Overview

overview

10

Static

static

10

setup_ll2.msi

windows7-x64

10

setup_ll2.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_ll2.msi

  • Size

    2.9MB

  • MD5

    cd137d3bdb80bb4b2fefe9bac6f1bf23

  • SHA1

    d30769a433cb7f01c78a1b088a26ddcb8036d367

  • SHA256

    2f940888c42e0fb3e6d625fc80ccdb5e6c26e43d6f87ad67cb020e287bfec07e

  • SHA512

    3e64935f12cb35fc6bca0172abc85a0040863ab610385e665c251930ebc8b85525a06b26770e395a8f37c8dc9ea43b500855751a89b94ccbb16e6f204786fb7d

  • SSDEEP

    49152:M+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:M+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 11 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_ll2.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1104
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4792
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9CBF04771839FA017EA4FE86EC30BFFD
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI923D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240620406 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1596
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI958A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240620968 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2648
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI9ACB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240622328 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:320
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIA6C6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240625390 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:404
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E0E70DE3BE49B607D282BD616C7A4B91 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2288
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3864
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="5" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q3000003TcZeIAK" /AgentId="1da75706-159f-41fe-b5d6-8acb8bf85432"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1132
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 31DDF196DFF693EE14487E7C243BA6DE E Global\MSI0000
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4428
    • C:\Program Files (x86)\AnyDesk-f45e5af2_msi\AnyDesk-f45e5af2_msi.exe
      "C:\Program Files (x86)\AnyDesk-f45e5af2_msi\AnyDesk-f45e5af2_msi.exe" --control
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:2880
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DD4B2FD9C65A4E2AB0E8253D29E63BA9 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:4360
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{74E27C33-BB07-40A9-BE82-169FDDC812F5}
        3⤵
        • Executes dropped EXE
        PID:3948
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2DEE8C02-DD41-42A3-BAF0-E5DB7492AC14}
        3⤵
        • Executes dropped EXE
        PID:5884
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5908CFEF-A82B-4208-8092-A06C4A621C97}
        3⤵
        • Executes dropped EXE
        PID:3496
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D579C935-35A7-4D0E-AF0D-3AB18883B476}
        3⤵
        • Executes dropped EXE
        PID:6052
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BA2B02E3-3B8D-4085-99C6-617F3342D233}
        3⤵
        • Executes dropped EXE
        PID:5352
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2036B20B-1291-4C28-B549-A76C4BDC622F}
        3⤵
        • Executes dropped EXE
        PID:5568
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD79D9B5-F38D-46A0-A29C-A30E377E9445}
        3⤵
        • Executes dropped EXE
        PID:5360
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{032BCA0F-4A87-4966-A7A8-7DA97BA1E4BC}
        3⤵
        • Executes dropped EXE
        PID:5700
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3C1AC6B-7517-44F5-BFE9-BB36F994D1E5}
        3⤵
        • Executes dropped EXE
        PID:4184
      • C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe
        C:\Windows\TEMP\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_is62CC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{47AB6470-02BC-4D2E-A66F-14CCD298D799}
        3⤵
        • Executes dropped EXE
        PID:5872
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4624
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5128
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6064
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5848
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2748
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5508
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4592
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5472
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2928
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5204
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1124
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6084
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:6052
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5640
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5344
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3896
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4976
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6024
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2432
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A99A48F2-CE56-464A-B846-3E7132650BBD}
        3⤵
        • Executes dropped EXE
        PID:5444
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F4D8151-1783-45D9-B372-70577B2BD94F}
        3⤵
        • Executes dropped EXE
        PID:3676
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA1720F7-BD39-4DFB-BE44-009686768A18}
        3⤵
        • Executes dropped EXE
        PID:5304
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E22D6CF8-613B-4405-AFBA-A3763FF9906D}
        3⤵
        • Executes dropped EXE
        PID:5632
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0E53272-6FEB-46CA-A278-BCF467C66440}
        3⤵
        • Executes dropped EXE
        PID:2392
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{82F85F04-B2D6-4E04-B4FF-AA1A24938B87}
        3⤵
        • Executes dropped EXE
        PID:5316
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0602A66E-CFFD-4F26-A7BF-CF94B9092903}
        3⤵
        • Executes dropped EXE
        PID:5392
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{937F757D-7627-4F7C-B73F-CD1AFFCB5F10}
        3⤵
        • Executes dropped EXE
        PID:5408
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59F23870-5099-4232-BD0B-9A6665A6F970}
        3⤵
        • Executes dropped EXE
        PID:944
      • C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
        C:\Windows\TEMP\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ACB3D8C8-5F56-4465-BAD9-C634DFAB4DCE}
        3⤵
        • Executes dropped EXE
        PID:2220
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4F43E9E-055E-489D-9F23-5D83E09AE2FB}
        3⤵
        • Executes dropped EXE
        PID:1236
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52E1DCFC-C0AC-4B5F-B4BE-E303BED5F583}
        3⤵
        • Executes dropped EXE
        PID:5240
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{50E1A5AF-0B03-4849-886E-5230376491B9}
        3⤵
        • Executes dropped EXE
        PID:5844
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{044AE7A1-86D1-4C2A-AB3F-42CDD99D603D}
        3⤵
        • Executes dropped EXE
        PID:3628
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7AB8EC22-4E9E-438E-A9F7-2EB4A498EE79}
        3⤵
        • Executes dropped EXE
        PID:1388
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{939470A2-CBC7-4881-9082-F0DEB5ECEB96}
        3⤵
        • Executes dropped EXE
        PID:4524
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DAB3E6F7-1A4C-4F9A-8DDE-F423A05E4E4C}
        3⤵
        • Executes dropped EXE
        PID:5816
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D086D02A-F1ED-4457-90E6-5CDBA9E0A8F8}
        3⤵
        • Executes dropped EXE
        PID:5456
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E20F1D88-03F3-436E-85F9-0512E401BE55}
        3⤵
        • Executes dropped EXE
        PID:4172
      • C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe
        C:\Windows\TEMP\{68BD07D1-B1B9-4778-80A9-25B97139917C}\_is8421.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1417B78-8C0F-4490-B1CE-0396E9C1E72C}
        3⤵
        • Executes dropped EXE
        PID:5184
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4768
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5252
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3232
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:6060
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:1432
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5348
          • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
            C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{207981AA-A243-4F93-AB95-C547CA4A0224}
            3⤵
              PID:5744
            • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
              C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35668274-29F6-4EC8-AD09-C95557D8C3D3}
              3⤵
                PID:4592
              • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D958C474-8609-40D6-9633-1DE05975777D}
                3⤵
                  PID:4336
                • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                  C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C77B5A59-1109-4458-BB35-23D323030760}
                  3⤵
                    PID:3408
                  • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                    C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2653EF4-84D1-47C3-95A6-52843077B793}
                    3⤵
                      PID:6124
                    • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                      C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDD70662-AABD-4BBA-A43A-3F76470DF031}
                      3⤵
                        PID:5236
                      • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                        C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{457C4CED-2990-48CF-AB49-989E808506F6}
                        3⤵
                          PID:5724
                        • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                          C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DF914E5-9C27-49A9-A2F3-4FF652584D75}
                          3⤵
                            PID:5148
                          • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                            C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A19FF8D6-4191-40AA-9987-A7CEFB21CA92}
                            3⤵
                              PID:5304
                            • C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe
                              C:\Windows\TEMP\{84F22809-7576-4BAE-B1B9-3CEFBFAB8B60}\_is972E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C060A3B-E0D6-4B02-9C81-163F589B7C8A}
                              3⤵
                                PID:5976
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:5908
                              • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{279E9669-682C-47C2-8F4F-0E84CCE003BC}
                                3⤵
                                  PID:4596
                                • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                  C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B141F140-4B02-4B97-BEE9-5F09B514CFD9}
                                  3⤵
                                    PID:3260
                                  • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                    C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CAB3FFEF-78FB-47F9-8D6C-F24CE2300B42}
                                    3⤵
                                      PID:2028
                                    • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                      C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B3F344DD-C32E-4E25-B338-992528A3EA7B}
                                      3⤵
                                        PID:5356
                                      • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                        C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{166A0822-4D3B-4AFA-8A1B-1FA4CD7D7C6A}
                                        3⤵
                                          PID:320
                                        • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                          C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{828ED1D8-7E58-4B99-A789-5637DCC56C5B}
                                          3⤵
                                            PID:4208
                                          • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                            C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3B8CDFC7-DFB9-4F91-8A67-8C8D0BB3A3FE}
                                            3⤵
                                              PID:1160
                                            • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                              C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CC8C2BF4-06D3-4698-948D-C7C52188C06A}
                                              3⤵
                                                PID:5896
                                              • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                                C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D42E82D0-8880-43B8-8456-A4F65C2339D8}
                                                3⤵
                                                  PID:5208
                                                • C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe
                                                  C:\Windows\TEMP\{78025738-4691-4103-8E48-4F04EA9227D5}\_is9E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9AD6E044-C535-46E9-9728-C52CA75012D7}
                                                  3⤵
                                                    PID:6004
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1108
                                              • C:\Windows\system32\vssvc.exe
                                                C:\Windows\system32\vssvc.exe
                                                1⤵
                                                • Checks SCSI registry key(s)
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1752
                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                                                1⤵
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Executes dropped EXE
                                                • Modifies data under HKEY_USERS
                                                • Modifies system certificate store
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:2592
                                                • C:\Windows\System32\sc.exe
                                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                                  2⤵
                                                  • Launches sc.exe
                                                  PID:4424
                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "0711719f-f187-45f6-846b-39c083161c4e" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q3000003TcZeIAK
                                                  2⤵
                                                  • Drops file in System32 directory
                                                  • Executes dropped EXE
                                                  PID:924
                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "a338c418-578f-4382-9f08-27e2cd79eb7c" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q3000003TcZeIAK
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:3940
                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "787ccec9-19bf-4d30-9b1b-ac5ab65474c5" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q3000003TcZeIAK
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:2216
                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "c53c680a-4470-4767-881c-ead61dd5a87d" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q3000003TcZeIAK
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Modifies data under HKEY_USERS
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:892
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                    3⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3256
                                                    • C:\Windows\system32\cscript.exe
                                                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                      4⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:4540
                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "bf4c834a-001e-4caf-80cc-44bdd63f3322" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjozLCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9wYWNrYWdlc3N0b3JlLmJsb2IuY29yZS53aW5kb3dzLm5ldC9pbnN0YWxsZXJzL0FueURlc2svQWdlbnRfQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSJ9" 001Q3000003TcZeIAK
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1640
                                                  • C:\Windows\SYSTEM32\msiexec.exe
                                                    "msiexec.exe" /i "C:\Windows\TEMP\AnyDesk-CM.msi" /qn
                                                    3⤵
                                                      PID:4380
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C echo xfMdjXPyBCaC | AnyDesk-f45e5af2_msi.exe --set-password
                                                      3⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:224
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /S /D /c" echo xfMdjXPyBCaC "
                                                        4⤵
                                                          PID:2344
                                                        • C:\Program Files (x86)\AnyDesk-f45e5af2_msi\AnyDesk-f45e5af2_msi.exe
                                                          AnyDesk-f45e5af2_msi.exe --set-password
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:116
                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "563862d4-044e-45fb-9d3a-cc67f904de61" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q3000003TcZeIAK
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:548
                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                                                    1⤵
                                                    • Drops file in Program Files directory
                                                    • Executes dropped EXE
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2664
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:2728
                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "403b0762-f43d-41c7-b303-63a50e0b33eb" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q3000003TcZeIAK
                                                      2⤵
                                                      • Drops file in Program Files directory
                                                      • Executes dropped EXE
                                                      PID:1092
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                        3⤵
                                                          PID:3676
                                                          • C:\Windows\system32\cscript.exe
                                                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                            4⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:3296
                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "87fc1b77-6455-4d05-9677-4b8d1bcc04a1" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q3000003TcZeIAK
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2344
                                                        • C:\Windows\TEMP\SplashtopStreamer.exe
                                                          "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:5448
                                                          • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                            "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5988
                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                              msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5676
                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=3867fecb110905612ff8c925a32c9a32&rmm_session_pwd_ttl=86400"
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4896
                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "75c032eb-3c38-4d19-b106-064fe01b822b" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q3000003TcZeIAK
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:880
                                                        • C:\Windows\SYSTEM32\msiexec.exe
                                                          "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                                                          3⤵
                                                            PID:4228
                                                          • C:\Windows\SYSTEM32\msiexec.exe
                                                            "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                                                            3⤵
                                                              PID:3872
                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "4baa38f0-fe37-4fd6-93e4-d1dcfb864571" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q3000003TcZeIAK
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4408
                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "0b390f35-7324-4a5d-bc2c-884d65f99682" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q3000003TcZeIAK
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Executes dropped EXE
                                                            PID:3304
                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "d5ea581c-0cec-4e30-a247-51c67b7b35de" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q3000003TcZeIAK
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:3628
                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "e58ccdac-15a4-458c-a6f5-5d45c7d6892a" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q3000003TcZeIAK
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5172
                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "80938fe6-43a0-452b-8208-d396c639b53f" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q3000003TcZeIAK
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:5484
                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "848f53a2-03d6-477b-9f5a-77673dc42cc7" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q3000003TcZeIAK
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Program Files directory
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5936
                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "760e5474-0d49-477a-b922-5e4d57ab271a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q3000003TcZeIAK
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Modifies data under HKEY_USERS
                                                            PID:1860
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C echo Z4OWCv1WwDgl | AnyDesk-f45e5af2_msi.exe --set-password
                                                              3⤵
                                                                PID:6100
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Z4OWCv1WwDgl "
                                                                  4⤵
                                                                    PID:5700
                                                                  • C:\Program Files (x86)\AnyDesk-f45e5af2_msi\AnyDesk-f45e5af2_msi.exe
                                                                    AnyDesk-f45e5af2_msi.exe --set-password
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4184
                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "08190f16-a806-454e-a058-3b2c43f2c714" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q3000003TcZeIAK
                                                                2⤵
                                                                • Drops file in System32 directory
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4500
                                                                • C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                  "C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 08190f16-a806-454e-a058-3b2c43f2c714 agent-api.atera.com/Production 443 or8ixLi90Mf connect 001Q3000003TcZeIAK
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:4492
                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "254443f6-09b8-448d-9e7f-8d8280bcf488" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q3000003TcZeIAK
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2832
                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "296876a6-fb8d-4b9e-b038-5569e87d1703" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q3000003TcZeIAK
                                                                2⤵
                                                                • Writes to the Master Boot Record (MBR)
                                                                • Drops file in Program Files directory
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5148
                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "7dedba39-8834-495a-a9f8-ab2dd15f444f" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q3000003TcZeIAK
                                                                2⤵
                                                                • Drops file in System32 directory
                                                                • Executes dropped EXE
                                                                PID:5224
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                                  3⤵
                                                                  • System Time Discovery
                                                                  PID:5144
                                                                  • C:\Program Files\dotnet\dotnet.exe
                                                                    dotnet --list-runtimes
                                                                    4⤵
                                                                    • System Time Discovery
                                                                    PID:4800
                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "c8354866-6254-48db-a0b7-4965f1d2d623" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q3000003TcZeIAK
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:5320
                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "0b390f35-7324-4a5d-bc2c-884d65f99682" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q3000003TcZeIAK
                                                                2⤵
                                                                  PID:4568
                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 1da75706-159f-41fe-b5d6-8acb8bf85432 "0b390f35-7324-4a5d-bc2c-884d65f99682" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q3000003TcZeIAK
                                                                  2⤵
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:5648
                                                              • C:\Program Files (x86)\AnyDesk-f45e5af2_msi\AnyDesk-f45e5af2_msi.exe
                                                                "C:\Program Files (x86)\AnyDesk-f45e5af2_msi\AnyDesk-f45e5af2_msi.exe" --service
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2872
                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                                                1⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4852
                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:3948
                                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                                                    -h
                                                                    3⤵
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:3256
                                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5976
                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                                                      4⤵
                                                                        PID:6092
                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:6012
                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2992
                                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                                        SRUtility.exe -r
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2196
                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                                                      3⤵
                                                                      • Drops file in Program Files directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:3976
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                                                        4⤵
                                                                          PID:4488
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ver
                                                                            5⤵
                                                                              PID:5896
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc query ddmgr
                                                                              5⤵
                                                                              • Launches sc.exe
                                                                              PID:1996
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc query lci_proxykmd
                                                                              5⤵
                                                                              • Launches sc.exe
                                                                              PID:5940
                                                                            • C:\Windows\system32\rundll32.exe
                                                                              rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                                                              5⤵
                                                                              • Drops file in Windows directory
                                                                              • Checks SCSI registry key(s)
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:912
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                      1⤵
                                                                      • Drops file in Windows directory
                                                                      • Checks SCSI registry key(s)
                                                                      PID:5764
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000144" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                        2⤵
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:5684
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                        2⤵
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:1244
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000178"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        PID:5496
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        PID:6060

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Persistence

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Privilege Escalation

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Defense Evasion

                                                                    Modify Registry

                                                                    1
                                                                    T1112

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Subvert Trust Controls

                                                                    1
                                                                    T1553

                                                                    Install Root Certificate

                                                                    1
                                                                    T1553.004

                                                                    System Binary Proxy Execution

                                                                    1
                                                                    T1218

                                                                    Msiexec

                                                                    1
                                                                    T1218.007

                                                                    Credential Access

                                                                    Discovery

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    4
                                                                    T1012

                                                                    System Information Discovery

                                                                    3
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Config.Msi\e5791a2.rbs
                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      244c006d5b1865ab0d5f33031dc914a8

                                                                      SHA1

                                                                      f362a1f5a399058a604f868d024ba95b8ca968a6

                                                                      SHA256

                                                                      37f014fd89b4f4fed4a2ac0f3668dde2daf867c24874288ad8c6d1b03d9a568e

                                                                      SHA512

                                                                      16d75b260343a1c92536a547be2472617accd8a2244253b862009edc45ff43bb35bda3a48378d892fa18170e6c1fc220e0b10046ed38ba7f523a496876471d42

                                                                      Download Submit

                                                                    • C:\Config.Msi\e5791a7.rbs
                                                                      Filesize

                                                                      164KB

                                                                      MD5

                                                                      eb3e6ae4f4e743183b8fd95478671002

                                                                      SHA1

                                                                      52552bdc2358862a15597eb6e3aac3456e12978b

                                                                      SHA256

                                                                      03cdd28ec401aed3867b81ca962a538e4f31e5d32d597fdbb505ad8db4424259

                                                                      SHA512

                                                                      ac3ff56087a7be293455c348499caf09edeb5d6895297c82535a7ae3f6b1fb10616ef581ec1b1cc9c8ad2ef95b75ded96d04743894017b69709cfe982f00210a

                                                                      Download Submit

                                                                    • C:\Config.Msi\e5791ac.rbs
                                                                      Filesize

                                                                      74KB

                                                                      MD5

                                                                      c312f443b8e78be3267c25450a5cbf6d

                                                                      SHA1

                                                                      2694886e8aaa29b637c318cd9a46e79493e88803

                                                                      SHA256

                                                                      57766a2a7d79f9dbe8e47cc4568907a5e8dc6da73b4e9adae6df254a8c5e5241

                                                                      SHA512

                                                                      7ca10164890d16242c8ab42eed77cdad1eb43111e641cb80ef7807c39c14281e1617491a9b6ad21e1a518a4e4a595eb31b23bb9c47883f09847aec18b082cf93

                                                                      Download Submit

                                                                    • C:\Config.Msi\e5791ae.rbs
                                                                      Filesize

                                                                      464B

                                                                      MD5

                                                                      3a32460b7ddfbfa8c3ab02228f4a738a

                                                                      SHA1

                                                                      4ee65f9fbb1c5c2211743a6133d9a7b8a8c77435

                                                                      SHA256

                                                                      621121562ac2104305ae744e577a6073f0b3c0ca05eb6ffc9b6b1d16010880d6

                                                                      SHA512

                                                                      ac1a77648236be704679753ae38be0ec15e1cbf847e02797c43ee6120e2589bb71caaaa96f276b51e7e8636235fedec235a06e12d9a784d73267186eebf7f60e

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                      Filesize

                                                                      753B

                                                                      MD5

                                                                      8298451e4dee214334dd2e22b8996bdc

                                                                      SHA1

                                                                      bc429029cc6b42c59c417773ea5df8ae54dbb971

                                                                      SHA256

                                                                      6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

                                                                      SHA512

                                                                      cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                      Filesize

                                                                      142KB

                                                                      MD5

                                                                      477293f80461713d51a98a24023d45e8

                                                                      SHA1

                                                                      e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                      SHA256

                                                                      a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                      SHA512

                                                                      23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      b3bb71f9bb4de4236c26578a8fae2dcd

                                                                      SHA1

                                                                      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                      SHA256

                                                                      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                      SHA512

                                                                      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                      Filesize

                                                                      210KB

                                                                      MD5

                                                                      c106df1b5b43af3b937ace19d92b42f3

                                                                      SHA1

                                                                      7670fc4b6369e3fb705200050618acaa5213637f

                                                                      SHA256

                                                                      2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                      SHA512

                                                                      616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      693KB

                                                                      MD5

                                                                      2c4d25b7fbd1adfd4471052fa482af72

                                                                      SHA1

                                                                      fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                      SHA256

                                                                      2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                      SHA512

                                                                      f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                      Filesize

                                                                      158KB

                                                                      MD5

                                                                      1922740d2479c7d0cd6fb57c3d739543

                                                                      SHA1

                                                                      877a807a396156be1d0c2782391cabc29ea15760

                                                                      SHA256

                                                                      20443f66e184311fd412158cb162e36b0172332cd6d401cec9ee5fe17df75e58

                                                                      SHA512

                                                                      d624bad0fcd8afc190a5de241da341a3f39d6aaa0e5eacdf8b14e8e74515b688f06e2cdc75da0634880ea98238a1d26cd2d2bfaedb6d92067dace99d0963975c

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\data\iot_conf.json
                                                                      Filesize

                                                                      189B

                                                                      MD5

                                                                      29fc674365c2746dc02bbc23964cce96

                                                                      SHA1

                                                                      ce8f9bd4dc58fb8dd322d638d4022c6acdb341eb

                                                                      SHA256

                                                                      9621f63fe08e481b03c6bf950110b7adf33ecccb10f87afa751667f1dddd0823

                                                                      SHA512

                                                                      8dc78b431b9b490046c56b55e9b16cfd1e666e479825b8995618bca033193db3899cb0f5fb1e9ebab214790708e319b2690c125c1a3f278e8c52e3264a5698fd

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                      Filesize

                                                                      157KB

                                                                      MD5

                                                                      63f830bc220b8af1381f2210fdf6a258

                                                                      SHA1

                                                                      5651a89b75ba320ba3133826c9fca7f5baa0fbbb

                                                                      SHA256

                                                                      a82eec1added638aa86d4e66f3b3789e8f7e40a15d0be3b01fbe50ca85b99f9c

                                                                      SHA512

                                                                      ae2884f99833f11a5ce73843bb675de13c3dd362602352b3e8d3f6815bc03fb9a681f0adfeb677fa575bf3395734fc9e07ea05896e8698f875f7a6b01276a31c

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                      Filesize

                                                                      1.1MB

                                                                      MD5

                                                                      9a9b1fd85b5f1dcd568a521399a0d057

                                                                      SHA1

                                                                      34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                      SHA256

                                                                      88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                      SHA512

                                                                      7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                      Filesize

                                                                      51KB

                                                                      MD5

                                                                      3180c705182447f4bcc7ce8e2820b25d

                                                                      SHA1

                                                                      ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                      SHA256

                                                                      5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                      SHA512

                                                                      228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                      Filesize

                                                                      12B

                                                                      MD5

                                                                      eb053699fc80499a7185f6d5f7d55bfe

                                                                      SHA1

                                                                      9700472d22b1995c320507917fa35088ae4e5f05

                                                                      SHA256

                                                                      bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                                      SHA512

                                                                      d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                      Filesize

                                                                      173KB

                                                                      MD5

                                                                      fd9df72620bca7c4d48bc105c89dffd2

                                                                      SHA1

                                                                      2e537e504704670b52ce775943f14bfbaf175c1b

                                                                      SHA256

                                                                      847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                                      SHA512

                                                                      47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                      Filesize

                                                                      546B

                                                                      MD5

                                                                      158fb7d9323c6ce69d4fce11486a40a1

                                                                      SHA1

                                                                      29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                      SHA256

                                                                      5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                      SHA512

                                                                      7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      688KB

                                                                      MD5

                                                                      3ef8d12aa1d48dec3ac19a0ceabd4fd8

                                                                      SHA1

                                                                      c81b7229a9bd55185a0edccb7e6df3b8e25791cf

                                                                      SHA256

                                                                      18c1ddbdbf47370cc85fa2cf7ba043711ab3eadbd8da367638686dfd6b735c85

                                                                      SHA512

                                                                      0ff2e8dbfef7164b22f9ae9865e83154096971c3f0b236d988ab947e803c1ed03d86529ab80d2be9ff33af305d34c9b30082f8c26e575f0979ca9287b415f9f9

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                      Filesize

                                                                      27KB

                                                                      MD5

                                                                      797c9554ec56fd72ebb3f6f6bef67fb5

                                                                      SHA1

                                                                      40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                      SHA256

                                                                      7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                      SHA512

                                                                      4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                      Filesize

                                                                      214KB

                                                                      MD5

                                                                      01807774f043028ec29982a62fa75941

                                                                      SHA1

                                                                      afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                      SHA256

                                                                      9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                      SHA512

                                                                      33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                      Filesize

                                                                      37KB

                                                                      MD5

                                                                      efb4712c8713cb05eb7fe7d87a83a55a

                                                                      SHA1

                                                                      c94d106bba77aecf88540807da89349b50ea5ae7

                                                                      SHA256

                                                                      30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                      SHA512

                                                                      3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                      Filesize

                                                                      3.4MB

                                                                      MD5

                                                                      e010d1f614b1a830482d3df4ba056f24

                                                                      SHA1

                                                                      5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                                      SHA256

                                                                      98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                                      SHA512

                                                                      727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                      Filesize

                                                                      389KB

                                                                      MD5

                                                                      5e3252e0248b484e76fcdbf8b42a645d

                                                                      SHA1

                                                                      11ae92fd16ac87f6ab755911e85e263253c16516

                                                                      SHA256

                                                                      01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                                      SHA512

                                                                      540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                      Filesize

                                                                      48KB

                                                                      MD5

                                                                      eefc43b486aaf293a19e79bab1d96269

                                                                      SHA1

                                                                      7b642b4cfed2933faa3ee5e88b98048a268df246

                                                                      SHA256

                                                                      02acefaa5674280da7c2ba8584ea7e8ce08ad1adaa347f2f7ea5aff13e557856

                                                                      SHA512

                                                                      52fdc0db899d47c3fca0aaa665a88faefa39297116120282a84080685baeb890f95f5b859b0e1e6dfb27d496c129b6b1b00ca415bb822e9fd7ab0f736cae6101

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                      Filesize

                                                                      196KB

                                                                      MD5

                                                                      680bac4393da4dafe0100d9483d3b6e4

                                                                      SHA1

                                                                      ed211ef61232c5aacee7ca168659f02f9d4f4e53

                                                                      SHA256

                                                                      c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                                                                      SHA512

                                                                      5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                      Filesize

                                                                      56KB

                                                                      MD5

                                                                      0f33a7acb33960d1306ba418405d8264

                                                                      SHA1

                                                                      bc24c37727b00d514446c8b5fb6c04f36254a067

                                                                      SHA256

                                                                      a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                                      SHA512

                                                                      72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      9d1528a2ce17522f6de064ae2c2b608e

                                                                      SHA1

                                                                      2f1ce8b589e57ab300bb93dde176689689f75114

                                                                      SHA256

                                                                      11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                      SHA512

                                                                      a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5936.update
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      14ffcf07375b3952bd3f2fe52bb63c14

                                                                      SHA1

                                                                      ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                      SHA256

                                                                      6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                      SHA512

                                                                      14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      e93adaf9ce541d9730d2f1a563c876ab

                                                                      SHA1

                                                                      7ab6744b61f19b10b175624ed1dbec387786c72f

                                                                      SHA256

                                                                      e51155b0e76d65de66665b79d62950e39dd0aca1873d05ebc925274ca827761f

                                                                      SHA512

                                                                      245a1141a7789a38960c392f25a970cf36666805bfa50aa3db809a7885080de873ab28bfa9565907b9cdf614a26455be51422c32548557d4c3f42342bcf1dfe0

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                      Filesize

                                                                      2B

                                                                      MD5

                                                                      81051bcc2cf1bedf378224b0a93e2877

                                                                      SHA1

                                                                      ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                      SHA256

                                                                      7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                      SHA512

                                                                      1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                      Filesize

                                                                      54KB

                                                                      MD5

                                                                      77c613ffadf1f4b2f50d31eeec83af30

                                                                      SHA1

                                                                      76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                      SHA256

                                                                      2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                      SHA512

                                                                      29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                      Filesize

                                                                      71KB

                                                                      MD5

                                                                      5129e29d4d9a8ed94e04099622316b37

                                                                      SHA1

                                                                      be1c537ad5fc51bd28bd3ea23e16cbfbdaf01dfd

                                                                      SHA256

                                                                      17c1a413747e1dbf203f1824e45ddc0dc7afe4c529bca88cdb670f019d95db11

                                                                      SHA512

                                                                      7b8a1d79c069cdcbebd57255d11d96e13e291df8b99c15d6c969a66ef8af8639fac92e22b233b4b6f8b33a9c52ba2936fe59ecee2acf78c571f4920ea075e4bb

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                      Filesize

                                                                      50KB

                                                                      MD5

                                                                      254dcbee3213189461b66e962ce8cc05

                                                                      SHA1

                                                                      cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                                                                      SHA256

                                                                      e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                                                                      SHA512

                                                                      7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                      Filesize

                                                                      32KB

                                                                      MD5

                                                                      db1db66ebd9b15b7dcd55374ea56ee5e

                                                                      SHA1

                                                                      c22897eb20900a66cf62023c37d6a7d1192aec3d

                                                                      SHA256

                                                                      0263a627bbea55a66deecd7a43f8537bb68b5f95bb3d4269d3e594bd1d851e64

                                                                      SHA512

                                                                      b56b2143a60e6153e7fb752029c72d78547d5253f32ecbd0dda5a8acc5c3859292e860162b11a041a37b4f618f4425484b4e2385d7e2c621c8cbced073e3a67e

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                      Filesize

                                                                      56KB

                                                                      MD5

                                                                      e9794f785780945d2dde78520b9bb59f

                                                                      SHA1

                                                                      293cae66cedbc7385cd49819587d3d5a61629422

                                                                      SHA256

                                                                      0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                                                                      SHA512

                                                                      1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                      Filesize

                                                                      588KB

                                                                      MD5

                                                                      17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                      SHA1

                                                                      bc0316e11c119806907c058d62513eb8ce32288c

                                                                      SHA256

                                                                      13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                      SHA512

                                                                      f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                      Filesize

                                                                      213B

                                                                      MD5

                                                                      7865853a1570118f6367750c3e84c4be

                                                                      SHA1

                                                                      05ebdf45557abb36b0c51d2d6a49cc04a8c05a53

                                                                      SHA256

                                                                      cf44eca6d2c85fc05e4ab32cf015523af9a5fa7d5d84e91769a1bc58cd807c44

                                                                      SHA512

                                                                      7852a91a821c9b58192e2b524884761922994052c4eb7d18e761f935b1563ceb61577d6be72673be2ced1c248d4deb413a9f80d1819c8c2a2e8b2e148678f241

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      1ef7574bc4d8b6034935d99ad884f15b

                                                                      SHA1

                                                                      110709ab33f893737f4b0567f9495ac60c37667c

                                                                      SHA256

                                                                      0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                      SHA512

                                                                      947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      f512536173e386121b3ebd22aac41a4e

                                                                      SHA1

                                                                      74ae133215345beaebb7a95f969f34a40dda922a

                                                                      SHA256

                                                                      a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                      SHA512

                                                                      1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                      Filesize

                                                                      76KB

                                                                      MD5

                                                                      b40fe65431b18a52e6452279b88954af

                                                                      SHA1

                                                                      c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                      SHA256

                                                                      800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                      SHA512

                                                                      e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                      Filesize

                                                                      80KB

                                                                      MD5

                                                                      3904d0698962e09da946046020cbcb17

                                                                      SHA1

                                                                      edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                      SHA256

                                                                      a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                      SHA512

                                                                      c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                                      Filesize

                                                                      92KB

                                                                      MD5

                                                                      75cf057e3e9f9aac5f38b90879017c6c

                                                                      SHA1

                                                                      e3fc9ea50ff24cdc3ba1720ba1c82d9fbc1ace30

                                                                      SHA256

                                                                      cfef1735b5c768cdba22a1e43629bc1e359c5f2ba841258106bbfcad7cc56bfd

                                                                      SHA512

                                                                      c3a1be90163a71fdf948f2f3fad9ea569ca12598f2abe1652434d2a123e60c892971450c6ca280f8f58c5100f90729d2d87e7922e264d84f39dcbab58d3d441d

                                                                      Download Submit

                                                                    • C:\ProgramData\AnyDesk\ad_f45e5af2_msi\system.conf
                                                                      Filesize

                                                                      395B

                                                                      MD5

                                                                      ddbbfbda3a40a51adbc92a11325f601b

                                                                      SHA1

                                                                      0492833bc268ce53cf9622ed4c3505ae5310b10e

                                                                      SHA256

                                                                      42361da2591b0fada7032c16d723cfd4e32f7406a1530f8cc4ea84242b406b86

                                                                      SHA512

                                                                      141135369cacea456c8d2a21f634a506fd9bc5f5f1308ba7456a8f63c36d869b838bd963524f06efe05a416db78ddabfd36004a284c6dcee34aa8b481ab6df7b

                                                                      Download Submit

                                                                    • C:\ProgramData\AnyDesk\ad_f45e5af2_msi\system.conf
                                                                      Filesize

                                                                      583B

                                                                      MD5

                                                                      5549b3663c33527a4626d29eae8f61e0

                                                                      SHA1

                                                                      3e3432191e3e3f5b484cb3bf0e98dbdb86463fea

                                                                      SHA256

                                                                      d3ed73beea34ae5b7feb180ac78d7871b8c9d19173af08199de9a2dd9f77968c

                                                                      SHA512

                                                                      821fa3fb1c7ea19f7db0342ba66b7958b545f57cf26d1e10af4c1def62f41107fdacf9f07dabd0c45633c3d98413d3a5d9c81872a25dbb85102577c98c659a79

                                                                      Download Submit

                                                                    • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\364c62f823f3be9362164d680278e8af
                                                                      Filesize

                                                                      16KB

                                                                      MD5

                                                                      b2e89027a140a89b6e3eb4e504e93d96

                                                                      SHA1

                                                                      f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                      SHA256

                                                                      5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                      SHA512

                                                                      93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                      Filesize

                                                                      471B

                                                                      MD5

                                                                      b6102b47f3d2450f02c1167e5b337e9b

                                                                      SHA1

                                                                      91a6e5d7b3540556c971bcd6cdf52abd2cffcbfe

                                                                      SHA256

                                                                      e0c2d57c8661d444666ae009725ee84cd33a29ac48738277ea37bfd56b3cf8c4

                                                                      SHA512

                                                                      62bb67b325b56c41544956928ef0991262df019a470fc5792ba5abb7096e419f7ea3c8326560ffbe2b50ed0612fbc968fdf7564793a4d550b2465b799cbfcedf

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                      Filesize

                                                                      727B

                                                                      MD5

                                                                      a433d0bd40ae75fbd372efe3fd3e2bc6

                                                                      SHA1

                                                                      137005873f5a1d269a7047adbcd08f5d204a323b

                                                                      SHA256

                                                                      83599ee2c90c3ef5da0f1d87bb6155bdcd2e70b97ad2163e4247f74f0925e1ec

                                                                      SHA512

                                                                      dca032c59d56db32821d19d913cb7519fbc0545bdc5b19cc6ca9eebf2faa8dca9739d4190b269c34438bca85879a271108f0641c2b653df37f08bfb9224150cb

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      727B

                                                                      MD5

                                                                      dd4a6de11c5aca03831ce2c397816af4

                                                                      SHA1

                                                                      98aa2153abf98ed443bb2214471fad28f61db070

                                                                      SHA256

                                                                      49f3eb5a31dc7c52694a2baa6defe57f668a679c3fc5cc736162b6e1e2cf4bb3

                                                                      SHA512

                                                                      8c0de17a3838d920121901226aa8d72b8434b8ea00f6d9a0e354d05049b5cb56c6bb7f9f9325e882077cbfb43f8da5f71b8f50675569c9a3a163c20a457c9694

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                      Filesize

                                                                      400B

                                                                      MD5

                                                                      dc262d03c118c59058e6c1c30c41c77c

                                                                      SHA1

                                                                      63917a7d1d83a62922be1d5c407ea3ee9dbc419f

                                                                      SHA256

                                                                      8813cf1553c6d588c2c13b143101b19eed8babd3ccbf1871b1be9c53792b3d87

                                                                      SHA512

                                                                      de8b0b56d98d19bfba0f1f109266c11948ae4bb06ecbcbdce3ac41cf46d8c6e79257559bc0abad250a381b0eec0b6633dd635ce65ea8f8e2e84765d3677ed247

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                      Filesize

                                                                      404B

                                                                      MD5

                                                                      e6cd7ed8c1385af269448552e0155363

                                                                      SHA1

                                                                      e1f686992949b6485fbd6a4c0f73306031906426

                                                                      SHA256

                                                                      7bd9b4297ba94d454d92226f7f9122c62bf87ae836c50d5ecf990089c595f4fe

                                                                      SHA512

                                                                      18fe65745a5b2e3f47d21f2db6383ac12fb8ce2774da47aab3c35a4397d1cd3f3628d9738bd1b543df2e10e7b936ac28fad172f5394a992bff4bf5348f78d815

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      93ca7e027ef6c64bffe08c020e5dde29

                                                                      SHA1

                                                                      5b595cae16baa1d127b9d95a29ea02fc61b4426b

                                                                      SHA256

                                                                      2ee0c6245f7fe866b13b462d2abd91fdd15e765b7a7c0647e98422f19534402c

                                                                      SHA512

                                                                      c07ce440057ccfadfa4632d6e4bb80324b7c819b59a0b7aadb00d76275e55500141a89d891ebbeb73ceb61bb812ac5b055c9e7fb91e9c8673e79a5d400249feb

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                      Filesize

                                                                      651B

                                                                      MD5

                                                                      9bbfe11735bac43a2ed1be18d0655fe2

                                                                      SHA1

                                                                      61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                      SHA256

                                                                      549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                      SHA512

                                                                      a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI83D2.tmp
                                                                      Filesize

                                                                      4.5MB

                                                                      MD5

                                                                      08211c29e0d617a579ffa2c41bde1317

                                                                      SHA1

                                                                      4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                                      SHA256

                                                                      3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                                      SHA512

                                                                      d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI923D.tmp
                                                                      Filesize

                                                                      509KB

                                                                      MD5

                                                                      88d29734f37bdcffd202eafcdd082f9d

                                                                      SHA1

                                                                      823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                      SHA256

                                                                      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                      SHA512

                                                                      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI923D.tmp-\AlphaControlAgentInstallation.dll
                                                                      Filesize

                                                                      25KB

                                                                      MD5

                                                                      aa1b9c5c685173fad2dabebeb3171f01

                                                                      SHA1

                                                                      ed756b1760e563ce888276ff248c734b7dd851fb

                                                                      SHA256

                                                                      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                      SHA512

                                                                      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI923D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      1a5caea6734fdd07caa514c3f3fb75da

                                                                      SHA1

                                                                      f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                      SHA256

                                                                      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                      SHA512

                                                                      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI958A.tmp-\CustomAction.config
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      bc17e956cde8dd5425f2b2a68ed919f8

                                                                      SHA1

                                                                      5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                      SHA256

                                                                      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                      SHA512

                                                                      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI958A.tmp-\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      695KB

                                                                      MD5

                                                                      715a1fbee4665e99e859eda667fe8034

                                                                      SHA1

                                                                      e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                      SHA256

                                                                      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                      SHA512

                                                                      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI9C82.tmp
                                                                      Filesize

                                                                      211KB

                                                                      MD5

                                                                      a3ae5d86ecf38db9427359ea37a5f646

                                                                      SHA1

                                                                      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                      SHA256

                                                                      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                      SHA512

                                                                      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                      Download Submit

                                                                    • C:\Windows\Installer\e5791a1.msi
                                                                      Filesize

                                                                      2.9MB

                                                                      MD5

                                                                      cd137d3bdb80bb4b2fefe9bac6f1bf23

                                                                      SHA1

                                                                      d30769a433cb7f01c78a1b088a26ddcb8036d367

                                                                      SHA256

                                                                      2f940888c42e0fb3e6d625fc80ccdb5e6c26e43d6f87ad67cb020e287bfec07e

                                                                      SHA512

                                                                      3e64935f12cb35fc6bca0172abc85a0040863ab610385e665c251930ebc8b85525a06b26770e395a8f37c8dc9ea43b500855751a89b94ccbb16e6f204786fb7d

                                                                      Download Submit

                                                                    • C:\Windows\Installer\e5791a8.msi
                                                                      Filesize

                                                                      7.7MB

                                                                      MD5

                                                                      383bfb6f7210ebc9dc025754987b53b0

                                                                      SHA1

                                                                      93fd6096c8db53f25b16662b270d48814d6166dd

                                                                      SHA256

                                                                      8daef36f8974c24d0fa70124b9edceb1162bbfdf95939a905f6d95f3f80b72db

                                                                      SHA512

                                                                      af73aa9e77edc5f4d3e694e6ae42f209ce676f4c437ea0c4e4d21e4ffa291f2b3c8871ffc2e14c72440f5657258517c3526444af9700be4c20167303bc3893e2

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{81094faf-4220-f447-8a5d-729f46ee4c95}\lci_proxywddm.cat
                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      8e16d54f986dbe98812fd5ec04d434e8

                                                                      SHA1

                                                                      8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                      SHA256

                                                                      7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                      SHA512

                                                                      e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{81094faf-4220-f447-8a5d-729f46ee4c95}\lci_proxywddm.inf
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      0315a579f5afe989154cb7c6a6376b05

                                                                      SHA1

                                                                      e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                      SHA256

                                                                      d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                      SHA512

                                                                      c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{81094faf-4220-f447-8a5d-729f46ee4c95}\x64\lci_proxyumd.dll
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      4dc11547a5fc28ca8f6965fa21573481

                                                                      SHA1

                                                                      d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                      SHA256

                                                                      e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                      SHA512

                                                                      bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{81094faf-4220-f447-8a5d-729f46ee4c95}\x64\lci_proxyumd32.dll
                                                                      Filesize

                                                                      135KB

                                                                      MD5

                                                                      67ae7b2c36c9c70086b9d41b4515b0a8

                                                                      SHA1

                                                                      ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                      SHA256

                                                                      79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                      SHA512

                                                                      4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{81094faf-4220-f447-8a5d-729f46ee4c95}\x64\lci_proxywddm.sys
                                                                      Filesize

                                                                      119KB

                                                                      MD5

                                                                      b9b0e9b4d93b18b99ece31a819d71d00

                                                                      SHA1

                                                                      2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                      SHA256

                                                                      0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                      SHA512

                                                                      465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{b0584183-ddc1-3a4d-a912-59a0e3f7dd31}\lci_iddcx.cat
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      62458e58313475c9a3642a392363e359

                                                                      SHA1

                                                                      e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                      SHA256

                                                                      85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                      SHA512

                                                                      49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{b0584183-ddc1-3a4d-a912-59a0e3f7dd31}\lci_iddcx.inf
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      1cec22ca85e1b5a8615774fca59a420b

                                                                      SHA1

                                                                      049a651751ef38321a1088af6a47c4380f9293fc

                                                                      SHA256

                                                                      60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                      SHA512

                                                                      0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{b0584183-ddc1-3a4d-a912-59a0e3f7dd31}\x64\lci_iddcx.dll
                                                                      Filesize

                                                                      52KB

                                                                      MD5

                                                                      01e8bc64139d6b74467330b11331858d

                                                                      SHA1

                                                                      b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                      SHA256

                                                                      148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                      SHA512

                                                                      4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                      Download Submit

                                                                    • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-17-17-11.dat
                                                                      Filesize

                                                                      602B

                                                                      MD5

                                                                      a13f4159757cd6e8f52e431a7fc2833a

                                                                      SHA1

                                                                      600cd18fb0c5ecca1ed9214ec2df4be4bafd1945

                                                                      SHA256

                                                                      679a250da84d8a187e1482d2979b618be30c32ce7fd048e12d4c9a34f605eefd

                                                                      SHA512

                                                                      95c3d73bc3dcfb15c1d50088bdea3f6839e195cd96da1b85ba5585a844f6bacc6dac3b488b0f849f84e2f1b0cf9fe6236d72cc7dd90021dda481b7758d08aedd

                                                                      Download Submit

                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                      Filesize

                                                                      976B

                                                                      MD5

                                                                      0bcd675e6327839dfaccbee9a81dfc7f

                                                                      SHA1

                                                                      b296edb7a66ac2bc85d9cd44b3db92ef69db1a47

                                                                      SHA256

                                                                      8e8af471d68975001535ec7e8672bf5dbfb3afbef2c5b914cb21f2b86ad3f125

                                                                      SHA512

                                                                      2939c0c537418d7a33892f14cc5def4998e4adb221c53e71ff180dc53aa78f5acb87ec04e9250e016a68e21e049725ab0b4fb9916665aa6642b4bea320283ff0

                                                                      Download Submit

                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      59b19a3e055f60ea8810f04e429a081b

                                                                      SHA1

                                                                      53d928ae89c3faca1bff58ca8da3a5ff24bb3332

                                                                      SHA256

                                                                      cda80d42dc077b02ee82fed5ca79d908111f8ba89bd681d9b61450de83536f68

                                                                      SHA512

                                                                      85868c535cf08d33300d4c49a62a2563a233914e7804eef4f95ca783fbfd626dd82aa0ee74fb881f31be4c6e5b0324e47e535ea4493b87a998b97104b1322c09

                                                                      Download Submit

                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      f640cfecea7c84c31447fbee8693ef10

                                                                      SHA1

                                                                      8c63529e91e4efee798d8bb5699a40747267c3b7

                                                                      SHA256

                                                                      a81213508cb4516bba4c48a27eed23999fc94d5d276877bf08702fa3d0c0eff4

                                                                      SHA512

                                                                      1ac238127d6176379576318dfc58dffbc0f28c4ad8f04919e953e72a379b33a8e10fd1771879f4171d660841ae6dce0b87133135197a3cc3d1b46ee669cfa3bc

                                                                      Download Submit

                                                                    • C:\Windows\Temp\PreVer.log
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      920a0530e40a4b1895c697f073ba20bd

                                                                      SHA1

                                                                      ff4557b83342be3740230a301673bb966f20aaf5

                                                                      SHA256

                                                                      08ede0088ceb346029fb768d19274da01846c73f743b6a17e71f0793b180bff0

                                                                      SHA512

                                                                      4ff36d96d8ec8ecd2e50536e0beb8964cb5afc1e37fbc44a0c50198e4e747d493b66d7cdd04d118639e4018a024fb8d7fae39a24972700dfa966baa68fde7129

                                                                      Download Submit

                                                                    • C:\Windows\Temp\Tmp57B0.tmp
                                                                      Filesize

                                                                      3KB

                                                                      MD5

                                                                      560af444a6a7faa0b0ca94dc16ca2a58

                                                                      SHA1

                                                                      df31453fafde354870a0a9a8ca50b18e284c32e4

                                                                      SHA256

                                                                      94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429

                                                                      SHA512

                                                                      7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack.log
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      4f9ec7dc06d94c67b6cfbe8631b400ec

                                                                      SHA1

                                                                      67b048502a25a4b2bc1259bf62514e323c305519

                                                                      SHA256

                                                                      6b9ca0879ca9b8d80f6f38ab3113cbf50d3cd74558eaa696edc650930f048d54

                                                                      SHA512

                                                                      87bd68aff672121b1ed44d9354e728780533e48bdcfbc4dd79e6e7ea80db768f8ddbe08971d4e33caf9f9db066decd7bd4a7c516aa4bf40e8fcced59552afc0a

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack.log
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      af871a788baec1922a7017d46c065f9c

                                                                      SHA1

                                                                      8e3cb52f72fcef7cd4fd3e8794be0d00472c2047

                                                                      SHA256

                                                                      33ac0bb1bc83a5d7ed52a84fca8b3fab7388ba881f252c565d61bcc890419ffb

                                                                      SHA512

                                                                      4b2190ba1a1190ca4c6946138e8fbced7cd64447c3a62093b007bbf60b200f16e40be258c66767a7ad00c24b74c07303ac0bf101ef1efda17e55ce128d93ff60

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                      Filesize

                                                                      3.2MB

                                                                      MD5

                                                                      2c18826adf72365827f780b2a1d5ea75

                                                                      SHA1

                                                                      a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                                      SHA256

                                                                      ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                                      SHA512

                                                                      474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\IsConfig.ini
                                                                      Filesize

                                                                      571B

                                                                      MD5

                                                                      d239b8964e37974225ad69d78a0a8275

                                                                      SHA1

                                                                      cf208e98a6f11d1807cd84ca61504ad783471679

                                                                      SHA256

                                                                      0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                                      SHA512

                                                                      88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\String1033.txt
                                                                      Filesize

                                                                      182KB

                                                                      MD5

                                                                      99bbffd900115fe8672c73fb1a48a604

                                                                      SHA1

                                                                      8f587395fa6b954affef337c70781ce00913950e

                                                                      SHA256

                                                                      57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                                      SHA512

                                                                      d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\_is6BA7.exe
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      7a1c100df8065815dc34c05abc0c13de

                                                                      SHA1

                                                                      3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                      SHA256

                                                                      e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                      SHA512

                                                                      bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{0162E4D2-BF94-4BAE-A454-2D3B828FC807}\setup.inx
                                                                      Filesize

                                                                      345KB

                                                                      MD5

                                                                      0376dd5b7e37985ea50e693dc212094c

                                                                      SHA1

                                                                      02859394164c33924907b85ab0aaddc628c31bf1

                                                                      SHA256

                                                                      c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                      SHA512

                                                                      69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\ISRT.dll
                                                                      Filesize

                                                                      427KB

                                                                      MD5

                                                                      85315ad538fa5af8162f1cd2fce1c99d

                                                                      SHA1

                                                                      31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                      SHA256

                                                                      70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                      SHA512

                                                                      877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{BE07E21C-E729-47D9-BAE9-CB891DBFEAFD}\_isres_0x0409.dll
                                                                      Filesize

                                                                      1.8MB

                                                                      MD5

                                                                      befe2ef369d12f83c72c5f2f7069dd87

                                                                      SHA1

                                                                      b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                      SHA256

                                                                      9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                      SHA512

                                                                      760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                      Download Submit

                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                      Filesize

                                                                      404B

                                                                      MD5

                                                                      5d6694cc894d3ab541bd06c2d83c6fb0

                                                                      SHA1

                                                                      7ecc2ea3fab07d99714b597decb201d6a1e67d00

                                                                      SHA256

                                                                      931e19281cf3c7b2325158146f44aa68bbb287ad2219f25a5ea6db4a98173553

                                                                      SHA512

                                                                      4989e347ef3af2e9c25f18f9485dd4e8a20a32ac17175efdc387fca47bcde8ab71e95a2c0275af12680d32e65757aa15646bba5cb0f0962696a700c81937db81

                                                                      Download Submit

                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      1dff2e7333f5f79f5d296429529d7f24

                                                                      SHA1

                                                                      08e0e08f19a4d57dbe62af540c65b4f54d0b97f7

                                                                      SHA256

                                                                      e0fea2d693ac7dd939c560cb33547a796aabad075a70a1f433413c26d5973ae0

                                                                      SHA512

                                                                      84d6af8103410525dabfb2240ed4be4a2a20d6bdfb2bb1c9b96ac3d47399cc7d7823667562073155df638b92ca5a898d9d0268de5c54d298d1d790195d7bd15a

                                                                      Download Submit

                                                                    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                      Filesize

                                                                      24.1MB

                                                                      MD5

                                                                      8d020c4fd7296ee93ffebf45570c1ae6

                                                                      SHA1

                                                                      a1dca1005ad7d698aa72e46f0c80e3023affe103

                                                                      SHA256

                                                                      24d3f85112196e5cf48af6b0a921a0926053c177787bc073212ea30e77ede084

                                                                      SHA512

                                                                      a2018c6fb3c871d83839c2095bb7932b51ac05e2c9c14bfc4c5c343cae2bb15f2f40578ba575b179ba4cdf5e062aded3a3a05a65d2069720df883b587cdec928

                                                                      Download Submit

                                                                    • \??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{793a360c-dfdc-458e-b836-1572d7d6d775}_OnDiskSnapshotProp
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      508d73d3501b643bfa49c74fca759bc0

                                                                      SHA1

                                                                      99606ee09ffda30e48bafe1d1d43b5c7e02bc06d

                                                                      SHA256

                                                                      cb8b762841e050843c2dd229a5fba60746e4f43a4251a0befd5e65aa61360c1d

                                                                      SHA512

                                                                      aba31cb94f06f73e39ed1b14aac8b335f8faeca3513865918ecf0e777f732e2f53c4f55d07f6cc3a7b3ea4daaec4900cd21fc82fdb301973db9ffc349da4b05d

                                                                      Download Submit

                                                                    • memory/116-484-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/116-476-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/320-112-0x00000000053A0000-0x0000000005406000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                      Download

                                                                    • memory/548-355-0x00000225DDAF0000-0x00000225DDB0C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/548-358-0x00000225F63E0000-0x00000225F6428000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                      Download

                                                                    • memory/548-353-0x00000225DD130000-0x00000225DD194000-memory.dmp

                                                                      Filesize

                                                                      400KB

                                                                      Download

                                                                    • memory/548-354-0x00000225F6230000-0x00000225F627A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/548-357-0x00000225F6280000-0x00000225F62CC000-memory.dmp

                                                                      Filesize

                                                                      304KB

                                                                      Download

                                                                    • memory/548-360-0x00000225DDB20000-0x00000225DDB2A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/548-359-0x00000225DDB10000-0x00000225DDB18000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/548-361-0x00000225F6560000-0x00000225F663C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/548-362-0x00000225F6640000-0x00000225F66F2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/548-369-0x00000225F64C0000-0x00000225F64E6000-memory.dmp

                                                                      Filesize

                                                                      152KB

                                                                      Download

                                                                    • memory/548-368-0x00000225F73A0000-0x00000225F73DA000-memory.dmp

                                                                      Filesize

                                                                      232KB

                                                                      Download

                                                                    • memory/548-367-0x00000225F64F0000-0x00000225F651A000-memory.dmp

                                                                      Filesize

                                                                      168KB

                                                                      Download

                                                                    • memory/548-366-0x00000225F6700000-0x00000225F6768000-memory.dmp

                                                                      Filesize

                                                                      416KB

                                                                      Download

                                                                    • memory/548-365-0x00000225F64B0000-0x00000225F64B8000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/548-364-0x00000225F64A0000-0x00000225F64A8000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/548-363-0x00000225F6490000-0x00000225F6498000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/880-530-0x00000167AF180000-0x00000167AF192000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/880-863-0x00000167C8D80000-0x00000167C8DD4000-memory.dmp

                                                                      Filesize

                                                                      336KB

                                                                      Download

                                                                    • memory/880-531-0x00000167AF630000-0x00000167AF64C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/880-533-0x00000167C83B0000-0x00000167C8462000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/924-277-0x00000208AF8A0000-0x00000208AF950000-memory.dmp

                                                                      Filesize

                                                                      704KB

                                                                      Download

                                                                    • memory/924-274-0x0000020896710000-0x0000020896740000-memory.dmp

                                                                      Filesize

                                                                      192KB

                                                                      Download

                                                                    • memory/924-278-0x00000208970A0000-0x00000208970BC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/1132-167-0x00000207AECE0000-0x00000207AED1C000-memory.dmp

                                                                      Filesize

                                                                      240KB

                                                                      Download

                                                                    • memory/1132-166-0x0000020796580000-0x0000020796592000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/1132-150-0x00000207948C0000-0x00000207948E8000-memory.dmp

                                                                      Filesize

                                                                      160KB

                                                                      Download

                                                                    • memory/1132-162-0x00000207AEF70000-0x00000207AF008000-memory.dmp

                                                                      Filesize

                                                                      608KB

                                                                      Download

                                                                    • memory/1596-45-0x00000000053B0000-0x00000000053BC000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/1596-41-0x0000000005370000-0x000000000539E000-memory.dmp

                                                                      Filesize

                                                                      184KB

                                                                      Download

                                                                    • memory/1640-312-0x000001F0521E0000-0x000001F0521FC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/1640-311-0x000001F052560000-0x000001F0525AA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/1640-310-0x000001F051BB0000-0x000001F051BC0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/1640-351-0x000001F06B090000-0x000001F06B142000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/1640-356-0x000001F052220000-0x000001F052228000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/1640-313-0x000001F06AFB0000-0x000001F06B08C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/2344-532-0x00000180CD830000-0x00000180CD846000-memory.dmp

                                                                      Filesize

                                                                      88KB

                                                                      Download

                                                                    • memory/2344-535-0x00000180CE0B0000-0x00000180CE0CC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/2344-534-0x00000180E69A0000-0x00000180E6A52000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2592-195-0x000002B4A60C0000-0x000002B4A6172000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2592-243-0x000002B4A6650000-0x000002B4A6688000-memory.dmp

                                                                      Filesize

                                                                      224KB

                                                                      Download

                                                                    • memory/2592-203-0x000002B4A6050000-0x000002B4A6072000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/2648-78-0x00000000050D0000-0x0000000005182000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2648-81-0x0000000002D00000-0x0000000002D22000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/2648-82-0x0000000005190000-0x00000000054E4000-memory.dmp

                                                                      Filesize

                                                                      3.3MB

                                                                      Download

                                                                    • memory/2832-1109-0x000001699EFA0000-0x000001699EFB0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/2832-1118-0x000001699F930000-0x000001699F944000-memory.dmp

                                                                      Filesize

                                                                      80KB

                                                                      Download

                                                                    • memory/2832-1112-0x000001699F910000-0x000001699F930000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2832-1116-0x00000169B8AC0000-0x00000169B8B26000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                      Download

                                                                    • memory/2832-1115-0x00000169B80E0000-0x00000169B8192000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2872-1842-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/2872-487-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/2872-417-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/2872-485-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/2880-468-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/2880-486-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/3256-2832-0x0000000072A10000-0x0000000072B2C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/3256-2833-0x0000000072640000-0x0000000072A0D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/3304-862-0x000001CD22E70000-0x000001CD22E8A000-memory.dmp

                                                                      Filesize

                                                                      104KB

                                                                      Download

                                                                    • memory/3304-798-0x000001CD22630000-0x000001CD2263A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/3304-1015-0x000001CD3B8B0000-0x000001CD3B962000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/3304-1107-0x000001CD3BEA0000-0x000001CD3C3C8000-memory.dmp

                                                                      Filesize

                                                                      5.2MB

                                                                      Download

                                                                    • memory/3628-1125-0x0000013457250000-0x000001345732C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/3628-1047-0x000001343DDB0000-0x000001343DDBC000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/3628-1162-0x0000013457010000-0x000001345702C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/3628-1093-0x000001343E270000-0x000001343E28C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/3628-1072-0x0000013456EC0000-0x0000013456F0A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/3628-1117-0x00000134570C0000-0x0000013457170000-memory.dmp

                                                                      Filesize

                                                                      704KB

                                                                      Download

                                                                    • memory/3948-2816-0x0000000072A10000-0x0000000072B2C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/3948-2817-0x0000000072640000-0x0000000072A0D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/4184-1365-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/4184-1306-0x0000000000580000-0x000000000156F000-memory.dmp

                                                                      Filesize

                                                                      15.9MB

                                                                      Download

                                                                    • memory/4360-2454-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4360-1430-0x0000000003E80000-0x0000000004047000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                      Download

                                                                    • memory/4360-2372-0x0000000003EC0000-0x0000000004087000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                      Download

                                                                    • memory/4408-695-0x00000267126C0000-0x00000267126FA000-memory.dmp

                                                                      Filesize

                                                                      232KB

                                                                      Download

                                                                    • memory/4408-1196-0x0000026713280000-0x0000026713290000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/4408-1100-0x0000026713150000-0x0000026713198000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                      Download

                                                                    • memory/4408-1200-0x000002672C4B0000-0x000002672C4D8000-memory.dmp

                                                                      Filesize

                                                                      160KB

                                                                      Download

                                                                    • memory/4408-1088-0x00000267130E0000-0x00000267130FC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/4408-1060-0x00000267131C0000-0x0000026713272000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5148-1237-0x000001CC3DB40000-0x000001CC3DB66000-memory.dmp

                                                                      Filesize

                                                                      152KB

                                                                      Download

                                                                    • memory/5172-1059-0x0000021393430000-0x000002139343C000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/5172-1101-0x0000021393900000-0x0000021393920000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/5172-1089-0x00000213938E0000-0x00000213938F8000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                      Download

                                                                    • memory/5172-1096-0x00000213AC660000-0x00000213AC712000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5224-1111-0x0000021CD38A0000-0x0000021CD38EA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/5224-1127-0x0000021CEC3C0000-0x0000021CEC472000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5224-1221-0x0000021CEC290000-0x0000021CEC2AA000-memory.dmp

                                                                      Filesize

                                                                      104KB

                                                                      Download

                                                                    • memory/5224-1114-0x0000021CD3870000-0x0000021CD388C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5224-1110-0x0000021CD3020000-0x0000021CD3032000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/5224-1128-0x0000021CEC560000-0x0000021CEC63C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/5484-1124-0x00000265ED320000-0x00000265ED33C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5484-1120-0x00000265ED390000-0x00000265ED442000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5484-1104-0x00000265ED080000-0x00000265ED08A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/5484-1123-0x00000265ED450000-0x00000265ED4B2000-memory.dmp

                                                                      Filesize

                                                                      392KB

                                                                      Download

                                                                    • memory/5484-1062-0x00000265D4000000-0x00000265D4034000-memory.dmp

                                                                      Filesize

                                                                      208KB

                                                                      Download

                                                                    • memory/5484-1103-0x00000265ED100000-0x00000265ED118000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                      Download

                                                                    • memory/5484-1108-0x00000265ED170000-0x00000265ED1BA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/5484-1098-0x00000265ED060000-0x00000265ED07C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5484-1121-0x00000265ED530000-0x00000265ED60C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/5484-1090-0x00000265ED090000-0x00000265ED0DA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/5936-1119-0x000001833DF30000-0x000001833E58C000-memory.dmp

                                                                      Filesize

                                                                      6.4MB

                                                                      Download

                                                                    • memory/5936-1097-0x00000183240C0000-0x00000183240D0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/5936-1122-0x000001833D820000-0x000001833D866000-memory.dmp

                                                                      Filesize

                                                                      280KB

                                                                      Download

                                                                    • memory/5936-1092-0x0000018323C20000-0x0000018323C32000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/5936-1218-0x000001833D870000-0x000001833D8C0000-memory.dmp

                                                                      Filesize

                                                                      320KB

                                                                      Download

                                                                    • memory/5936-1219-0x000001833D9C0000-0x000001833DA36000-memory.dmp

                                                                      Filesize

                                                                      472KB

                                                                      Download

                                                                    • memory/5936-1220-0x0000018324530000-0x000001832454E000-memory.dmp

                                                                      Filesize

                                                                      120KB

                                                                      Download

                                                                    • memory/5936-1106-0x0000018324490000-0x00000183244B0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/5936-1105-0x000001833CD60000-0x000001833CE12000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5976-2820-0x0000000072A10000-0x0000000072B2C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5976-2821-0x0000000072640000-0x0000000072A0D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download