Overview

overview

10

Static

static

10

setup_wellnet.msi

windows7-x64

10

setup_wellnet.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 20:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_wellnet.msi

  • Size

    2.9MB

  • MD5

    67208cd63d07c6f274d276f04caa1578

  • SHA1

    3a8b02d2aed87fe63daf529bb61298010ab1f816

  • SHA256

    fa798e522d0e8b0a795b5083fdb5be379b27b403678f616660172acfe4ecb8ac

  • SHA512

    95baa0b0b1247a05d06d894e5ab0475a3b83cdffe48fe8c8f96c08acb94437e4f007ddc5c3abe54c5414ab3c0375a0202f7fb50aa6156ec8c72012acce367f82

  • SSDEEP

    49152:a+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:a+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_wellnet.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2420
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3848
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2304
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 319A91AB3C04FE58A18EDDE2EBAF84E5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE203.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240640781 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4400
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE734.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240641859 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1204
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIEBD9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240643109 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4620
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIF796.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646078 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4132
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1AD9148218E80F35505C49781E24DBE9 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3632
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1832
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="6" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="0013z00002hK1yJAAS" /AgentId="3c1370eb-712c-4321-ba81-e53b8a439c36"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4532
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D7EDA324B002B4C272722B8755A61CFB E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E3C87B06-DB95-41E4-80FF-09AE89CBA5CD}
        3⤵
        • Executes dropped EXE
        PID:3468
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4A9E263-7699-43BA-87B2-38CBFF90E0BF}
        3⤵
        • Executes dropped EXE
        PID:2284
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{805A9777-47DD-4F93-A128-CD79119ECEBA}
        3⤵
        • Executes dropped EXE
        PID:4708
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{34D86C03-B533-4A32-8090-9589D13C017D}
        3⤵
        • Executes dropped EXE
        PID:4996
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CD9B12AD-F816-48AD-9105-B426F233F39E}
        3⤵
        • Executes dropped EXE
        PID:3448
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5E9068C1-23E1-45D8-9C08-934E8D190992}
        3⤵
        • Executes dropped EXE
        PID:1520
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55407BE7-5507-4955-815A-60C21F15436A}
        3⤵
        • Executes dropped EXE
        PID:2052
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E2DB17AA-55C3-4F99-809B-EB675E2E726F}
        3⤵
        • Executes dropped EXE
        PID:1876
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E15CE615-B4D7-4845-B7D8-9018BDB7F909}
        3⤵
        • Executes dropped EXE
        PID:3828
      • C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe
        C:\Windows\TEMP\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_is30BF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC11BAEC-3BBF-4F0D-83B5-BF55C866C5E8}
        3⤵
        • Executes dropped EXE
        PID:4084
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4620
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4820
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1412
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3020
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:312
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4884
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3476
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1992
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1348
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4328
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4220
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4256
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1600
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3684
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3480
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3948
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2920
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1588
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2420
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1652
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52EA213A-4D43-4DF9-A668-E930F0858AC6}
        3⤵
        • Executes dropped EXE
        PID:4276
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55B791A7-9A95-49C7-8C43-D5A37C8D1D55}
        3⤵
        • Executes dropped EXE
        PID:2964
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55B3E41C-68D8-4342-BCE4-6286A1960B0D}
        3⤵
        • Executes dropped EXE
        PID:3244
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9CCA2C3C-2509-43E9-88D8-75590B16495D}
        3⤵
        • Executes dropped EXE
        PID:3236
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F55D4573-892A-4BAA-B489-2DB66AFF83A5}
        3⤵
        • Executes dropped EXE
        PID:2712
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AABA05D9-4F12-4F78-87C7-51DFE6E1A505}
        3⤵
        • Executes dropped EXE
        PID:2052
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F56749B-4596-4676-9168-F3BD0761B442}
        3⤵
        • Executes dropped EXE
        PID:4708
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1DE3A2C2-6B51-4DA8-BCB3-2D5BC9EF22BA}
        3⤵
        • Executes dropped EXE
        PID:1664
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{94DC3A1A-6A24-464E-B51D-FB55794BBCC0}
        3⤵
        • Executes dropped EXE
        PID:2008
      • C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
        C:\Windows\TEMP\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41CC5636-EE63-42F2-BEB0-5ED5A5E46920}
        3⤵
        • Executes dropped EXE
        PID:4996
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5C2F666E-B63B-4C6E-B53F-9C6116EFF4AB}
        3⤵
        • Executes dropped EXE
        PID:2964
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{73226221-57C8-4108-A6E7-C6C8FAC6F9D4}
        3⤵
        • Executes dropped EXE
        PID:1536
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3487896F-4405-4CD0-AF8A-9C378A9F90A6}
        3⤵
        • Executes dropped EXE
        PID:2808
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{08F98C9D-DE2F-47FD-AF66-120055C65E12}
        3⤵
        • Executes dropped EXE
        PID:3828
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E44519F-C980-4B64-93FF-E5A324C6F7EB}
        3⤵
        • Executes dropped EXE
        PID:2712
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35317EFE-C21E-4DDC-9BE9-F86C3BB4B773}
        3⤵
        • Executes dropped EXE
        PID:1700
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C5E60B8B-7C0F-4344-92C0-DDF4A4ACA9D0}
        3⤵
        • Executes dropped EXE
        PID:748
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2FDA9DC3-E28A-4F76-8FC7-49E08527F70D}
        3⤵
        • Executes dropped EXE
        PID:1532
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B44FB69B-4C67-4968-A29D-FAF1B86886F0}
        3⤵
        • Executes dropped EXE
        PID:3020
      • C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe
        C:\Windows\TEMP\{F2DBB06C-6CAC-4BB6-8CA9-6065AE7B7122}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83414323-BFDE-41A4-8F7A-D0B8B26F41B6}
        3⤵
        • Executes dropped EXE
        PID:2524
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1652
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1256
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4352
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:4828
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:4920
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4884
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0192B5B-D1C1-454D-8666-3D5D65755E28}
            3⤵
            • Executes dropped EXE
            PID:2560
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C8F883EB-B157-4299-9E1A-875E1ECDB844}
            3⤵
            • Executes dropped EXE
            PID:1532
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DB480C80-CDB4-4B5C-945D-1BFC3AA2595A}
            3⤵
            • Executes dropped EXE
            PID:3468
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1BFF10A8-124A-4329-9CB1-2A0F70E6A587}
            3⤵
            • Executes dropped EXE
            PID:2208
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55D5A991-12EA-487F-93F5-DB058CB99CED}
            3⤵
            • Executes dropped EXE
            PID:4912
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18C6DA38-ECA0-41B8-BB8A-169B3BF597BC}
            3⤵
            • Executes dropped EXE
            PID:2324
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1B0F85FE-9F00-43B0-8096-AE9182ED95E1}
            3⤵
            • Executes dropped EXE
            PID:3224
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C620E246-284C-4529-8FFC-354F9F02FB44}
            3⤵
            • Executes dropped EXE
            PID:4996
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D4A6688C-4E9D-459E-BC67-80C5EDE73CCE}
            3⤵
            • Executes dropped EXE
            PID:2908
          • C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe
            C:\Windows\TEMP\{5A26951D-FBF1-4426-B6A2-D3EFFB97DDC2}\_is59F6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{178A083C-2472-4FC5-A238-1F0EAF75C2A8}
            3⤵
            • Executes dropped EXE
            PID:4340
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2052
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F61A41F0-45B2-4B30-833C-83151ED8E736}
            3⤵
            • Executes dropped EXE
            PID:3776
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3EE938C5-E779-4C8D-B2A8-B7E870D3E064}
            3⤵
            • Executes dropped EXE
            PID:4340
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35ACA70E-44C5-41D1-A3AF-F7181E638FF9}
            3⤵
            • Executes dropped EXE
            PID:768
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5D920460-18CE-4CD4-8067-BB5BA5FAAA2C}
            3⤵
            • Executes dropped EXE
            PID:4708
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2FEA45FA-257E-4A2F-B8E1-9C6E191B419B}
            3⤵
            • Executes dropped EXE
            PID:3684
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13D2496A-2B2C-4E42-8E6D-E74D1E11FE63}
            3⤵
            • Executes dropped EXE
            PID:2100
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7F389FE6-B5D0-43A2-82D6-94726DA707CB}
            3⤵
            • Executes dropped EXE
            PID:3468
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F4631A46-0CBB-42F5-AE4A-CFE25CE0A371}
            3⤵
            • Executes dropped EXE
            PID:1016
          • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
            C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{50879E85-0E08-4CB4-B0E4-6F3A41428CEB}
            3⤵
              PID:1588
            • C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe
              C:\Windows\TEMP\{AE19B18F-2065-484E-88C5-C2AB310E72B8}\_is5D72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC796E54-E956-4815-AC4F-127453A7F164}
              3⤵
                PID:1396
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3448
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 5F1316B396C0F1B6545C3AA76BF133D1 E Global\MSI0000
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3688
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI9CE9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688734 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                3⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5284
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI9F3C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688953 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                3⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3220
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSIA306.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240689921 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                3⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5492
              • C:\Windows\SysWOW64\NET.exe
                "NET" STOP AteraAgent
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5928
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  4⤵
                    PID:3220
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:724
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5352
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5428
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4140
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5368
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIC6C3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240699125 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4352
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:1456
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="b774a9de-864a-48b8-a18e-fd219faf6817"
                2⤵
                • Modifies data under HKEY_USERS
                PID:5948
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:1496
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2848
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:4604
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "17d66e6b-01ec-4832-a62b-b98fe428c49b" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002hK1yJAAS
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                PID:224
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "d2e78a8b-9155-4dd0-9766-7ef1e3a41974" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002hK1yJAAS
                2⤵
                • Executes dropped EXE
                PID:2884
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "3ce11a0b-bf35-40b3-840b-6944c7367ae9" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 0013z00002hK1yJAAS
                2⤵
                • Executes dropped EXE
                PID:4072
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "b90223f5-acd4-4c8e-a325-fd71b3d65edf" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 0013z00002hK1yJAAS
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3948
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:724
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:4276
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "04d1a902-70e8-435e-a9ae-394dbabf31ef" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 0013z00002hK1yJAAS
                2⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2004
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:840
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2304
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4576
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "618ca61a-7bd7-4d58-b9f8-f1c040b7de12" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 0013z00002hK1yJAAS
                2⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2892
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2652
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:4908
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "f30412b8-dba7-4aaa-8d4c-dc2ee3485897" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002hK1yJAAS
                2⤵
                  PID:3464
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                      PID:5844
                      • C:\Windows\system32\cscript.exe
                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:5136
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "bfccc756-847b-4109-b4ef-1aad46b3257c" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002hK1yJAAS
                    2⤵
                    • Drops file in System32 directory
                    PID:1848
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                      3⤵
                      • Modifies data under HKEY_USERS
                      PID:5232
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "2600ad62-38ba-4aa5-87e0-21d155c0e3ae" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002hK1yJAAS
                    2⤵
                      PID:448
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=ca032628066c46400eddcbb9c1611351&rmm_session_pwd_ttl=86400"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5360
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "957c6620-64c0-4874-885b-65f866e80871" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002hK1yJAAS
                      2⤵
                      • Drops file in Program Files directory
                      PID:4340
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "73bb175a-30b1-4687-a410-8b939909ad20" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002hK1yJAAS
                      2⤵
                      • Drops file in System32 directory
                      • Modifies registry class
                      PID:5396
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "3462e173-55c7-4565-9227-6dde52e355c5" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002hK1yJAAS
                      2⤵
                      • Drops file in System32 directory
                      PID:5492
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "bc4ebc7e-ba6d-4c9c-9178-f63a12eb1b59" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002hK1yJAAS
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      PID:5728
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "73a5f669-edd7-4f28-8a28-cb59c7508345" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002hK1yJAAS
                      2⤵
                      • Drops file in System32 directory
                      PID:5768
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "2ed3e49e-e5be-41ad-b318-7ee1b7588753" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 0013z00002hK1yJAAS
                      2⤵
                      • Drops file in System32 directory
                      PID:5896
                      • C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe
                        "C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 2ed3e49e-e5be-41ad-b318-7ee1b7588753 agent-api.atera.com/Production 443 or8ixLi90Mf connect 0013z00002hK1yJAAS
                        3⤵
                          PID:5652
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "4a78824f-8aec-4c14-b770-53a442c144fe" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002hK1yJAAS
                        2⤵
                        • Drops file in System32 directory
                        PID:5204
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "a08f60a1-c746-4c51-baf9-99eb4c8062ee" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002hK1yJAAS
                        2⤵
                        • Drops file in System32 directory
                        PID:5696
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "8844dc97-1fa5-4f29-85e0-e3f93fb2b694" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002hK1yJAAS
                        2⤵
                        • Drops file in System32 directory
                        PID:1992
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                          3⤵
                          • System Time Discovery
                          PID:5460
                          • C:\Program Files\dotnet\dotnet.exe
                            dotnet --list-runtimes
                            4⤵
                            • System Time Discovery
                            PID:1908
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "1be8329b-be3b-476f-a212-9956f56e9fbf" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002hK1yJAAS
                        2⤵
                        • Drops file in System32 directory
                        PID:5416
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "480003e6-7c71-49c7-ba60-66a72afa8ff8" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002hK1yJAAS
                        2⤵
                        • Drops file in System32 directory
                        PID:3760
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "b49aafd0-8c35-43e9-9ffc-00ba25c192d0" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 0013z00002hK1yJAAS
                        2⤵
                          PID:5488
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                        1⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1804
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                          2⤵
                          • Drops file in System32 directory
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:944
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                            -h
                            3⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SetWindowsHookEx
                            PID:1596
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                            3⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5056
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                              4⤵
                                PID:3220
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:3596
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4912
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                SRUtility.exe -r
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4352
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              • Suspicious use of SetWindowsHookEx
                              PID:960
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                4⤵
                                  PID:2004
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ver
                                    5⤵
                                      PID:448
                                    • C:\Windows\system32\sc.exe
                                      sc query ddmgr
                                      5⤵
                                      • Launches sc.exe
                                      PID:5320
                                    • C:\Windows\system32\sc.exe
                                      sc query lci_proxykmd
                                      5⤵
                                      • Launches sc.exe
                                      PID:6068
                                    • C:\Windows\system32\rundll32.exe
                                      rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                      5⤵
                                      • Drops file in System32 directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:5924
                            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                              1⤵
                              • Drops file in Program Files directory
                              • Modifies data under HKEY_USERS
                              PID:5656
                              • C:\Windows\System32\sc.exe
                                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                2⤵
                                • Launches sc.exe
                                PID:5496
                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "ab646368-6d1f-4548-aaed-cf542731eb52" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002hK1yJAAS
                                2⤵
                                  PID:2540
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "a3380526-1c68-4e41-8add-7af55d57fdb6" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002hK1yJAAS
                                  2⤵
                                    PID:5488
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "cb3f8c89-4b96-476c-8066-6a1d2a0b21a2" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002hK1yJAAS
                                    2⤵
                                    • Drops file in Program Files directory
                                    • Modifies data under HKEY_USERS
                                    PID:1840
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      3⤵
                                        PID:2588
                                        • C:\Windows\system32\cscript.exe
                                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                          4⤵
                                          • Modifies data under HKEY_USERS
                                          PID:5868
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "879170a5-723d-4423-9016-c232cc8918b4" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 0013z00002hK1yJAAS
                                      2⤵
                                        PID:5712
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "1b422f38-9b6e-4ac8-9d6e-0b4d5fd75eb1" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002hK1yJAAS
                                        2⤵
                                          PID:5400
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "8f74e8cf-f6bf-4e78-a1ab-472e52f9f182" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002hK1yJAAS
                                          2⤵
                                          • Drops file in Program Files directory
                                          • Modifies data under HKEY_USERS
                                          PID:3220
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "d851a607-1275-4c56-b190-68f4f7c0ffab" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002hK1yJAAS
                                          2⤵
                                            PID:1908
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "3e6d39f9-a63b-412f-bcec-308eb53eaf9d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002hK1yJAAS
                                            2⤵
                                              PID:5324
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                3⤵
                                                • System Time Discovery
                                                PID:6136
                                                • C:\Program Files\dotnet\dotnet.exe
                                                  dotnet --list-runtimes
                                                  4⤵
                                                  • System Time Discovery
                                                  PID:2204
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "9f0a5123-0e62-4ee2-b2ce-f74a664923ba" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002hK1yJAAS
                                              2⤵
                                                PID:2836
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "82dbef54-684b-4757-82b8-6a15b4049c9e" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002hK1yJAAS
                                                2⤵
                                                  PID:3992
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=ca032628066c46400eddcbb9c1611351&rmm_session_pwd_ttl=86400"
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2240
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "8615d6c2-afcd-4192-a1b1-ee594b237483" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002hK1yJAAS
                                                  2⤵
                                                    PID:5176
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "e1f44989-3ea5-438d-bd18-1500a9ba3f8a" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002hK1yJAAS
                                                    2⤵
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:6044
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "710872fb-8a26-4f61-867a-5a027131cd9e" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002hK1yJAAS
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    • Modifies registry class
                                                    PID:5580
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "dc7d0f0d-2d0d-41da-9b60-49a8bcd2a3a1" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002hK1yJAAS
                                                    2⤵
                                                      PID:5712
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "3c1370eb-712c-4321-ba81-e53b8a439c36" "dc7d0f0d-2d0d-41da-9b60-49a8bcd2a3a1" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "0013z00002hK1yJAAS"
                                                        3⤵
                                                          PID:2880
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 3c1370eb-712c-4321-ba81-e53b8a439c36 "ab646368-6d1f-4548-aaed-cf542731eb52" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002hK1yJAAS
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:2836
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                      1⤵
                                                      • Checks SCSI registry key(s)
                                                      PID:984
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:5492
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000168" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:6092
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000168"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:1364
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Checks SCSI registry key(s)
                                                        PID:1736

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Event Triggered Execution

                                                    2
                                                    T1546

                                                    Component Object Model Hijacking

                                                    1
                                                    T1546.015

                                                    Installer Packages

                                                    1
                                                    T1546.016

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Privilege Escalation

                                                    Event Triggered Execution

                                                    2
                                                    T1546

                                                    Component Object Model Hijacking

                                                    1
                                                    T1546.015

                                                    Installer Packages

                                                    1
                                                    T1546.016

                                                    Defense Evasion

                                                    Modify Registry

                                                    1
                                                    T1112

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Subvert Trust Controls

                                                    1
                                                    T1553

                                                    Install Root Certificate

                                                    1
                                                    T1553.004

                                                    System Binary Proxy Execution

                                                    1
                                                    T1218

                                                    Msiexec

                                                    1
                                                    T1218.007

                                                    Credential Access

                                                    Discovery

                                                    Peripheral Device Discovery

                                                    2
                                                    T1120

                                                    Query Registry

                                                    4
                                                    T1012

                                                    System Information Discovery

                                                    3
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    System Time Discovery

                                                    1
                                                    T1124

                                                    Lateral Movement

                                                    Collection

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Config.Msi\e57e178.rbs
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      d876d787772a1257faef3241723f0673

                                                      SHA1

                                                      5ad30270f46f6ff3fb727b14c3c1e0ae1ce1b80e

                                                      SHA256

                                                      a8cd088c1e42f1cfa88952ee7a11a143f748515f2d832a1c986983309043e238

                                                      SHA512

                                                      3aa0dd3e0aba730802302cc8852fe09361a4f6b4bf96ad34da0a0f88871eddca007f1a822bbcf4cbb3a631828cc78b7e23d0f2940498b69ec3d35fa1a14a044b

                                                      Download Submit

                                                    • C:\Config.Msi\e57e17d.rbs
                                                      Filesize

                                                      74KB

                                                      MD5

                                                      0347557b0b6141c02006d8404b720459

                                                      SHA1

                                                      85c29c243e92cc4a98d7b61faa789b78b9c95331

                                                      SHA256

                                                      a11def20c6147546de15e711aef2de40d3e385348a8ac95496da648d2ee4955c

                                                      SHA512

                                                      82a6deca5a3b8fdc565ca83db30bab6cbb27b5d9f9f401fe22e36aac2126496181088a64517beafc3db969168647a4ab4a7e843db0beec495a07b5ae41da0255

                                                      Download Submit

                                                    • C:\Config.Msi\e57e17f.rbs
                                                      Filesize

                                                      464B

                                                      MD5

                                                      839c93d34fc39b1e269c0b704369f102

                                                      SHA1

                                                      716729655805e226324db1e85cf6f9f8082c9a25

                                                      SHA256

                                                      f0b167034dfc4dca53c208af14792525657be6330262d0f7fab3f062e6182961

                                                      SHA512

                                                      78dac71163d02845137471ae9de6c50b828c2227fba86f7eb4c7a8b01de084b74bc3eeb8eaddd00b47df79c1978a5f31cd7f51199203924616aee2ab19ade267

                                                      Download Submit

                                                    • C:\Config.Msi\e57e185.rbs
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      fcfc2de096fadcc75ca178fec4ec3d1b

                                                      SHA1

                                                      c9eed381cafef6840933295501159a4babb47c9f

                                                      SHA256

                                                      b237558c607b52e4ff52e3459b2004b7fbea882b6a6ba6b70b55a68e70499bff

                                                      SHA512

                                                      4b2a3063054fc88ff84c015dbdc94895129aee76be5b82dc9591a7a0dc716926e910b148958056aec46729ab7b5e1bb0aa4203d2f3d941ffed3639dab09b9559

                                                      Download Submit

                                                    • C:\Config.Msi\e57e18d.rbs
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      33cfeabbb9cfe33bc94ad26934078fdc

                                                      SHA1

                                                      8093b74d7a0df61abc64bfba25b4bd3d53bde4ff

                                                      SHA256

                                                      d5265b068b2ceb0124b672a3172c2ddcef4ec480474a179a4b91ac89de6732fe

                                                      SHA512

                                                      440a7c46fd80e615a625cc4c195be17aa5c1b48181e45ff9a09e4d2f3508304780a5492649b34a180005235e5a24530b006bee8e7b00be9d7f9b9f7fbc90bd1f

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      337079222a6f6c6edf58f3f981ff20ae

                                                      SHA1

                                                      1f705fc0faa84c69e1fe936b34783b301323e255

                                                      SHA256

                                                      ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                      SHA512

                                                      ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                      Filesize

                                                      142KB

                                                      MD5

                                                      477293f80461713d51a98a24023d45e8

                                                      SHA1

                                                      e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                      SHA256

                                                      a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                      SHA512

                                                      23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      b3bb71f9bb4de4236c26578a8fae2dcd

                                                      SHA1

                                                      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                      SHA256

                                                      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                      SHA512

                                                      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                      Filesize

                                                      210KB

                                                      MD5

                                                      c106df1b5b43af3b937ace19d92b42f3

                                                      SHA1

                                                      7670fc4b6369e3fb705200050618acaa5213637f

                                                      SHA256

                                                      2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                      SHA512

                                                      616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                      Filesize

                                                      693KB

                                                      MD5

                                                      2c4d25b7fbd1adfd4471052fa482af72

                                                      SHA1

                                                      fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                      SHA256

                                                      2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                      SHA512

                                                      f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                      Filesize

                                                      158KB

                                                      MD5

                                                      1922740d2479c7d0cd6fb57c3d739543

                                                      SHA1

                                                      877a807a396156be1d0c2782391cabc29ea15760

                                                      SHA256

                                                      20443f66e184311fd412158cb162e36b0172332cd6d401cec9ee5fe17df75e58

                                                      SHA512

                                                      d624bad0fcd8afc190a5de241da341a3f39d6aaa0e5eacdf8b14e8e74515b688f06e2cdc75da0634880ea98238a1d26cd2d2bfaedb6d92067dace99d0963975c

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                      Filesize

                                                      157KB

                                                      MD5

                                                      63f830bc220b8af1381f2210fdf6a258

                                                      SHA1

                                                      5651a89b75ba320ba3133826c9fca7f5baa0fbbb

                                                      SHA256

                                                      a82eec1added638aa86d4e66f3b3789e8f7e40a15d0be3b01fbe50ca85b99f9c

                                                      SHA512

                                                      ae2884f99833f11a5ce73843bb675de13c3dd362602352b3e8d3f6815bc03fb9a681f0adfeb677fa575bf3395734fc9e07ea05896e8698f875f7a6b01276a31c

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                      Filesize

                                                      51KB

                                                      MD5

                                                      3180c705182447f4bcc7ce8e2820b25d

                                                      SHA1

                                                      ad6486557819a33d3f29b18d92b43b11707aae6e

                                                      SHA256

                                                      5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                      SHA512

                                                      228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                      Filesize

                                                      12B

                                                      MD5

                                                      eb053699fc80499a7185f6d5f7d55bfe

                                                      SHA1

                                                      9700472d22b1995c320507917fa35088ae4e5f05

                                                      SHA256

                                                      bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                      SHA512

                                                      d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                      Filesize

                                                      173KB

                                                      MD5

                                                      fd9df72620bca7c4d48bc105c89dffd2

                                                      SHA1

                                                      2e537e504704670b52ce775943f14bfbaf175c1b

                                                      SHA256

                                                      847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                      SHA512

                                                      47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                      Filesize

                                                      546B

                                                      MD5

                                                      158fb7d9323c6ce69d4fce11486a40a1

                                                      SHA1

                                                      29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                      SHA256

                                                      5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                      SHA512

                                                      7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                      Filesize

                                                      688KB

                                                      MD5

                                                      3ef8d12aa1d48dec3ac19a0ceabd4fd8

                                                      SHA1

                                                      c81b7229a9bd55185a0edccb7e6df3b8e25791cf

                                                      SHA256

                                                      18c1ddbdbf47370cc85fa2cf7ba043711ab3eadbd8da367638686dfd6b735c85

                                                      SHA512

                                                      0ff2e8dbfef7164b22f9ae9865e83154096971c3f0b236d988ab947e803c1ed03d86529ab80d2be9ff33af305d34c9b30082f8c26e575f0979ca9287b415f9f9

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                      Filesize

                                                      27KB

                                                      MD5

                                                      797c9554ec56fd72ebb3f6f6bef67fb5

                                                      SHA1

                                                      40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                      SHA256

                                                      7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                      SHA512

                                                      4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                      Filesize

                                                      214KB

                                                      MD5

                                                      01807774f043028ec29982a62fa75941

                                                      SHA1

                                                      afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                      SHA256

                                                      9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                      SHA512

                                                      33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                      Filesize

                                                      37KB

                                                      MD5

                                                      efb4712c8713cb05eb7fe7d87a83a55a

                                                      SHA1

                                                      c94d106bba77aecf88540807da89349b50ea5ae7

                                                      SHA256

                                                      30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                      SHA512

                                                      3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                      Filesize

                                                      3.4MB

                                                      MD5

                                                      e010d1f614b1a830482d3df4ba056f24

                                                      SHA1

                                                      5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                      SHA256

                                                      98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                      SHA512

                                                      727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                      Filesize

                                                      389KB

                                                      MD5

                                                      5e3252e0248b484e76fcdbf8b42a645d

                                                      SHA1

                                                      11ae92fd16ac87f6ab755911e85e263253c16516

                                                      SHA256

                                                      01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                      SHA512

                                                      540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      e2c2b5d88a3aa82787ed7a03a5d67480

                                                      SHA1

                                                      8dad7efdaa91b627ca89df84e2b8153cf5dbf4bc

                                                      SHA256

                                                      940d705cc0ec57b474a708e94404c2664e430615acbd4895b3dc1f5c6bb44544

                                                      SHA512

                                                      6bf3cc791883218568c9faed10d1d8fb00105fea573c2f77b853bfbba63570434c60c83c2b8a53a75399219c597582493c981d72fd367a10cd64d2c8a58d4379

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                      Filesize

                                                      196KB

                                                      MD5

                                                      680bac4393da4dafe0100d9483d3b6e4

                                                      SHA1

                                                      ed211ef61232c5aacee7ca168659f02f9d4f4e53

                                                      SHA256

                                                      c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                                                      SHA512

                                                      5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                      Filesize

                                                      56KB

                                                      MD5

                                                      0f33a7acb33960d1306ba418405d8264

                                                      SHA1

                                                      bc24c37727b00d514446c8b5fb6c04f36254a067

                                                      SHA256

                                                      a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                      SHA512

                                                      72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      9d1528a2ce17522f6de064ae2c2b608e

                                                      SHA1

                                                      2f1ce8b589e57ab300bb93dde176689689f75114

                                                      SHA256

                                                      11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                      SHA512

                                                      a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.4340.update
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      14ffcf07375b3952bd3f2fe52bb63c14

                                                      SHA1

                                                      ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                      SHA256

                                                      6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                      SHA512

                                                      14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      e929971bc6030677b1f7e30d5bf749bf

                                                      SHA1

                                                      a838844ac82dbc1b3a4ed463b029cf4796d9d5bb

                                                      SHA256

                                                      fe8ac6b7d1f7bccda6b0c6e62bc085f4cf1549cd01776a53e53f59d8a33d5be6

                                                      SHA512

                                                      3ea524fb51fc73c88a57123a80b458bba4425920c02d067da8fb4121d31a7257382af841e48c3c1e238bc11d70bfaa8e33783b4fcaf648b1cef44eba0bbcdb36

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                      Filesize

                                                      2B

                                                      MD5

                                                      81051bcc2cf1bedf378224b0a93e2877

                                                      SHA1

                                                      ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                      SHA256

                                                      7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                      SHA512

                                                      1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                      Filesize

                                                      54KB

                                                      MD5

                                                      77c613ffadf1f4b2f50d31eeec83af30

                                                      SHA1

                                                      76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                      SHA256

                                                      2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                      SHA512

                                                      29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                      Filesize

                                                      334KB

                                                      MD5

                                                      2e2e6e6702fa92da8c08fa85617fa861

                                                      SHA1

                                                      bee96d85e39faa0d6f60fc797e0c4f0e9c01ed67

                                                      SHA256

                                                      565bbd4ed69c929cb00ce6552633382bfe46248b6e9db3293b9c031875c02b35

                                                      SHA512

                                                      35eaf569f94c69749308d30722589331ea1957f3a11f440b1eccc4aa32284681162128b2febef76c75181b49e5e57d780685a22e14e1900ffc7add3f83ac075e

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                      Filesize

                                                      71KB

                                                      MD5

                                                      5129e29d4d9a8ed94e04099622316b37

                                                      SHA1

                                                      be1c537ad5fc51bd28bd3ea23e16cbfbdaf01dfd

                                                      SHA256

                                                      17c1a413747e1dbf203f1824e45ddc0dc7afe4c529bca88cdb670f019d95db11

                                                      SHA512

                                                      7b8a1d79c069cdcbebd57255d11d96e13e291df8b99c15d6c969a66ef8af8639fac92e22b233b4b6f8b33a9c52ba2936fe59ecee2acf78c571f4920ea075e4bb

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                      Filesize

                                                      50KB

                                                      MD5

                                                      254dcbee3213189461b66e962ce8cc05

                                                      SHA1

                                                      cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                                                      SHA256

                                                      e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                                                      SHA512

                                                      7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                      Filesize

                                                      32KB

                                                      MD5

                                                      db1db66ebd9b15b7dcd55374ea56ee5e

                                                      SHA1

                                                      c22897eb20900a66cf62023c37d6a7d1192aec3d

                                                      SHA256

                                                      0263a627bbea55a66deecd7a43f8537bb68b5f95bb3d4269d3e594bd1d851e64

                                                      SHA512

                                                      b56b2143a60e6153e7fb752029c72d78547d5253f32ecbd0dda5a8acc5c3859292e860162b11a041a37b4f618f4425484b4e2385d7e2c621c8cbced073e3a67e

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                      Filesize

                                                      56KB

                                                      MD5

                                                      e9794f785780945d2dde78520b9bb59f

                                                      SHA1

                                                      293cae66cedbc7385cd49819587d3d5a61629422

                                                      SHA256

                                                      0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                                                      SHA512

                                                      1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                      Filesize

                                                      588KB

                                                      MD5

                                                      17d74c03b6bcbcd88b46fcc58fc79a0d

                                                      SHA1

                                                      bc0316e11c119806907c058d62513eb8ce32288c

                                                      SHA256

                                                      13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                      SHA512

                                                      f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                      Filesize

                                                      218B

                                                      MD5

                                                      224d5ae1b3e146e5f17118230d87a177

                                                      SHA1

                                                      25b936325e6e81d736fc8f6d94f092b8a4665db3

                                                      SHA256

                                                      9c7d9a762fb354fdeb72a3f678d0e7d8629a54082269a5b6655d38ea8e3f4191

                                                      SHA512

                                                      4b8fe000ad6d97492186d8fce71e6593330c303a8741fdac02b0ac8f54993b04449597cf28358c32dc1abc4684800028bbccfd5905736b7c021479f5c4fc69c4

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      1ef7574bc4d8b6034935d99ad884f15b

                                                      SHA1

                                                      110709ab33f893737f4b0567f9495ac60c37667c

                                                      SHA256

                                                      0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                      SHA512

                                                      947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                      Filesize

                                                      10KB

                                                      MD5

                                                      f512536173e386121b3ebd22aac41a4e

                                                      SHA1

                                                      74ae133215345beaebb7a95f969f34a40dda922a

                                                      SHA256

                                                      a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                      SHA512

                                                      1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                      Filesize

                                                      76KB

                                                      MD5

                                                      b40fe65431b18a52e6452279b88954af

                                                      SHA1

                                                      c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                      SHA256

                                                      800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                      SHA512

                                                      e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                      Filesize

                                                      80KB

                                                      MD5

                                                      3904d0698962e09da946046020cbcb17

                                                      SHA1

                                                      edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                      SHA256

                                                      a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                      SHA512

                                                      c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                      Filesize

                                                      96KB

                                                      MD5

                                                      fc7976759dcb6c0cb12410537130579e

                                                      SHA1

                                                      b8d0eb4fd3475dbde30ca49f29eac4f79deabd60

                                                      SHA256

                                                      1858f785d3c0249bd0be3b53d75e919b2d8775030f2e2d364a866f918c1e1545

                                                      SHA512

                                                      c5ae00e43fc6afeae8dba92d8c0ffeb9a03bde0c86667cf5a606d4439ebe050f90ab9f285bdda248d4c3f0fd1821ac8a326a15ea7c497ab760479dde9588cbd3

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      433B

                                                      MD5

                                                      cf5f69533151675ab4f248fbc8cdedeb

                                                      SHA1

                                                      eb736e17118ac79e341b49eb29ea04433e65e66f

                                                      SHA256

                                                      e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                      SHA512

                                                      e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      717B

                                                      MD5

                                                      ef0a07aec4367a64c16c581da2657aa9

                                                      SHA1

                                                      13011a5abcbadb3424fb6ecee560665556bb1d24

                                                      SHA256

                                                      f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                      SHA512

                                                      35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                      Filesize

                                                      7KB

                                                      MD5

                                                      362ce475f5d1e84641bad999c16727a0

                                                      SHA1

                                                      6b613c73acb58d259c6379bd820cca6f785cc812

                                                      SHA256

                                                      1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                      SHA512

                                                      7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                      Filesize

                                                      1.9MB

                                                      MD5

                                                      dc34fb149320b8344ef62548a634f290

                                                      SHA1

                                                      d5008caa155335ec563e47f00ab83c1b87ac732a

                                                      SHA256

                                                      5caeaa7a9f680c9e332d445b2a0b1679e028fe92ad3ed713c51a24acfc1eaed4

                                                      SHA512

                                                      97ccdbbff6b6ea6b644cabc285c0e6147c43f9b3fa451a8b7851fd0664dc9504fffe3223205f11ce2b3d6ba816891393a86aeecf86bd6daf06c889421a91192b

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      9a9b1fd85b5f1dcd568a521399a0d057

                                                      SHA1

                                                      34ed149b290a3a94260d889ba50cb286f1795fa6

                                                      SHA256

                                                      88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                      SHA512

                                                      7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                      Filesize

                                                      375KB

                                                      MD5

                                                      4a09a87d2004dac4b00687e9c9f15036

                                                      SHA1

                                                      c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                                                      SHA256

                                                      2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                                                      SHA512

                                                      f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                      Filesize

                                                      321KB

                                                      MD5

                                                      d3901e62166e9c42864fe3062cb4d8d5

                                                      SHA1

                                                      c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                      SHA256

                                                      dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                      SHA512

                                                      ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                      Filesize

                                                      814KB

                                                      MD5

                                                      9b1f97a41bfb95f148868b49460d9d04

                                                      SHA1

                                                      768031d5e877e347a249dfdeab7c725df941324b

                                                      SHA256

                                                      09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                      SHA512

                                                      9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                      Filesize

                                                      1.2MB

                                                      MD5

                                                      e74d2a16da1ddb7f9c54f72b8a25897c

                                                      SHA1

                                                      32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                      SHA256

                                                      a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                      SHA512

                                                      52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                      Filesize

                                                      11B

                                                      MD5

                                                      5eda46a55c61b07029e7202f8cf1781c

                                                      SHA1

                                                      862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                      SHA256

                                                      12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                      SHA512

                                                      4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                      Filesize

                                                      12B

                                                      MD5

                                                      5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                      SHA1

                                                      93012724e6cc0a298838aede678806e6c0c6517d

                                                      SHA256

                                                      a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                      SHA512

                                                      890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      6f7713c1825d978d975bce1ea3b1499d

                                                      SHA1

                                                      91a555c9be9b5950d7b9962f00d70538ab126ed2

                                                      SHA256

                                                      e73f8d5cfcf72e7699bdbf2cc3dcfc2d0c49206702daa13cb9d8f6da222ed8e3

                                                      SHA512

                                                      d3837be5aa09b211fbdd53ab35525c5a1a2ec3f87417024fb0798abdee2a1789b1e6060d7b325b484482c068f0fdc287339980765d5e1fff17a6cb3a348fb3d3

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      d5f444c54928b619a482e3661d4939fe

                                                      SHA1

                                                      2a1cf5c377a30d969e168b2a099984a7c5816081

                                                      SHA256

                                                      9f5a11f07de61fa65ed5274bd62cc62c8eeb6e90ad1f9177319fca587d2f9203

                                                      SHA512

                                                      75aae4dcaa410563cdfede5baf277e91ba348a1ee0b261ed2a87e963a1fd60ff87fde8bf4ed70770a9398a49a2ac54a3e21ebaf1b6b9ab071eb77cfd50d544c3

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      ea258f6e342142f680648e16d765dca2

                                                      SHA1

                                                      cabc826fe1fe8956013e0a42464609bcb1e0fcf4

                                                      SHA256

                                                      6eeb74d8a799e21bdd34568584105ef862dd6c15a28cc6fb3e3a2a23d218632f

                                                      SHA512

                                                      392a20ca5455f7c93f0531ee23d2b4e76c8f1f56d107f936c4bb42ff4e7d193e9eb3b582ad6080df121ec04538b4cd0667691ea16960a73c604ed20da01d9715

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                      Filesize

                                                      2.8MB

                                                      MD5

                                                      a7bf0da8e308248aefd69586e1f8a312

                                                      SHA1

                                                      f1df1b8f00087260c9c7c2ba46cb98903f98bf73

                                                      SHA256

                                                      b8c4a5ec9357ace0e98bf2e7550d691af280a387fc9636260ea6bc2c2b5b6ba6

                                                      SHA512

                                                      e9edd7b668136e3a16b070c13bedb5465ab1cee02cc84f84f40a80aca12cd3ce2a781724f53fecae891a390fc257bec727fb6e4756f644597785ff21107071fd

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                      Filesize

                                                      2.9MB

                                                      MD5

                                                      7805ea1a8dd15cac328b826efe38c2a9

                                                      SHA1

                                                      66ff8eafb2424717c4394bae28a8683db1244527

                                                      SHA256

                                                      7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                                                      SHA512

                                                      17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      6c6f85e896655a6eb726482f04c49086

                                                      SHA1

                                                      2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                      SHA256

                                                      e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                      SHA512

                                                      b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                      Filesize

                                                      541B

                                                      MD5

                                                      d0efb0a6d260dbe5d8c91d94b77d7acd

                                                      SHA1

                                                      e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                      SHA256

                                                      7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                      SHA512

                                                      a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                      Filesize

                                                      12B

                                                      MD5

                                                      213da2b23ec7ec5259829958b2cf42be

                                                      SHA1

                                                      5b7dfb867ed116395f0c8d8299d7357e1f5355fc

                                                      SHA256

                                                      eb70db8191a629c3c2a53d07ee68ce9e4a906defd701b4a08cab8a410df29457

                                                      SHA512

                                                      2b5500f9062c8c44ee4bb2ba81f4b0f948e07c1182525fbdc72a1ab6e304055e04100cce41dc3e68a7cec3557ed39a755eb1ef38e3db6cf56102f5a20e6601d2

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                      Filesize

                                                      646KB

                                                      MD5

                                                      0e6af651f8be91dc9dde2faab59c9a77

                                                      SHA1

                                                      f199693bb55864f8497227c1c14244ff3e6e423e

                                                      SHA256

                                                      895f2593cf3f365046f33e9cf5ebcb2a17e7af1c592decc82bfe8ff5d5653a20

                                                      SHA512

                                                      fd770888310dd2e58124eae49bdc6e715fde9b100010ef224e10f6a757629c2c55d12c0e4cede3f8cf8e89d1267e4820c9bf82df5f6263675ecc3596895da4af

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                      Filesize

                                                      3.1MB

                                                      MD5

                                                      ff671b6085ba35e1bbebd5d2389ab7d6

                                                      SHA1

                                                      d7719a66e303c4e854faba873b781e0084f36998

                                                      SHA256

                                                      4f2a43098f6eff50a03fde9e134a4c8b7df6fe7e9a9c6913afeefe0deeb1463e

                                                      SHA512

                                                      f5a63eeb6a239d7be9935ceb1240aae7c9f3a8d5740d665b5fde6f28a7667feb345f88bc440ebe7d6a0512b448f4e3772a49823bc6ad8ba7372e0a31b5f9f200

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                      Filesize

                                                      570KB

                                                      MD5

                                                      b50834694383960830cf48d9836e1108

                                                      SHA1

                                                      adc80813181b98a8296befa2960a55f939f3bfee

                                                      SHA256

                                                      370a259808052366888284b0cc4c91ff8f23e8008003959b8d0efb1adbf00cd6

                                                      SHA512

                                                      f87be933e87275b000be031aa5df7536dfd5fe9b99a607ce0904f206e074d3a0687a00654b9b78edaa2fccf3d30526e0ee5bd7dcba4a5daafd6fc60eeaaa15c5

                                                      Download Submit

                                                    • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\1ebdc3c6f171b55324212a0a91c7df95
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      b2e89027a140a89b6e3eb4e504e93d96

                                                      SHA1

                                                      f3b1b34874b73ae3032decb97ef96a53a654228f

                                                      SHA256

                                                      5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                      SHA512

                                                      93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                      Download Submit

                                                    • C:\ProgramData\chocolatey\config\chocolatey.config
                                                      Filesize

                                                      809B

                                                      MD5

                                                      8b6737800745d3b99886d013b3392ac3

                                                      SHA1

                                                      bb94da3f294922d9e8d31879f2d145586a182e19

                                                      SHA256

                                                      86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                      SHA512

                                                      654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                      Download Submit

                                                    • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                      Filesize

                                                      12KB

                                                      MD5

                                                      a1e377796688ba84c63d43edede8f5be

                                                      SHA1

                                                      67b7e75237c85264478a85786b72e4c544db7589

                                                      SHA256

                                                      71355e546df23415104408a89aa7d3b7a0e55b16bdcb5964c6e41cbf9da8b7d6

                                                      SHA512

                                                      8b135a0bf0eea3578198cf87b36b230fb1ef717febb89819c4efb71b8a83cfac3908c7896559f57d8f504a85a4a565ae310f5643243ce4d0dec92ffdcc830165

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                      Filesize

                                                      471B

                                                      MD5

                                                      b6102b47f3d2450f02c1167e5b337e9b

                                                      SHA1

                                                      91a6e5d7b3540556c971bcd6cdf52abd2cffcbfe

                                                      SHA256

                                                      e0c2d57c8661d444666ae009725ee84cd33a29ac48738277ea37bfd56b3cf8c4

                                                      SHA512

                                                      62bb67b325b56c41544956928ef0991262df019a470fc5792ba5abb7096e419f7ea3c8326560ffbe2b50ed0612fbc968fdf7564793a4d550b2465b799cbfcedf

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      727B

                                                      MD5

                                                      a433d0bd40ae75fbd372efe3fd3e2bc6

                                                      SHA1

                                                      137005873f5a1d269a7047adbcd08f5d204a323b

                                                      SHA256

                                                      83599ee2c90c3ef5da0f1d87bb6155bdcd2e70b97ad2163e4247f74f0925e1ec

                                                      SHA512

                                                      dca032c59d56db32821d19d913cb7519fbc0545bdc5b19cc6ca9eebf2faa8dca9739d4190b269c34438bca85879a271108f0641c2b653df37f08bfb9224150cb

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      727B

                                                      MD5

                                                      1dc1121e24814ab2e9102c631f6368e5

                                                      SHA1

                                                      55f7935319102e893d0df7ba28c35343456300ee

                                                      SHA256

                                                      8ed09687565336351ef88085dcf6cfc841af12a63433ecc12c2f13a9557c3c59

                                                      SHA512

                                                      132158f8f2bdf5d66cd4f3fed37405027d4233c79a365027e5d8d0ea20c5d23805bd298358df371b625486282867ba93a3ff5945dddf3ae8d91dd2630e477df4

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                      Filesize

                                                      400B

                                                      MD5

                                                      8e16a45f77af21d3b1bbe255a191e228

                                                      SHA1

                                                      d871e5396fa5067a508e85f61d7115a40fa9e85f

                                                      SHA256

                                                      2ab205933f9b115ce70376a725f105764966d490573770e4d9498dbb3e52696e

                                                      SHA512

                                                      4b104e72b87ee1dae2fd4b634f6130750b624e75cf4da5b722f0c1e7cb8f305d0849adfda2bd7d471cb955cc1d57b70b2a10076858328bd7c4c76d1b6dca3701

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      404B

                                                      MD5

                                                      1868d39bc6429f1b6647a741fba49d54

                                                      SHA1

                                                      f07166bd0f1b8f20a755b45fd9273fec1d8445a9

                                                      SHA256

                                                      7f9ea63f3375f823cc15b425a16c5f664d54983d0c21caa5ecf3dbf027a394a3

                                                      SHA512

                                                      f3aafe189e89209cd496cfd63f3ae896e119781f08bf84e4102354b84e43649f2d079f541a252c014c86621a2df6ff52d1a7d407a7531d8e7fd5584016b22f93

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      412B

                                                      MD5

                                                      7dd57faa7a7b62f561146a3324ffc3dc

                                                      SHA1

                                                      32fcfe4549c5439901c32609b9cea6775f979467

                                                      SHA256

                                                      9072bf63a8a0a4bd1235351d04de27ad8ae9978d515f0aafc495d0e9a93c8fdc

                                                      SHA512

                                                      13ce2ee9126dc48a975cb0b2f9ed7f8cff4fcbb926a10f9079c27f807efb381a7052f00f8d5fd7e38ce864dd06326d23732ec06558acccfcc3ee0608ca82f6d7

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                      Filesize

                                                      651B

                                                      MD5

                                                      9bbfe11735bac43a2ed1be18d0655fe2

                                                      SHA1

                                                      61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                      SHA256

                                                      549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                      SHA512

                                                      a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI47E0.tmp
                                                      Filesize

                                                      4.5MB

                                                      MD5

                                                      08211c29e0d617a579ffa2c41bde1317

                                                      SHA1

                                                      4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                      SHA256

                                                      3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                      SHA512

                                                      d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI9CE9.tmp-\System.Management.dll
                                                      Filesize

                                                      60KB

                                                      MD5

                                                      878e361c41c05c0519bfc72c7d6e141c

                                                      SHA1

                                                      432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                      SHA256

                                                      24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                      SHA512

                                                      59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIE203.tmp
                                                      Filesize

                                                      509KB

                                                      MD5

                                                      88d29734f37bdcffd202eafcdd082f9d

                                                      SHA1

                                                      823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                      SHA256

                                                      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                      SHA512

                                                      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIE203.tmp-\AlphaControlAgentInstallation.dll
                                                      Filesize

                                                      25KB

                                                      MD5

                                                      aa1b9c5c685173fad2dabebeb3171f01

                                                      SHA1

                                                      ed756b1760e563ce888276ff248c734b7dd851fb

                                                      SHA256

                                                      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                      SHA512

                                                      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIE203.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      1a5caea6734fdd07caa514c3f3fb75da

                                                      SHA1

                                                      f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                      SHA256

                                                      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                      SHA512

                                                      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIE734.tmp-\CustomAction.config
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      bc17e956cde8dd5425f2b2a68ed919f8

                                                      SHA1

                                                      5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                      SHA256

                                                      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                      SHA512

                                                      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIE734.tmp-\Newtonsoft.Json.dll
                                                      Filesize

                                                      695KB

                                                      MD5

                                                      715a1fbee4665e99e859eda667fe8034

                                                      SHA1

                                                      e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                      SHA256

                                                      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                      SHA512

                                                      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIEDA0.tmp
                                                      Filesize

                                                      211KB

                                                      MD5

                                                      a3ae5d86ecf38db9427359ea37a5f646

                                                      SHA1

                                                      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                      SHA256

                                                      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                      SHA512

                                                      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                      Download Submit

                                                    • C:\Windows\Installer\e57e177.msi
                                                      Filesize

                                                      2.9MB

                                                      MD5

                                                      67208cd63d07c6f274d276f04caa1578

                                                      SHA1

                                                      3a8b02d2aed87fe63daf529bb61298010ab1f816

                                                      SHA256

                                                      fa798e522d0e8b0a795b5083fdb5be379b27b403678f616660172acfe4ecb8ac

                                                      SHA512

                                                      95baa0b0b1247a05d06d894e5ab0475a3b83cdffe48fe8c8f96c08acb94437e4f007ddc5c3abe54c5414ab3c0375a0202f7fb50aa6156ec8c72012acce367f82

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{f8b43d4a-4ca9-cf43-8c07-95ee4aac413b}\lci_proxywddm.cat
                                                      Filesize

                                                      12KB

                                                      MD5

                                                      8e16d54f986dbe98812fd5ec04d434e8

                                                      SHA1

                                                      8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                      SHA256

                                                      7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                      SHA512

                                                      e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{f8b43d4a-4ca9-cf43-8c07-95ee4aac413b}\lci_proxywddm.inf
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      0315a579f5afe989154cb7c6a6376b05

                                                      SHA1

                                                      e352ff670358cf71e0194918dfe47981e9ccbb88

                                                      SHA256

                                                      d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                      SHA512

                                                      c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{f8b43d4a-4ca9-cf43-8c07-95ee4aac413b}\x64\lci_proxyumd.dll
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      4dc11547a5fc28ca8f6965fa21573481

                                                      SHA1

                                                      d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                      SHA256

                                                      e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                      SHA512

                                                      bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{f8b43d4a-4ca9-cf43-8c07-95ee4aac413b}\x64\lci_proxyumd32.dll
                                                      Filesize

                                                      135KB

                                                      MD5

                                                      67ae7b2c36c9c70086b9d41b4515b0a8

                                                      SHA1

                                                      ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                      SHA256

                                                      79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                      SHA512

                                                      4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{f8b43d4a-4ca9-cf43-8c07-95ee4aac413b}\x64\lci_proxywddm.sys
                                                      Filesize

                                                      119KB

                                                      MD5

                                                      b9b0e9b4d93b18b99ece31a819d71d00

                                                      SHA1

                                                      2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                      SHA256

                                                      0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                      SHA512

                                                      465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{fd8a59c4-b68e-9a4b-856e-1dbca36490c9}\lci_iddcx.cat
                                                      Filesize

                                                      10KB

                                                      MD5

                                                      62458e58313475c9a3642a392363e359

                                                      SHA1

                                                      e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                      SHA256

                                                      85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                      SHA512

                                                      49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{fd8a59c4-b68e-9a4b-856e-1dbca36490c9}\lci_iddcx.inf
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      1cec22ca85e1b5a8615774fca59a420b

                                                      SHA1

                                                      049a651751ef38321a1088af6a47c4380f9293fc

                                                      SHA256

                                                      60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                      SHA512

                                                      0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{fd8a59c4-b68e-9a4b-856e-1dbca36490c9}\x64\lci_iddcx.dll
                                                      Filesize

                                                      52KB

                                                      MD5

                                                      01e8bc64139d6b74467330b11331858d

                                                      SHA1

                                                      b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                      SHA256

                                                      148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                      SHA512

                                                      4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                      Download Submit

                                                    • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-20-20-52.dat
                                                      Filesize

                                                      602B

                                                      MD5

                                                      14c94459141d456170dd93eb1f14d66d

                                                      SHA1

                                                      8c710761f79b8154d3dbd3deda95d310eff69154

                                                      SHA256

                                                      7d447f2f2f9454feda894cab79a73faeb8a9333412c411263f00020697f2aec1

                                                      SHA512

                                                      468dd52b990d92f4dd2f889dc598d2856614ef23853df9a34868a0e58a784b8dc64763c733f5e83e3dd26229d86da227091124b9244eab1aaebc312882dea7a9

                                                      Download Submit

                                                    • C:\Windows\Temp\InstallUtil.log
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      9a5469449dfed5d80613be7ce2e39aef

                                                      SHA1

                                                      82b5cb8d01abc935f8d0f34255401d0813fb009a

                                                      SHA256

                                                      6fc8f58988f88744888c6cf1dc339330de7c56434292ba5d296af0596a94b41e

                                                      SHA512

                                                      39162fe9e7218c90389a0268bfe938cac1ca950f0b085fdc6a1411c2f0a7bdcd11afe0ac1f8eb54c9730c78e956d2c2603380cfd0dcd1521b01cb339137084ec

                                                      Download Submit

                                                    • C:\Windows\Temp\InstallUtil.log
                                                      Filesize

                                                      708B

                                                      MD5

                                                      695706f43b498b7f91e27b08d58219ab

                                                      SHA1

                                                      00f21370d64ae90406c209423e0f6df08bab5381

                                                      SHA256

                                                      9c414ba677ed6491d257f054cae3544e4d3214fd1a0e2d6d356906065f75350b

                                                      SHA512

                                                      ec13c59cb11c75a6797a04a1261291b6485374aa65b6a85a13ae4691f5fabd2238d52105abc40f4e4f0ef40ce1b81c647e4714cdc3e2466ea9115fe66c076593

                                                      Download Submit

                                                    • C:\Windows\Temp\InstallUtil.log
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      0a86c80cadfd9898b336f059059d4a2c

                                                      SHA1

                                                      32336b17c094401278c78df372ff3caf81f345e5

                                                      SHA256

                                                      f43d475de728fad7ea31a5b28951c6ee5c41af9e9b54e67517749077ca52b103

                                                      SHA512

                                                      5d154223ebf5f16cea20e1fa64c521741828832a4ae2d22f4b922b86eeab00a15f21fcbea070f32da618a9b66423bcd6e9be9c1bb3f049fa34f13e387bfedd9e

                                                      Download Submit

                                                    • C:\Windows\Temp\Tmp9B9F.tmp
                                                      Filesize

                                                      3KB

                                                      MD5

                                                      560af444a6a7faa0b0ca94dc16ca2a58

                                                      SHA1

                                                      df31453fafde354870a0a9a8ca50b18e284c32e4

                                                      SHA256

                                                      94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429

                                                      SHA512

                                                      7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack.log
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      d2fe1945010913f33664615d81425ff3

                                                      SHA1

                                                      70b9e87f56558bcc7ad87c70faba1675f83dd876

                                                      SHA256

                                                      3afeb8bb39d073af85a830c7f8526c82d5590d407bb1611997fa333bca97d7e9

                                                      SHA512

                                                      38640c1d4955cf872460e27c7ab5d1467878bf84a7389eae6f01124464de27ad4c81da5f83e3891388f87e947ef75eda237fa49ca9851e4ed74d09d3a78e9436

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                      Filesize

                                                      3.2MB

                                                      MD5

                                                      2c18826adf72365827f780b2a1d5ea75

                                                      SHA1

                                                      a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                      SHA256

                                                      ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                      SHA512

                                                      474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                      Download Submit

                                                    • C:\Windows\Temp\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\IsConfig.ini
                                                      Filesize

                                                      571B

                                                      MD5

                                                      d239b8964e37974225ad69d78a0a8275

                                                      SHA1

                                                      cf208e98a6f11d1807cd84ca61504ad783471679

                                                      SHA256

                                                      0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                      SHA512

                                                      88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                      Download Submit

                                                    • C:\Windows\Temp\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\String1033.txt
                                                      Filesize

                                                      182KB

                                                      MD5

                                                      99bbffd900115fe8672c73fb1a48a604

                                                      SHA1

                                                      8f587395fa6b954affef337c70781ce00913950e

                                                      SHA256

                                                      57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                      SHA512

                                                      d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                      Download Submit

                                                    • C:\Windows\Temp\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\_is3D92.exe
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      7a1c100df8065815dc34c05abc0c13de

                                                      SHA1

                                                      3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                      SHA256

                                                      e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                      SHA512

                                                      bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                      Download Submit

                                                    • C:\Windows\Temp\{67B3B53F-DC19-4B5F-AF9F-59BF6E6840EE}\setup.inx
                                                      Filesize

                                                      345KB

                                                      MD5

                                                      0376dd5b7e37985ea50e693dc212094c

                                                      SHA1

                                                      02859394164c33924907b85ab0aaddc628c31bf1

                                                      SHA256

                                                      c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                      SHA512

                                                      69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                      Download Submit

                                                    • C:\Windows\Temp\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\ISRT.dll
                                                      Filesize

                                                      427KB

                                                      MD5

                                                      85315ad538fa5af8162f1cd2fce1c99d

                                                      SHA1

                                                      31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                      SHA256

                                                      70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                      SHA512

                                                      877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                      Download Submit

                                                    • C:\Windows\Temp\{F2DE1AEA-5FDB-4A01-B31E-6B325CFCAA32}\_isres_0x0409.dll
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      befe2ef369d12f83c72c5f2f7069dd87

                                                      SHA1

                                                      b89c7f6da1241ed98015dc347e70322832bcbe50

                                                      SHA256

                                                      9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                      SHA512

                                                      760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                      Download Submit

                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      404B

                                                      MD5

                                                      812f88fa4c7a397c60c88090f7d14a5a

                                                      SHA1

                                                      436b2c9d6c0768f95b8d7965b540ce0c4c83e770

                                                      SHA256

                                                      291759ca74358fa22731e5aa1f1f42938616386549277e00274c131f9bb0dabb

                                                      SHA512

                                                      6515e67cd584f78f4d9a531b8684262f53c5f35e5e09ce7c7cdee35e2fd8aeaade431f7be02c82986ffdd70616ac9179fda01091977eb20de537d4ed23af2e59

                                                      Download Submit

                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      412B

                                                      MD5

                                                      14a4789c729c619f3d32d975a25128ad

                                                      SHA1

                                                      191053064c2b99ecc6aff3786dc6ea97409f79a9

                                                      SHA256

                                                      fab57c5abe3319d472fe84f48cce3530199f417afaf4f055667d3562e1e76fa9

                                                      SHA512

                                                      bcbc02e2edca42a3cb79b10a2da8c24cfb8118f93d7e850ee37d5a29ad14de0d4a97083e4e036f9341b67b8562673c3aea3331e255bddec4f4ae933a058b3567

                                                      Download Submit

                                                    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                      Filesize

                                                      24.1MB

                                                      MD5

                                                      5bc0d3bbe35a2164167a8cf1f3dd0b71

                                                      SHA1

                                                      401e7447754873bef5820a1584a6dd839dfdd541

                                                      SHA256

                                                      429d3df55eb6501e9bfd03804e33536d8ca9a14410236ff4f53125b3a413a36c

                                                      SHA512

                                                      3ba3a7ef11bc8763905f8b55927e751a463150b091d633f9e56133c8ffcff7875d367a896123c29535fc3dba6334a23dbb45cd3d75eb43a95802344e8a8fec8b

                                                      Download Submit

                                                    • \??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1fd70e52-bc36-4162-a387-030247059f8b}_OnDiskSnapshotProp
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      b73d8319d16ca0145b1a4b31f463b84c

                                                      SHA1

                                                      7b2367abf359192f55b82d9b7e3d7f9f57f15008

                                                      SHA256

                                                      7231383505985674424d3d62125d87e661a267f681e656373657d1e487fbe8fe

                                                      SHA512

                                                      3f2c5e5b5d6ea1c015e341ee2179a10f91634134d49201e5b0b8d67bb2b79a389ef59bb307f0fcf9a4d833f9915d2f8c946a8a74e2a8073e5b1b02dbbb5a6031

                                                      Download Submit

                                                    • memory/224-277-0x000001A4C8600000-0x000001A4C86B0000-memory.dmp

                                                      Filesize

                                                      704KB

                                                      Download

                                                    • memory/224-274-0x000001A4C7B90000-0x000001A4C7BC0000-memory.dmp

                                                      Filesize

                                                      192KB

                                                      Download

                                                    • memory/224-278-0x000001A4C8510000-0x000001A4C852C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/944-1381-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/944-1217-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/944-1218-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/944-1139-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/944-1140-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/944-1380-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1204-81-0x0000000002CB0000-0x0000000002CD2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/1204-82-0x00000000051F0000-0x0000000005544000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/1204-78-0x0000000005130000-0x00000000051E2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/1596-4242-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/1596-1718-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1596-1719-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/1596-3013-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/1596-1206-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/1596-1205-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1596-4241-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1596-3012-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1848-1281-0x0000023FF7F50000-0x0000023FF8002000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/1848-1280-0x0000023FDF660000-0x0000023FDF67C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/1848-1279-0x0000023FDEE00000-0x0000023FDEE12000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/1848-1532-0x0000023FDF6F0000-0x0000023FDF744000-memory.dmp

                                                      Filesize

                                                      336KB

                                                      Download

                                                    • memory/1912-1053-0x00000000030B0000-0x0000000003277000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/1912-1089-0x00000000030C0000-0x0000000003287000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/1912-1050-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1912-1014-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1912-910-0x00000000030A0000-0x0000000003267000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/1912-907-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1912-488-0x0000000003090000-0x0000000003257000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/1912-484-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/1992-1908-0x000001D09A2B0000-0x000001D09A2C2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/1992-1909-0x000001D09AB50000-0x000001D09AB9A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/1992-1914-0x000001D09A830000-0x000001D09A84C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/2004-302-0x000002A03B800000-0x000002A03B81C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/2004-301-0x000002A0544A0000-0x000002A054552000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2004-300-0x000002A03B320000-0x000002A03B336000-memory.dmp

                                                      Filesize

                                                      88KB

                                                      Download

                                                    • memory/2848-202-0x000001B669160000-0x000001B669212000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2848-207-0x000001B6690D0000-0x000001B6690F2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/2848-243-0x000001B6696A0000-0x000001B6696D8000-memory.dmp

                                                      Filesize

                                                      224KB

                                                      Download

                                                    • memory/2892-351-0x0000013D2FE70000-0x0000013D2FEB8000-memory.dmp

                                                      Filesize

                                                      288KB

                                                      Download

                                                    • memory/2892-362-0x0000013D302A0000-0x0000013D30308000-memory.dmp

                                                      Filesize

                                                      416KB

                                                      Download

                                                    • memory/2892-364-0x0000013D30F60000-0x0000013D30F9A000-memory.dmp

                                                      Filesize

                                                      232KB

                                                      Download

                                                    • memory/2892-365-0x0000013D30040000-0x0000013D30066000-memory.dmp

                                                      Filesize

                                                      152KB

                                                      Download

                                                    • memory/2892-361-0x0000013D30030000-0x0000013D30038000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2892-363-0x0000013D30070000-0x0000013D3009A000-memory.dmp

                                                      Filesize

                                                      168KB

                                                      Download

                                                    • memory/2892-347-0x0000013D16CB0000-0x0000013D16D14000-memory.dmp

                                                      Filesize

                                                      400KB

                                                      Download

                                                    • memory/2892-348-0x0000013D2FD80000-0x0000013D2FDCA000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/2892-349-0x0000013D17670000-0x0000013D1768C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/2892-350-0x0000013D2FE20000-0x0000013D2FE6C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                      Download

                                                    • memory/2892-357-0x0000013D30020000-0x0000013D30028000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2892-352-0x0000013D17690000-0x0000013D17698000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2892-353-0x0000013D176A0000-0x0000013D176AA000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/2892-354-0x0000013D30100000-0x0000013D301DC000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/2892-355-0x0000013D301E0000-0x0000013D30292000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2892-356-0x0000013D2FE10000-0x0000013D2FE18000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/3760-1921-0x0000013898CE0000-0x0000013898D14000-memory.dmp

                                                      Filesize

                                                      208KB

                                                      Download

                                                    • memory/3760-1925-0x00000138B1D50000-0x00000138B1D6C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/3760-1927-0x00000138B1DD0000-0x00000138B1DE8000-memory.dmp

                                                      Filesize

                                                      96KB

                                                      Download

                                                    • memory/3760-1924-0x00000138B1D80000-0x00000138B1DCA000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/3760-1929-0x00000138B1F70000-0x00000138B1FBA000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/3760-1928-0x00000138B1D40000-0x00000138B1D4A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/4340-1904-0x000001B6B5DD0000-0x000001B6B642C000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                      Download

                                                    • memory/4340-1324-0x000001B69CCB0000-0x000001B69CCC0000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/4340-1326-0x000001B69CCF0000-0x000001B69CD10000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/4340-1325-0x000001B6B55B0000-0x000001B6B5662000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/4340-1938-0x000001B6B57C0000-0x000001B6B5806000-memory.dmp

                                                      Filesize

                                                      280KB

                                                      Download

                                                    • memory/4340-1323-0x000001B69C470000-0x000001B69C482000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/4400-44-0x0000000004E70000-0x0000000004E7C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/4400-40-0x0000000004E30000-0x0000000004E5E000-memory.dmp

                                                      Filesize

                                                      184KB

                                                      Download

                                                    • memory/4532-167-0x0000028944F20000-0x0000028944F5C000-memory.dmp

                                                      Filesize

                                                      240KB

                                                      Download

                                                    • memory/4532-166-0x00000289435E0000-0x00000289435F2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/4532-162-0x0000028944E20000-0x0000028944EB8000-memory.dmp

                                                      Filesize

                                                      608KB

                                                      Download

                                                    • memory/4532-150-0x00000289431E0000-0x0000028943208000-memory.dmp

                                                      Filesize

                                                      160KB

                                                      Download

                                                    • memory/4620-112-0x00000000047F0000-0x0000000004856000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/5056-1236-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5056-1159-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5056-1917-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5056-1152-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5056-1237-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5056-1918-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5204-1851-0x0000023C62780000-0x0000023C627BA000-memory.dmp

                                                      Filesize

                                                      232KB

                                                      Download

                                                    • memory/5204-1937-0x0000023C7BA10000-0x0000023C7BAC2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5360-1935-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5360-1922-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5360-1920-0x0000000072D70000-0x0000000072E8C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5360-1936-0x00000000729A0000-0x0000000072D6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5396-1618-0x00000247B29D0000-0x00000247B29F0000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/5396-1581-0x00000247B30E0000-0x00000247B3192000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5396-1573-0x00000247B29B0000-0x00000247B29C8000-memory.dmp

                                                      Filesize

                                                      96KB

                                                      Download

                                                    • memory/5396-1566-0x00000247B25C0000-0x00000247B25CC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5416-1919-0x000001FAA38D0000-0x000001FAA391A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/5416-1916-0x000001FAA3050000-0x000001FAA305C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5416-1923-0x000001FAA34F0000-0x000001FAA350C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/5492-1574-0x000002169C760000-0x000002169C780000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/5492-1591-0x000002169C840000-0x000002169C8F2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5492-1753-0x00000216B5040000-0x00000216B50A6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/5492-1572-0x000002169BDE0000-0x000002169BDF0000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/5492-1761-0x000002169C780000-0x000002169C794000-memory.dmp

                                                      Filesize

                                                      80KB

                                                      Download

                                                    • memory/5696-1906-0x00000260DCD30000-0x00000260DCD4A000-memory.dmp

                                                      Filesize

                                                      104KB

                                                      Download

                                                    • memory/5696-1889-0x00000260DC970000-0x00000260DC97A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/5696-1915-0x00000260F5B10000-0x00000260F5BC2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5728-2828-0x0000020173890000-0x00000201739FA000-memory.dmp

                                                      Filesize

                                                      1.4MB

                                                      Download

                                                    • memory/5768-1857-0x0000017E783A0000-0x0000017E7847C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/5768-1617-0x0000017E5F060000-0x0000017E5F070000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/5768-1706-0x0000017E780A0000-0x0000017E780BC000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/5768-1926-0x0000017E78220000-0x0000017E78228000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5768-1656-0x0000017E780D0000-0x0000017E7811A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/5768-1907-0x0000017E78480000-0x0000017E78532000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download