea21ca241f9

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                            Filesize

                                                            651B

                                                            MD5

                                                            9bbfe11735bac43a2ed1be18d0655fe2

                                                            SHA1

                                                            61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                            SHA256

                                                            549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                            SHA512

                                                            a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                            Download Submit

                                                          • C:\Windows\Installer\MSI3513.tmp
                                                            Filesize

                                                            4.5MB

                                                            MD5

                                                            08211c29e0d617a579ffa2c41bde1317

                                                            SHA1

                                                            4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                            SHA256

                                                            3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                            SHA512

                                                            d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                            Download Submit

                                                          • C:\Windows\Installer\MSI8E82.tmp-\System.Management.dll
                                                            Filesize

                                                            60KB

                                                            MD5

                                                            878e361c41c05c0519bfc72c7d6e141c

                                                            SHA1

                                                            432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                            SHA256

                                                            24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                            SHA512

                                                            59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC0CF.tmp
                                                            Filesize

                                                            509KB

                                                            MD5

                                                            88d29734f37bdcffd202eafcdd082f9d

                                                            SHA1

                                                            823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                            SHA256

                                                            87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                            SHA512

                                                            1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC0CF.tmp-\AlphaControlAgentInstallation.dll
                                                            Filesize

                                                            25KB

                                                            MD5

                                                            aa1b9c5c685173fad2dabebeb3171f01

                                                            SHA1

                                                            ed756b1760e563ce888276ff248c734b7dd851fb

                                                            SHA256

                                                            e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                            SHA512

                                                            d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC0CF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            1a5caea6734fdd07caa514c3f3fb75da

                                                            SHA1

                                                            f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                            SHA256

                                                            cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                            SHA512

                                                            a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC3CE.tmp-\CustomAction.config
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            bc17e956cde8dd5425f2b2a68ed919f8

                                                            SHA1

                                                            5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                            SHA256

                                                            e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                            SHA512

                                                            02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC3CE.tmp-\Newtonsoft.Json.dll
                                                            Filesize

                                                            695KB

                                                            MD5

                                                            715a1fbee4665e99e859eda667fe8034

                                                            SHA1

                                                            e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                            SHA256

                                                            c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                            SHA512

                                                            bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC9DC.tmp
                                                            Filesize

                                                            211KB

                                                            MD5

                                                            a3ae5d86ecf38db9427359ea37a5f646

                                                            SHA1

                                                            eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                            SHA256

                                                            c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                            SHA512

                                                            96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                            Download Submit

                                                          • C:\Windows\Installer\e57c043.msi
                                                            Filesize

                                                            2.9MB

                                                            MD5

                                                            4c2ccd8e957c65e8c7ef53c5147066c3

                                                            SHA1

                                                            6cd11864dfe9f061c2a4e599304934d94f8c36e8

                                                            SHA256

                                                            3809affad6dc10de4613edb2c172f47b641b0393270a129b24683ccd30fb39d7

                                                            SHA512

                                                            8ef0ac1323c4a3da1e892892b46b71f08901aeb3142250144ce2514058ca593de9d05b88cfe502336dca4910bab2ede7023aa7c09364c60647cf50f3aa9749ff

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{13cf4e1c-1e5e-f445-b5b7-3dffc7a81497}\lci_proxywddm.cat
                                                            Filesize

                                                            12KB

                                                            MD5

                                                            8e16d54f986dbe98812fd5ec04d434e8

                                                            SHA1

                                                            8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                            SHA256

                                                            7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                            SHA512

                                                            e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{13cf4e1c-1e5e-f445-b5b7-3dffc7a81497}\lci_proxywddm.inf
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            0315a579f5afe989154cb7c6a6376b05

                                                            SHA1

                                                            e352ff670358cf71e0194918dfe47981e9ccbb88

                                                            SHA256

                                                            d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                            SHA512

                                                            c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{13cf4e1c-1e5e-f445-b5b7-3dffc7a81497}\x64\lci_proxyumd.dll
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            4dc11547a5fc28ca8f6965fa21573481

                                                            SHA1

                                                            d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                            SHA256

                                                            e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                            SHA512

                                                            bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{13cf4e1c-1e5e-f445-b5b7-3dffc7a81497}\x64\lci_proxyumd32.dll
                                                            Filesize

                                                            135KB

                                                            MD5

                                                            67ae7b2c36c9c70086b9d41b4515b0a8

                                                            SHA1

                                                            ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                            SHA256

                                                            79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                            SHA512

                                                            4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{13cf4e1c-1e5e-f445-b5b7-3dffc7a81497}\x64\lci_proxywddm.sys
                                                            Filesize

                                                            119KB

                                                            MD5

                                                            b9b0e9b4d93b18b99ece31a819d71d00

                                                            SHA1

                                                            2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                            SHA256

                                                            0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                            SHA512

                                                            465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{2320b27d-cfeb-4e4f-8960-39e072a6be9c}\lci_iddcx.cat
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            62458e58313475c9a3642a392363e359

                                                            SHA1

                                                            e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                            SHA256

                                                            85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                            SHA512

                                                            49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{2320b27d-cfeb-4e4f-8960-39e072a6be9c}\lci_iddcx.inf
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            1cec22ca85e1b5a8615774fca59a420b

                                                            SHA1

                                                            049a651751ef38321a1088af6a47c4380f9293fc

                                                            SHA256

                                                            60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                            SHA512

                                                            0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{2320b27d-cfeb-4e4f-8960-39e072a6be9c}\x64\lci_iddcx.dll
                                                            Filesize

                                                            52KB

                                                            MD5

                                                            01e8bc64139d6b74467330b11331858d

                                                            SHA1

                                                            b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                            SHA256

                                                            148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                            SHA512

                                                            4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                            Download Submit

                                                          • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-14-51-58.dat
                                                            Filesize

                                                            602B

                                                            MD5

                                                            235dd93c5a1ae29decd257933ee91b2f

                                                            SHA1

                                                            a2581a7de9da28c7f629a6200124f600344367c5

                                                            SHA256

                                                            435fbd19668c7f10d1526a31fd17ed2cb3b59acd057ed3029a5d2e2bcb119dc1

                                                            SHA512

                                                            70c1238cd6f6fdaa9169b4c2c7564601af335fa22ebbc63af5f5b66b886088ed03d4e1d2f1b7c5d9a05ebb7e1ab9cc7a33a387a4dcf424625dea65a554f94792

                                                            Download Submit

                                                          • C:\Windows\Temp\InstallUtil.log
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            fe5cc18b7cb5e8fd95d0afe5a79ad9ff

                                                            SHA1

                                                            99075b4c5a506f8615d472391c673176f000b35a

                                                            SHA256

                                                            8e74e4473ab2ab24638ee7e0f310bf559b550192243e7bc04aff8cec845c3541

                                                            SHA512

                                                            52a9a46986511c21b44c35ce00a48863b375e8d07229d8b7f7550fd19b843b0c4027d1417438e8fd07f53f8751c9f770f24c5d9efd52e5054712ad487dbdb883

                                                            Download Submit

                                                          • C:\Windows\Temp\InstallUtil.log
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            256bf995213a9c8f59c025b95a3724cb

                                                            SHA1

                                                            cca6a934ef3b49732a826a3be934491d9d426754

                                                            SHA256

                                                            589630a15d1818fe7d1704a683f3fb4f0bf6338caa744f4ddf1715e258e4e9bc

                                                            SHA512

                                                            180ed34246928fac2b6199e8abbf4c3ef2df815e6252a2ee671c4528e80bd166dc04e7ccecfde698f940431cbb1858330978d1c5a4447ee22c7643a595c87d01

                                                            Download Submit

                                                          • C:\Windows\Temp\PreVer.log
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            d34a32305f40178a398257f38155b698

                                                            SHA1

                                                            82a7ffd1c216a2a6a4c9f0ea5df7d2915f64ac0c

                                                            SHA256

                                                            a358ded09abe50235c3a0b35da3cfdbf934146e024ac541ea3f32155c29a4e83

                                                            SHA512

                                                            2360c7533c40527428ae862f326a97a7a21da0f8e09be76f2969b4e8f9c2c9c247f1261507730bac394d0027b801c2cf4561cb1fa46f03db32b50a54f913f653

                                                            Download Submit

                                                          • C:\Windows\Temp\Tmp8558.tmp
                                                            Filesize

                                                            3KB

                                                            MD5

                                                            560af444a6a7faa0b0ca94dc16ca2a58

                                                            SHA1

                                                            df31453fafde354870a0a9a8ca50b18e284c32e4

                                                            SHA256

                                                            94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429

                                                            SHA512

                                                            7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681

                                                            Download Submit

                                                          • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                            Filesize

                                                            3.2MB

                                                            MD5

                                                            2c18826adf72365827f780b2a1d5ea75

                                                            SHA1

                                                            a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                            SHA256

                                                            ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                            SHA512

                                                            474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                            Download Submit

                                                          • C:\Windows\Temp\{35130865-487A-4CE1-935B-C90194BD99A9}\IsConfig.ini
                                                            Filesize

                                                            571B

                                                            MD5

                                                            d239b8964e37974225ad69d78a0a8275

                                                            SHA1

                                                            cf208e98a6f11d1807cd84ca61504ad783471679

                                                            SHA256

                                                            0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                            SHA512

                                                            88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                            Download Submit

                                                          • C:\Windows\Temp\{35130865-487A-4CE1-935B-C90194BD99A9}\String1033.txt
                                                            Filesize

                                                            182KB

                                                            MD5

                                                            99bbffd900115fe8672c73fb1a48a604

                                                            SHA1

                                                            8f587395fa6b954affef337c70781ce00913950e

                                                            SHA256

                                                            57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                            SHA512

                                                            d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                            Download Submit

                                                          • C:\Windows\Temp\{35130865-487A-4CE1-935B-C90194BD99A9}\_is2AB6.exe
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            7a1c100df8065815dc34c05abc0c13de

                                                            SHA1

                                                            3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                            SHA256

                                                            e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                            SHA512

                                                            bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                            Download Submit

                                                          • C:\Windows\Temp\{35130865-487A-4CE1-935B-C90194BD99A9}\setup.inx
                                                            Filesize

                                                            345KB

                                                            MD5

                                                            0376dd5b7e37985ea50e693dc212094c

                                                            SHA1

                                                            02859394164c33924907b85ab0aaddc628c31bf1

                                                            SHA256

                                                            c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                            SHA512

                                                            69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                            Download Submit

                                                          • C:\Windows\Temp\{EA40EB65-7991-4139-A019-F2D49E5AA534}\ISRT.dll
                                                            Filesize

                                                            427KB

                                                            MD5

                                                            85315ad538fa5af8162f1cd2fce1c99d

                                                            SHA1

                                                            31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                            SHA256

                                                            70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                            SHA512

                                                            877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                            Download Submit

                                                          • C:\Windows\Temp\{EA40EB65-7991-4139-A019-F2D49E5AA534}\_isres_0x0409.dll
                                                            Filesize

                                                            1.8MB

                                                            MD5

                                                            befe2ef369d12f83c72c5f2f7069dd87

                                                            SHA1

                                                            b89c7f6da1241ed98015dc347e70322832bcbe50

                                                            SHA256

                                                            9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                            SHA512

                                                            760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                            Download Submit

                                                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            404B

                                                            MD5

                                                            9953d0cd42f0a69ab3b050036210895b

                                                            SHA1

                                                            81f8beec83bc091e0b28e3f063d9c75256646884

                                                            SHA256

                                                            a6db34d32e3fbadc0e894830c6ab60f30c124ba965bbe63c11efb496fe587565

                                                            SHA512

                                                            aac9f54a0d50a44935bfeecb6684ce58d21b3fa5bf999d0c616a38987dcdcf449fec995b16c607966a0566c560ce9db8b852eaa41c6a9b22dcb0d93a5049465e

                                                            Download Submit

                                                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            412B

                                                            MD5

                                                            9f2721889ba72d10468e11deebdc9970

                                                            SHA1

                                                            9b757c2a93e3428b06e60d10376f766a60b54e4a

                                                            SHA256

                                                            992a90b9ae069bee898340525d326ae80593139e73b6e764ead4f632aa03485d

                                                            SHA512

                                                            2eb4befd7495ce368312da5d444f8371e8519dc091c44e57c882daff4bc9a5061a99f4e4d29740702b7ca86486eac7f8bbd604445bc2444e04d3605178ff1dce

                                                            Download Submit

                                                          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                            Filesize

                                                            24.1MB

                                                            MD5

                                                            2fea5b739cde466d0f2ff4c4e6397d52

                                                            SHA1

                                                            9e1cbc7146d91dc665f3bfdeab8ffb5ffa21f765

                                                            SHA256

                                                            ba0334dba9799312019100c48f3a349411b14d8ec2eea9baa79e0b82eca2f8eb

                                                            SHA512

                                                            0f66ef310b61adb1b356289dade948a3d9803891cb3d6bb29ca5b1b7a0171dfe37e812c8f70389296bb753665238fecb7afa6c34f651ea57efffa5399ab2764e

                                                            Download Submit

                                                          • \??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e76003d2-b6d0-4573-aa8f-1861c2e80686}_OnDiskSnapshotProp
                                                            Filesize

                                                            6KB

                                                            MD5

                                                            fd120902549f1020e89bedd1f7761456

                                                            SHA1

                                                            e7c77dcacca82b94a999942b31e358a96ab45110

                                                            SHA256

                                                            85e628b40bff0b6d728db8885649d1f6610ebd72b1790d715c6580ebe44f5f14

                                                            SHA512

                                                            83699971e25ac7c36608aa291b1c1c0963e096d7a107d4d5d44c882ab6231fc6ca38f09fa1b8ef1b807ff1489371e7341f224c7fe5e840d60b1c055f846894e7

                                                            Download Submit

                                                          • memory/444-1138-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/444-1137-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/444-1222-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/444-1221-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/444-2524-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/444-1405-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/444-2525-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/444-1406-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/1076-300-0x000002411D7C0000-0x000002411D7D6000-memory.dmp

                                                            Filesize

                                                            88KB

                                                            Download

                                                          • memory/1076-301-0x00000241369E0000-0x0000024136A92000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/1076-302-0x000002411E020000-0x000002411E03C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/1444-110-0x0000000004810000-0x0000000004876000-memory.dmp

                                                            Filesize

                                                            408KB

                                                            Download

                                                          • memory/1792-241-0x00000200C7500000-0x00000200C7538000-memory.dmp

                                                            Filesize

                                                            224KB

                                                            Download

                                                          • memory/1792-192-0x00000200C7000000-0x00000200C70B2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/1792-198-0x00000200AE3E0000-0x00000200AE402000-memory.dmp

                                                            Filesize

                                                            136KB

                                                            Download

                                                          • memory/2360-1444-0x000001E960960000-0x000001E960978000-memory.dmp

                                                            Filesize

                                                            96KB

                                                            Download

                                                          • memory/2360-1613-0x000001E960980000-0x000001E9609A0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/2360-1488-0x000001E979150000-0x000001E979202000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/2360-1425-0x000001E95FFF0000-0x000001E95FFFC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/2440-1258-0x000001CCF9100000-0x000001CCF91B2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/2440-1257-0x000001CCE0840000-0x000001CCE085C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/2440-1414-0x000001CCF91C0000-0x000001CCF9214000-memory.dmp

                                                            Filesize

                                                            336KB

                                                            Download

                                                          • memory/2440-1256-0x000001CCDFFE0000-0x000001CCDFFF2000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/2492-39-0x0000000004BE0000-0x0000000004C0E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                            Download

                                                          • memory/2492-43-0x0000000004C20000-0x0000000004C2C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/2884-1157-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/2884-3006-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/2884-1408-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/2884-1411-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/2884-3007-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/2884-1156-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/2884-4191-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/2884-4192-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/2980-1510-0x0000013E09740000-0x0000013E09760000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/2980-1413-0x0000013E092A0000-0x0000013E092B0000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/2980-1412-0x0000013E08ED0000-0x0000013E08EE2000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/2980-1435-0x0000013E22060000-0x0000013E22112000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/2980-1935-0x0000013E228A0000-0x0000013E22EFC000-memory.dmp

                                                            Filesize

                                                            6.4MB

                                                            Download

                                                          • memory/3252-1855-0x0000018082ED0000-0x0000018082F0A000-memory.dmp

                                                            Filesize

                                                            232KB

                                                            Download

                                                          • memory/3252-1918-0x0000018083960000-0x00000180839A8000-memory.dmp

                                                            Filesize

                                                            288KB

                                                            Download

                                                          • memory/3252-1910-0x00000180839B0000-0x0000018083A62000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/3252-1914-0x00000180838F0000-0x000001808390C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/3328-350-0x000001B67B0F0000-0x000001B67B13C000-memory.dmp

                                                            Filesize

                                                            304KB

                                                            Download

                                                          • memory/3328-356-0x000001B67B1B0000-0x000001B67B1B8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/3328-347-0x000001B679F60000-0x000001B679FC4000-memory.dmp

                                                            Filesize

                                                            400KB

                                                            Download

                                                          • memory/3328-348-0x000001B67A840000-0x000001B67A88A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/3328-349-0x000001B67A810000-0x000001B67A82C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/3328-351-0x000001B67B140000-0x000001B67B188000-memory.dmp

                                                            Filesize

                                                            288KB

                                                            Download

                                                          • memory/3328-352-0x000001B67A800000-0x000001B67A808000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/3328-353-0x000001B67A830000-0x000001B67A83A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/3328-354-0x000001B67B420000-0x000001B67B4FC000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/3328-355-0x000001B67B500000-0x000001B67B5B2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/3328-357-0x000001B67B1C0000-0x000001B67B1C8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/3328-362-0x000001B67B370000-0x000001B67B396000-memory.dmp

                                                            Filesize

                                                            152KB

                                                            Download

                                                          • memory/3328-358-0x000001B67B1D0000-0x000001B67B1D8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/3328-359-0x000001B67B3B0000-0x000001B67B418000-memory.dmp

                                                            Filesize

                                                            416KB

                                                            Download

                                                          • memory/3328-360-0x000001B67B340000-0x000001B67B36A000-memory.dmp

                                                            Filesize

                                                            168KB

                                                            Download

                                                          • memory/3328-361-0x000001B67B5C0000-0x000001B67B5FA000-memory.dmp

                                                            Filesize

                                                            232KB

                                                            Download

                                                          • memory/3536-1089-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3536-483-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3536-486-0x0000000003420000-0x00000000035E7000-memory.dmp

                                                            Filesize

                                                            1.8MB

                                                            Download

                                                          • memory/3536-517-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3536-907-0x0000000003460000-0x0000000003627000-memory.dmp

                                                            Filesize

                                                            1.8MB

                                                            Download

                                                          • memory/3536-1019-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3536-1047-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3608-1150-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3608-1407-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/3608-1153-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/3608-4194-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/3608-4193-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3608-1280-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3624-1410-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/3624-1686-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3624-1409-0x0000000072BB0000-0x0000000072CCC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3624-1692-0x00000000727E0000-0x0000000072BAD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/3944-164-0x0000012D08C70000-0x0000012D08C82000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/3944-148-0x0000012D06F80000-0x0000012D06FA8000-memory.dmp

                                                            Filesize

                                                            160KB

                                                            Download

                                                          • memory/3944-160-0x0000012D21510000-0x0000012D215A8000-memory.dmp

                                                            Filesize

                                                            608KB

                                                            Download

                                                          • memory/3944-165-0x0000012D08CD0000-0x0000012D08D0C000-memory.dmp

                                                            Filesize

                                                            240KB

                                                            Download

                                                          • memory/4452-278-0x0000026A9D000000-0x0000026A9D01C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/4452-274-0x0000026A9CB30000-0x0000026A9CB60000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/4452-277-0x0000026AB5CD0000-0x0000026AB5D80000-memory.dmp

                                                            Filesize

                                                            704KB

                                                            Download

                                                          • memory/4728-80-0x00000000049D0000-0x0000000004D24000-memory.dmp

                                                            Filesize

                                                            3.3MB

                                                            Download

                                                          • memory/4728-76-0x0000000004910000-0x00000000049C2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/4728-79-0x00000000047E0000-0x0000000004802000-memory.dmp

                                                            Filesize

                                                            136KB

                                                            Download

                                                          • memory/5256-1904-0x0000024130A50000-0x0000024130A6A000-memory.dmp

                                                            Filesize

                                                            104KB

                                                            Download

                                                          • memory/5256-1911-0x0000024131180000-0x0000024131232000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5256-1903-0x0000024130680000-0x000002413068A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/5480-2770-0x000001AAAADD0000-0x000001AAAAF3A000-memory.dmp

                                                            Filesize

                                                            1.4MB

                                                            Download

                                                          • memory/5564-1934-0x0000022E0AF80000-0x0000022E0AFCA000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5564-1936-0x0000022E0AF30000-0x0000022E0AF4C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5564-1938-0x0000022E0AF50000-0x0000022E0AF5A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/5564-1937-0x0000022E0AFD0000-0x0000022E0AFE8000-memory.dmp

                                                            Filesize

                                                            96KB

                                                            Download

                                                          • memory/5564-1932-0x0000022E0A5A0000-0x0000022E0A5D4000-memory.dmp

                                                            Filesize

                                                            208KB

                                                            Download

                                                          • memory/5604-1909-0x0000027DA2570000-0x0000027DA25BA000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5604-1933-0x0000027DBB0C0000-0x0000027DBB19C000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/5604-1922-0x0000027DA2520000-0x0000027DA253C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5604-1905-0x0000027DA1CE0000-0x0000027DA1CF0000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/5604-1939-0x0000027DBAFE0000-0x0000027DBB092000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5760-1852-0x000001F0EF7F0000-0x000001F0EF800000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/5760-1853-0x000001F0EFC90000-0x000001F0EFCB0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/5760-1854-0x000001F0F09D0000-0x000001F0F0A82000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5760-1861-0x000001F0F0240000-0x000001F0F02A6000-memory.dmp

                                                            Filesize

                                                            408KB

                                                            Download

                                                          • memory/5760-1867-0x000001F0F0080000-0x000001F0F0094000-memory.dmp

                                                            Filesize

                                                            80KB

                                                            Download

                                                          • memory/5888-1906-0x00000253FB040000-0x00000253FB04C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/5888-1908-0x00000253FC0E0000-0x00000253FC12A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5888-1921-0x00000253FC090000-0x00000253FC0AC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5896-1931-0x000002A2FB720000-0x000002A2FB73C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5896-1920-0x000002A2FB840000-0x000002A2FB88A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5896-1913-0x000002A2FB350000-0x000002A2FB362000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download