Overview

overview

10

Static

static

10

setup_solu...c..msi

windows7-x64

10

setup_solu...c..msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 19:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_solutions_techno-redac_inc..msi

  • Size

    2.9MB

  • MD5

    1f7cc0e92a85fdd5a8bfbc2462fd39bb

  • SHA1

    d2632d95800bc3af215366d453a27fb57b4b6404

  • SHA256

    bef23b4312dc6427c7f67271ea042200a5a529c3d7210c46a0f5c5adfc49f387

  • SHA512

    22de5ca984e4c3c48ebb9f207d1845c6aa6fb80bd01082f2eed12354975e74d30435252f5c8a67cc3fa9caf12245b36bf649f806074eba9cf0977a69d496407e

  • SSDEEP

    49152:n+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:n+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoveryexecutionpersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_solutions_techno-redac_inc..msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2992
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2164
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B67F89AD29AEABD52CF67C61A8414142
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIC7C4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634000 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4392
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSICA46.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634453 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4500
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSICE1F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240635437 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:216
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID8C3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638187 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1584
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7A9CE87671E620057B40E5AD462AE968 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2332
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2352
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="2" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q3000001k7QwIAI" /AgentId="0d239d8f-1c9b-4194-8ad4-0e38be575950"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4136
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E3B34D318F897A179ECE3F7170D39C13 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D2C4F7A4-FD41-40C9-80E0-058AC2FF6FB0}
        3⤵
        • Executes dropped EXE
        PID:4812
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41F7117E-EBB7-49A0-8562-064F2AC1A988}
        3⤵
        • Executes dropped EXE
        PID:5068
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8596C186-DE02-4C5F-83CA-F209DCBFB37B}
        3⤵
        • Executes dropped EXE
        PID:2064
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B3AA5702-6E82-4A6B-BE65-30755D535B56}
        3⤵
        • Executes dropped EXE
        PID:3728
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B037C58-FE44-4FE2-B0B8-E9B81DDDB38F}
        3⤵
        • Executes dropped EXE
        PID:2024
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{906AA215-BE0C-4ADD-845B-7E23D4A2E6DA}
        3⤵
        • Executes dropped EXE
        PID:2920
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A06F8685-66C1-4916-9430-2740D7B6C036}
        3⤵
        • Executes dropped EXE
        PID:4544
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A8B4AA4-F082-450F-87AF-997471D409C1}
        3⤵
        • Executes dropped EXE
        PID:2848
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{33347893-2D43-4319-A842-5C456A8CC4A3}
        3⤵
        • Executes dropped EXE
        PID:1480
      • C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe
        C:\Windows\TEMP\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_is1DE3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{96D8844B-301D-4EC9-8B31-A7E4ECE0F56B}
        3⤵
        • Executes dropped EXE
        PID:3848
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2236
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1932
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3596
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3296
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:864
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4752
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2348
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3604
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3220
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1584
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3160
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2692
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2024
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2404
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3952
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3848
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3108
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5100
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DEF06D08-D9F6-4576-BF9F-85F0D3C79AD4}
        3⤵
        • Executes dropped EXE
        PID:4180
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DFE92AD7-3541-48FD-9B5D-A0F24E9EFA5B}
        3⤵
        • Executes dropped EXE
        PID:1892
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1A6BE506-7927-4E88-BB37-91EFA365358E}
        3⤵
        • Executes dropped EXE
        PID:1496
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6257731-E2FF-4E4D-9CD9-BE078EED2764}
        3⤵
        • Executes dropped EXE
        PID:3816
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{33C174DA-4DBA-48FF-914D-60D128C64109}
        3⤵
        • Executes dropped EXE
        PID:4544
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F94497F8-2018-440A-8541-9FCA5F8FE99C}
        3⤵
        • Executes dropped EXE
        PID:4812
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A750FA49-6233-4727-B229-D6E7874B0118}
        3⤵
        • Executes dropped EXE
        PID:3804
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{016BDED1-6CE5-441A-BA1E-C80926C88105}
        3⤵
        • Executes dropped EXE
        PID:5040
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{38DCBF3B-435B-4CF7-AC7C-73877DB96964}
        3⤵
        • Executes dropped EXE
        PID:1932
      • C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
        C:\Windows\TEMP\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{907C83E0-FE5C-419E-8851-E6FE5EB896BC}
        3⤵
        • Executes dropped EXE
        PID:4580
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5836AEED-0382-47E3-B2A7-0FDE4E2FA89D}
        3⤵
        • Executes dropped EXE
        PID:4432
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E714CCB1-6BC5-4670-9F5A-433123510319}
        3⤵
        • Executes dropped EXE
        PID:3204
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16699DB8-4D9E-4FC0-AF9D-072DC532477A}
        3⤵
        • Executes dropped EXE
        PID:4028
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E2B06DF1-A3D7-41FC-9110-E1E013EDBA4D}
        3⤵
        • Executes dropped EXE
        PID:1008
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2EB7020C-7CF2-4C15-ACEC-A84BAB420984}
        3⤵
        • Executes dropped EXE
        PID:372
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B297690C-169D-48E5-9525-4DCF9A559C15}
        3⤵
        • Executes dropped EXE
        PID:1228
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0EC14E1E-2DF8-4FE7-A016-CBB3B91DE36A}
        3⤵
        • Executes dropped EXE
        PID:1288
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26DB5403-AA30-4FAB-A715-9FB892A7E1A5}
        3⤵
        • Executes dropped EXE
        PID:4228
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4EEF7780-CD23-4ECE-A567-26FECED7A9F8}
        3⤵
        • Executes dropped EXE
        PID:4336
      • C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe
        C:\Windows\TEMP\{CF4F9C6A-00E8-4D47-B869-1957F234369D}\_is35B3.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E079CCDD-2335-41D2-9116-31C994439BAB}
        3⤵
        • Executes dropped EXE
        PID:2464
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1008
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2280
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4432
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:4500
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:3172
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1572
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1A24C22A-3ACE-4BCF-9F87-1B92B3D172F2}
            3⤵
            • Executes dropped EXE
            PID:4796
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9D884B2B-C198-47B3-84DC-44C8E040F182}
            3⤵
            • Executes dropped EXE
            PID:2056
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D5876E1E-6855-4C46-9FD9-E054433EA15B}
            3⤵
            • Executes dropped EXE
            PID:796
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C11C20C5-3873-4376-8F82-125684A925EF}
            3⤵
            • Executes dropped EXE
            PID:2692
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3307D9C-4A6C-4D05-846D-45B0563BE0CE}
            3⤵
            • Executes dropped EXE
            PID:2516
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DEA185E-699E-499D-8189-FF3FA93E78BC}
            3⤵
            • Executes dropped EXE
            PID:1188
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B2B4C3C4-5EDF-4CEB-9A0A-076DF3EE245E}
            3⤵
            • Executes dropped EXE
            PID:4300
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BDC40A98-7C59-4B7F-9D12-21FECD954334}
            3⤵
            • Executes dropped EXE
            PID:4796
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B271FDBB-9AA9-41D9-8DB4-B93E8A10DBEC}
            3⤵
            • Executes dropped EXE
            PID:2056
          • C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe
            C:\Windows\TEMP\{3EE1070E-7A43-486E-BDAC-1F8D30BE60DF}\_is4797.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BA53A284-9245-43B5-8E3E-942F33D79BE4}
            3⤵
            • Executes dropped EXE
            PID:796
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2848
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{968454D6-D803-4960-8716-F2C02C4E6C53}
            3⤵
            • Executes dropped EXE
            PID:4724
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{069A4069-1BFC-4F41-9495-8F5F2F299F3B}
            3⤵
            • Executes dropped EXE
            PID:4324
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{80C622AF-E522-4CDA-99BB-30D82F2FE922}
            3⤵
            • Executes dropped EXE
            PID:1892
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C7350159-CE8C-4F97-BD1B-B489D59F9A3D}
            3⤵
            • Executes dropped EXE
            PID:4264
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA2E6E94-1457-4EC7-9E54-54F05EFFFC95}
            3⤵
            • Executes dropped EXE
            PID:4180
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6CE7D649-7C8A-41A5-B33C-A05AF6764BF9}
            3⤵
            • Executes dropped EXE
            PID:768
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17A890B0-BFDB-4A9E-9F39-AA1540EE7B3F}
            3⤵
            • Executes dropped EXE
            PID:2148
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9334FB08-0D12-47E7-B7CA-478B2357BADD}
            3⤵
            • Executes dropped EXE
            PID:1228
          • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
            C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B585DED3-287B-4BC8-A344-111E3B153B0D}
            3⤵
              PID:1628
            • C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe
              C:\Windows\TEMP\{8876A351-7DD2-4DDE-92BC-6448254AD8DB}\_is4B03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D0640AC3-3A83-4E8A-AB72-4A097049E674}
              3⤵
                PID:3816
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                3⤵
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:4856
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  4⤵
                    PID:4180
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 1E9AAFF1E5441DF4F05DF439D4BFE6D3 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:872
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI8450.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682281 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5740
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI85F7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682531 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:4816
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI89F0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240683515 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5508
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4264
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:1092
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5656
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5768
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:6032
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:116
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIACC3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240692406 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4912
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                  PID:6112
                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="089ea0e9-621b-42f7-9680-6bca18feb011"
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:5424
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:3588
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4516
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:2212
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "4548fe58-89b1-4858-a823-1de374f2ff6f" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q3000001k7QwIAI
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:4040
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "b16bea28-d203-4364-8ec4-4c71b26807eb" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q3000001k7QwIAI
                  2⤵
                  • Executes dropped EXE
                  PID:2292
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "4d43203f-288c-4317-a534-7c9e53bf7fb5" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q3000001k7QwIAI
                  2⤵
                  • Executes dropped EXE
                  PID:3172
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "9856fc23-e5f3-4ee8-94fd-e545a64173de" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q3000001k7QwIAI
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:4836
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3032
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:2036
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "b6448924-5143-46e5-b173-c54227ba57f9" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q3000001k7QwIAI
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3872
                  • C:\Windows\TEMP\SplashtopStreamer.exe
                    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4512
                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1524
                      • C:\Windows\SysWOW64\msiexec.exe
                        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4248
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "be1ffc95-2cfa-4365-83c7-7a837ba8db37" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q3000001k7QwIAI
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:624
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious use of WriteProcessMemory
                PID:4004
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:4068
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "8a48e7bc-0dda-452f-a3cd-352aeef01cde" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q3000001k7QwIAI
                  2⤵
                  • Drops file in Program Files directory
                  PID:4700
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                      PID:3348
                      • C:\Windows\system32\cscript.exe
                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:4464
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "6f82f9f4-632a-43e0-b33e-d00f0807a458" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q3000001k7QwIAI
                    2⤵
                    • Drops file in Program Files directory
                    PID:2572
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                      3⤵
                        PID:6140
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "dfb5d4b0-c4d9-4db4-8604-c5d4826bb0f2" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q3000001k7QwIAI
                      2⤵
                        PID:1008
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=e4cedc6f490b83360e77af5eddf56e78&rmm_session_pwd_ttl=86400"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:5840
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "32342825-2b50-4b35-8ee1-d0c7c107fb7d" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q3000001k7QwIAI
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Modifies registry class
                        PID:5108
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "7d977281-1db7-489b-95e6-d45fe81b0e91" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q3000001k7QwIAI
                        2⤵
                        • Drops file in System32 directory
                        PID:5200
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "7bb98432-74f1-4bed-a995-c49b1ebf4ad4" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q3000001k7QwIAI
                        2⤵
                        • Drops file in Program Files directory
                        PID:5436
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "18a125c3-ef3a-4ea1-a367-13824ac9284e" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q3000001k7QwIAI
                        2⤵
                          PID:5788
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell.exe" Set-ExecutionPolicy Bypass -Scope CurrentUser
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:5752
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /c powershell.exe -File "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\81e3d3ff-b699-4eb5-8ec5-5b45a45d4b87_56d7960d-e1f2-450e-82c3-a597bcac4d90.ps1"
                            3⤵
                              PID:6112
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -File "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\81e3d3ff-b699-4eb5-8ec5-5b45a45d4b87_56d7960d-e1f2-450e-82c3-a597bcac4d90.ps1"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Modifies data under HKEY_USERS
                                PID:5376
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "703332cb-a50a-431c-b7ec-1d08d7c5c1b0" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q3000001k7QwIAI
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:5176
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:5584
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:5644
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "c0717e54-ae19-4657-b23f-1253630dbc77" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q3000001k7QwIAI
                            2⤵
                              PID:5392
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "40e9676e-bfc4-4ba6-9f4c-cdb4b2259233" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q3000001k7QwIAI
                              2⤵
                              • Drops file in Program Files directory
                              PID:5476
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "715354ae-882a-4102-b499-72528690c840" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q3000001k7QwIAI
                              2⤵
                                PID:5520
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "1d6d29ba-a971-40e7-9cc6-ef31950e9fd8" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q3000001k7QwIAI
                                2⤵
                                • Drops file in System32 directory
                                PID:6124
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "2af23fe9-21ae-41ae-a02a-067e38e6c758" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q3000001k7QwIAI
                                2⤵
                                • Writes to the Master Boot Record (MBR)
                                • Drops file in Program Files directory
                                PID:1180
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "4f56b8bd-c9b2-41b8-96d2-58e7d43f9b78" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q3000001k7QwIAI
                                2⤵
                                  PID:5232
                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "b538eaac-dced-4ff9-9158-78276f6d2dc5" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q3000001k7QwIAI
                                  2⤵
                                  • Drops file in System32 directory
                                  PID:5724
                                  • C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe
                                    "C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 b538eaac-dced-4ff9-9158-78276f6d2dc5 agent-api.atera.com/Production 443 or8ixLi90Mf connect 001Q3000001k7QwIAI
                                    3⤵
                                      PID:5228
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                  1⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2516
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                    2⤵
                                    • Drops file in System32 directory
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1892
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                      -h
                                      3⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2920
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                      3⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2464
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                        4⤵
                                          PID:620
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4548
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1676
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                          SRUtility.exe -r
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3108
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5944
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                          4⤵
                                            PID:3872
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ver
                                              5⤵
                                                PID:5948
                                              • C:\Windows\system32\sc.exe
                                                sc query ddmgr
                                                5⤵
                                                • Launches sc.exe
                                                PID:5156
                                              • C:\Windows\system32\sc.exe
                                                sc query lci_proxykmd
                                                5⤵
                                                • Launches sc.exe
                                                PID:920
                                              • C:\Windows\system32\rundll32.exe
                                                rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                                5⤵
                                                • Checks SCSI registry key(s)
                                                • Modifies data under HKEY_USERS
                                                PID:5012
                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                        1⤵
                                        • Drops file in Program Files directory
                                        • Modifies data under HKEY_USERS
                                        PID:4796
                                        • C:\Windows\System32\sc.exe
                                          "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                          2⤵
                                          • Launches sc.exe
                                          PID:4808
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "5f297260-135c-4983-846f-7a5c326ff8ea" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q3000001k7QwIAI
                                          2⤵
                                            PID:876
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "9f48a80d-5da7-4ee6-9aa8-1f7d09535dc6" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q3000001k7QwIAI
                                            2⤵
                                              PID:6128
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "3b9d5f48-f4f9-4589-aa5a-89a1276f9633" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q3000001k7QwIAI
                                              2⤵
                                                PID:5848
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "powershell.exe" Set-ExecutionPolicy Bypass -Scope CurrentUser
                                                  3⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Drops file in System32 directory
                                                  • Modifies data under HKEY_USERS
                                                  PID:4944
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /c powershell.exe -File "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\3f36c1e2-8b93-481f-ad2b-655cd3487762_56d7960d-e1f2-450e-82c3-a597bcac4d90.ps1"
                                                  3⤵
                                                    PID:5160
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell.exe -File "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\3f36c1e2-8b93-481f-ad2b-655cd3487762_56d7960d-e1f2-450e-82c3-a597bcac4d90.ps1"
                                                      4⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      PID:1668
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "fa73fec4-3d09-4403-b958-8b9ee5cb4699" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q3000001k7QwIAI
                                                  2⤵
                                                    PID:5320
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "60471d8f-be32-459f-9e87-c7d2f795bac7" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q3000001k7QwIAI
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:4948
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                      3⤵
                                                        PID:5348
                                                        • C:\Windows\system32\cscript.exe
                                                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                          4⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:5324
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "8452a21f-8897-4b21-9f22-4bb5bff09281" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q3000001k7QwIAI
                                                      2⤵
                                                        PID:812
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "2879733e-36a8-4266-bcc9-6d277e1e7e82" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q3000001k7QwIAI
                                                        2⤵
                                                        • Drops file in Program Files directory
                                                        PID:5556
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "7c54d816-dad0-4b57-805d-356fdcb36615" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q3000001k7QwIAI
                                                        2⤵
                                                          PID:3360
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                            3⤵
                                                            • System Time Discovery
                                                            PID:5304
                                                            • C:\Program Files\dotnet\dotnet.exe
                                                              dotnet --list-runtimes
                                                              4⤵
                                                              • System Time Discovery
                                                              PID:5328
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "970e5792-74cf-4bb2-9259-ebb268d4cd87" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q3000001k7QwIAI
                                                          2⤵
                                                          • Drops file in Program Files directory
                                                          PID:2944
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "12655d77-61c5-4787-a7f5-3988e6a470ca" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q3000001k7QwIAI
                                                          2⤵
                                                            PID:5472
                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=e4cedc6f490b83360e77af5eddf56e78&rmm_session_pwd_ttl=86400"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4284
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "936834e5-560b-4670-b381-a38314710ce1" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q3000001k7QwIAI
                                                            2⤵
                                                            • Writes to the Master Boot Record (MBR)
                                                            PID:376
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "d65eb52e-4031-46f6-a869-5b998b03fddd" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q3000001k7QwIAI
                                                            2⤵
                                                            • Drops file in Program Files directory
                                                            PID:4376
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "3e146b43-022f-4dac-bf7f-cfaabd7b2a79" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q3000001k7QwIAI
                                                            2⤵
                                                            • Modifies registry class
                                                            PID:5148
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "e7f9e39b-e0bc-4106-af95-a5bfcc7ce75e" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q3000001k7QwIAI
                                                            2⤵
                                                              PID:6020
                                                              • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                                "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "0d239d8f-1c9b-4194-8ad4-0e38be575950" "e7f9e39b-e0bc-4106-af95-a5bfcc7ce75e" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q3000001k7QwIAI"
                                                                3⤵
                                                                  PID:3196
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0d239d8f-1c9b-4194-8ad4-0e38be575950 "9f48a80d-5da7-4ee6-9aa8-1f7d09535dc6" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q3000001k7QwIAI
                                                                2⤵
                                                                  PID:4496
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                1⤵
                                                                • Drops file in Windows directory
                                                                • Checks SCSI registry key(s)
                                                                PID:3708
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:5168
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000178" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:3756
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000178"
                                                                  2⤵
                                                                  • Drops file in Drivers directory
                                                                  • Drops file in System32 directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:5860
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                  2⤵
                                                                  • Drops file in Drivers directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:3164

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Command and Scripting Interpreter

                                                              1
                                                              T1059

                                                              PowerShell

                                                              1
                                                              T1059.001

                                                              Persistence

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Installer Packages

                                                              1
                                                              T1546.016

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Privilege Escalation

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Installer Packages

                                                              1
                                                              T1546.016

                                                              Defense Evasion

                                                              Modify Registry

                                                              1
                                                              T1112

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Subvert Trust Controls

                                                              1
                                                              T1553

                                                              Install Root Certificate

                                                              1
                                                              T1553.004

                                                              System Binary Proxy Execution

                                                              1
                                                              T1218

                                                              Msiexec

                                                              1
                                                              T1218.007

                                                              Credential Access

                                                              Discovery

                                                              Peripheral Device Discovery

                                                              2
                                                              T1120

                                                              Query Registry

                                                              4
                                                              T1012

                                                              System Information Discovery

                                                              3
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Config.Msi\e57c739.rbs
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                c1e9b66fd8c53665665f186335030680

                                                                SHA1

                                                                e47baf2b5d04b5e522865e7cd51ae46bf338dfd4

                                                                SHA256

                                                                b01e30e4ce405775d5bd8280c523878e7d2d823eae907634657b917dab301ff7

                                                                SHA512

                                                                5fdb3f6784f6d770658dd0a751ac39e3bdf11f25776bd6a8d3bc3d3b4305749bdc44c0a0f41e7b28a22e97284b8ef7c10f351fa2895a7365f8daeda4cd0370a4

                                                                Download Submit

                                                              • C:\Config.Msi\e57c73e.rbs
                                                                Filesize

                                                                74KB

                                                                MD5

                                                                5ea21d50c75c66a5bb51ea84a11080ac

                                                                SHA1

                                                                f3986c1f68d53af5d8f1cdccef686852e67fcf02

                                                                SHA256

                                                                ec14426d48677bbee333d9dcce5456734b57ded51898a49d9ec08a4258f838d1

                                                                SHA512

                                                                dcb5ed465d88e9516efe4055c846b84ae671147aa07273d1a90d383065889ac99e620a45c9c5088d9b87e5fb266dda88df0a6fb2d2df068b09b692a3eedd7af0

                                                                Download Submit

                                                              • C:\Config.Msi\e57c740.rbs
                                                                Filesize

                                                                464B

                                                                MD5

                                                                672e8b3b391d55c3b8a26cc7735b272c

                                                                SHA1

                                                                2c75da3faf8a2641e5743314ba96b193543559c2

                                                                SHA256

                                                                2484fa8ceba20aa73d7facf0da0de5d153f3ef93fcaabaf57b653ef0dfb0618d

                                                                SHA512

                                                                25f25a867c2aecbc13c380ebb075c177844e6919e5858e219f3ea0ebf94e8a1c63202e1cda470bbcb4e469dd5846b3d1ad4217775f225a83e8b54fc8304ce2a4

                                                                Download Submit

                                                              • C:\Config.Msi\e57c746.rbs
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                28b7118987a428bf2c1d52cbb163b902

                                                                SHA1

                                                                ffeb1d6eac40bc54964a5819f8e313987a33aa07

                                                                SHA256

                                                                eb75089e74efe2a982f1136b026f26eca5501eb1450b420ca2442fba42106fbe

                                                                SHA512

                                                                c1fb5922e579774905131a880ee35a58445ccbe073521fe821e02320a74bb9dc611bdaec2368dc05ecf020c7daad264f0097d62aff4ac5d500f657ca4761ea3f

                                                                Download Submit

                                                              • C:\Config.Msi\e57c74e.rbs
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                8922dcd4560ad735e58858f3f00ab17d

                                                                SHA1

                                                                48e46a379fbbd5211047aab35d1ec5318e9758e4

                                                                SHA256

                                                                712dab6e8b900057d036358e49b4b2860afa584774af5149ea86f71e4972c641

                                                                SHA512

                                                                eeee1e4932e38e849256a4c1869f08665344bbd98cb663638edd9f8c2d82fcbb3a6946fc8dfff356f9d3d16c214cc6371143515c47419b919ef9f6aebe478269

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                Filesize

                                                                305B

                                                                MD5

                                                                27c1adfa459a0d4c1a3ee1e4e92f8e0e

                                                                SHA1

                                                                e21b1152b78827c8e59d84c541c190c099297632

                                                                SHA256

                                                                8e88d3edb3da0f6dfe4dc7716ab64256fab189429a6690b129d6789f7eeca49b

                                                                SHA512

                                                                f8f66043ad65be01a11e130ccedd14a1e638950bb95999e650f62362c05e81d413d330e87cc5fdade02776fc742ebf96331a3752ab80eda9931041089563ae36

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                Filesize

                                                                142KB

                                                                MD5

                                                                477293f80461713d51a98a24023d45e8

                                                                SHA1

                                                                e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                SHA256

                                                                a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                SHA512

                                                                23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                b3bb71f9bb4de4236c26578a8fae2dcd

                                                                SHA1

                                                                1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                SHA256

                                                                e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                SHA512

                                                                fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                Filesize

                                                                210KB

                                                                MD5

                                                                c106df1b5b43af3b937ace19d92b42f3

                                                                SHA1

                                                                7670fc4b6369e3fb705200050618acaa5213637f

                                                                SHA256

                                                                2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                SHA512

                                                                616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                Filesize

                                                                693KB

                                                                MD5

                                                                2c4d25b7fbd1adfd4471052fa482af72

                                                                SHA1

                                                                fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                SHA256

                                                                2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                SHA512

                                                                f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                Filesize

                                                                158KB

                                                                MD5

                                                                1922740d2479c7d0cd6fb57c3d739543

                                                                SHA1

                                                                877a807a396156be1d0c2782391cabc29ea15760

                                                                SHA256

                                                                20443f66e184311fd412158cb162e36b0172332cd6d401cec9ee5fe17df75e58

                                                                SHA512

                                                                d624bad0fcd8afc190a5de241da341a3f39d6aaa0e5eacdf8b14e8e74515b688f06e2cdc75da0634880ea98238a1d26cd2d2bfaedb6d92067dace99d0963975c

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                Filesize

                                                                157KB

                                                                MD5

                                                                63f830bc220b8af1381f2210fdf6a258

                                                                SHA1

                                                                5651a89b75ba320ba3133826c9fca7f5baa0fbbb

                                                                SHA256

                                                                a82eec1added638aa86d4e66f3b3789e8f7e40a15d0be3b01fbe50ca85b99f9c

                                                                SHA512

                                                                ae2884f99833f11a5ce73843bb675de13c3dd362602352b3e8d3f6815bc03fb9a681f0adfeb677fa575bf3395734fc9e07ea05896e8698f875f7a6b01276a31c

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                Filesize

                                                                51KB

                                                                MD5

                                                                3180c705182447f4bcc7ce8e2820b25d

                                                                SHA1

                                                                ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                SHA256

                                                                5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                SHA512

                                                                228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                Filesize

                                                                12B

                                                                MD5

                                                                eb053699fc80499a7185f6d5f7d55bfe

                                                                SHA1

                                                                9700472d22b1995c320507917fa35088ae4e5f05

                                                                SHA256

                                                                bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                                SHA512

                                                                d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                Filesize

                                                                173KB

                                                                MD5

                                                                fd9df72620bca7c4d48bc105c89dffd2

                                                                SHA1

                                                                2e537e504704670b52ce775943f14bfbaf175c1b

                                                                SHA256

                                                                847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                                SHA512

                                                                47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                Filesize

                                                                546B

                                                                MD5

                                                                158fb7d9323c6ce69d4fce11486a40a1

                                                                SHA1

                                                                29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                SHA256

                                                                5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                SHA512

                                                                7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                Filesize

                                                                688KB

                                                                MD5

                                                                3ef8d12aa1d48dec3ac19a0ceabd4fd8

                                                                SHA1

                                                                c81b7229a9bd55185a0edccb7e6df3b8e25791cf

                                                                SHA256

                                                                18c1ddbdbf47370cc85fa2cf7ba043711ab3eadbd8da367638686dfd6b735c85

                                                                SHA512

                                                                0ff2e8dbfef7164b22f9ae9865e83154096971c3f0b236d988ab947e803c1ed03d86529ab80d2be9ff33af305d34c9b30082f8c26e575f0979ca9287b415f9f9

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                Filesize

                                                                27KB

                                                                MD5

                                                                797c9554ec56fd72ebb3f6f6bef67fb5

                                                                SHA1

                                                                40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                SHA256

                                                                7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                SHA512

                                                                4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                Filesize

                                                                214KB

                                                                MD5

                                                                01807774f043028ec29982a62fa75941

                                                                SHA1

                                                                afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                SHA256

                                                                9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                SHA512

                                                                33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                Filesize

                                                                37KB

                                                                MD5

                                                                efb4712c8713cb05eb7fe7d87a83a55a

                                                                SHA1

                                                                c94d106bba77aecf88540807da89349b50ea5ae7

                                                                SHA256

                                                                30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                SHA512

                                                                3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                Filesize

                                                                3.4MB

                                                                MD5

                                                                e010d1f614b1a830482d3df4ba056f24

                                                                SHA1

                                                                5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                                SHA256

                                                                98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                                SHA512

                                                                727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                Filesize

                                                                389KB

                                                                MD5

                                                                5e3252e0248b484e76fcdbf8b42a645d

                                                                SHA1

                                                                11ae92fd16ac87f6ab755911e85e263253c16516

                                                                SHA256

                                                                01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                                SHA512

                                                                540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                Filesize

                                                                48KB

                                                                MD5

                                                                f55cf59108076da0f974cde1413dde37

                                                                SHA1

                                                                0bea8c054f830daf38e29f0dac5d91edff7e178e

                                                                SHA256

                                                                cda5e24b5b669145b7f94f1a9d6b6a037373e2bef77b95340de2d69825c9bae3

                                                                SHA512

                                                                f44d64f64cf0bc8b939988b06af2bcf450e841fd9142abc8221a12dfdd779b91523a57a3726c5e0cf8f7bb7925eb25a871fa6716b3775eb8577fd9b11733cb52

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                Filesize

                                                                196KB

                                                                MD5

                                                                680bac4393da4dafe0100d9483d3b6e4

                                                                SHA1

                                                                ed211ef61232c5aacee7ca168659f02f9d4f4e53

                                                                SHA256

                                                                c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                                                                SHA512

                                                                5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                Filesize

                                                                56KB

                                                                MD5

                                                                0f33a7acb33960d1306ba418405d8264

                                                                SHA1

                                                                bc24c37727b00d514446c8b5fb6c04f36254a067

                                                                SHA256

                                                                a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                                SHA512

                                                                72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                9d1528a2ce17522f6de064ae2c2b608e

                                                                SHA1

                                                                2f1ce8b589e57ab300bb93dde176689689f75114

                                                                SHA256

                                                                11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                SHA512

                                                                a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5476.update
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                14ffcf07375b3952bd3f2fe52bb63c14

                                                                SHA1

                                                                ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                SHA256

                                                                6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                SHA512

                                                                14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                c39b5b36da4625e2aca8262e8d27d5d5

                                                                SHA1

                                                                7a578a6e97420f2fdfdc470b04c10ae062bf7672

                                                                SHA256

                                                                73e1a8b04289dc6ceb2773370eaf3958725a8796e6aaa4a7ce4b420e26a37c9d

                                                                SHA512

                                                                a1a78e99f8e7772279e1145f6ef2449cbfbb3d8355425a34049543bf97c04d837730ee98238bc62724b6e2c73f762aa99e8d43497446629e81f3cf1b23abd9e3

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                Filesize

                                                                2B

                                                                MD5

                                                                81051bcc2cf1bedf378224b0a93e2877

                                                                SHA1

                                                                ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                SHA256

                                                                7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                SHA512

                                                                1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                Filesize

                                                                54KB

                                                                MD5

                                                                77c613ffadf1f4b2f50d31eeec83af30

                                                                SHA1

                                                                76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                SHA256

                                                                2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                SHA512

                                                                29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                Filesize

                                                                334KB

                                                                MD5

                                                                2e2e6e6702fa92da8c08fa85617fa861

                                                                SHA1

                                                                bee96d85e39faa0d6f60fc797e0c4f0e9c01ed67

                                                                SHA256

                                                                565bbd4ed69c929cb00ce6552633382bfe46248b6e9db3293b9c031875c02b35

                                                                SHA512

                                                                35eaf569f94c69749308d30722589331ea1957f3a11f440b1eccc4aa32284681162128b2febef76c75181b49e5e57d780685a22e14e1900ffc7add3f83ac075e

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                Filesize

                                                                71KB

                                                                MD5

                                                                5129e29d4d9a8ed94e04099622316b37

                                                                SHA1

                                                                be1c537ad5fc51bd28bd3ea23e16cbfbdaf01dfd

                                                                SHA256

                                                                17c1a413747e1dbf203f1824e45ddc0dc7afe4c529bca88cdb670f019d95db11

                                                                SHA512

                                                                7b8a1d79c069cdcbebd57255d11d96e13e291df8b99c15d6c969a66ef8af8639fac92e22b233b4b6f8b33a9c52ba2936fe59ecee2acf78c571f4920ea075e4bb

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                Filesize

                                                                50KB

                                                                MD5

                                                                254dcbee3213189461b66e962ce8cc05

                                                                SHA1

                                                                cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                                                                SHA256

                                                                e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                                                                SHA512

                                                                7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                Filesize

                                                                32KB

                                                                MD5

                                                                db1db66ebd9b15b7dcd55374ea56ee5e

                                                                SHA1

                                                                c22897eb20900a66cf62023c37d6a7d1192aec3d

                                                                SHA256

                                                                0263a627bbea55a66deecd7a43f8537bb68b5f95bb3d4269d3e594bd1d851e64

                                                                SHA512

                                                                b56b2143a60e6153e7fb752029c72d78547d5253f32ecbd0dda5a8acc5c3859292e860162b11a041a37b4f618f4425484b4e2385d7e2c621c8cbced073e3a67e

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                Filesize

                                                                56KB

                                                                MD5

                                                                e9794f785780945d2dde78520b9bb59f

                                                                SHA1

                                                                293cae66cedbc7385cd49819587d3d5a61629422

                                                                SHA256

                                                                0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                                                                SHA512

                                                                1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                Filesize

                                                                588KB

                                                                MD5

                                                                17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                SHA1

                                                                bc0316e11c119806907c058d62513eb8ce32288c

                                                                SHA256

                                                                13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                SHA512

                                                                f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                Filesize

                                                                210B

                                                                MD5

                                                                a3e3d2b93600b67662f5b4a5a150ed9f

                                                                SHA1

                                                                b8e72bbb06666e27ce9e8f8e6cf1a5ea9b944f36

                                                                SHA256

                                                                be24c81f64954ca4ef72e08eed3fc9e14555d41c172cfb07818ebd40ff0dd4d8

                                                                SHA512

                                                                7a1765b832be330591ccc65dbb9541c4a438af680757fedbc348b9f8c878f4ca88e64059414e250c11676ac8cf3de742f009060d0d597c096da3aa620fae2bd1

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                1ef7574bc4d8b6034935d99ad884f15b

                                                                SHA1

                                                                110709ab33f893737f4b0567f9495ac60c37667c

                                                                SHA256

                                                                0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                SHA512

                                                                947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                f512536173e386121b3ebd22aac41a4e

                                                                SHA1

                                                                74ae133215345beaebb7a95f969f34a40dda922a

                                                                SHA256

                                                                a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                SHA512

                                                                1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                Filesize

                                                                76KB

                                                                MD5

                                                                b40fe65431b18a52e6452279b88954af

                                                                SHA1

                                                                c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                SHA256

                                                                800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                SHA512

                                                                e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                Filesize

                                                                80KB

                                                                MD5

                                                                3904d0698962e09da946046020cbcb17

                                                                SHA1

                                                                edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                SHA256

                                                                a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                SHA512

                                                                c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                Filesize

                                                                321B

                                                                MD5

                                                                e27388e8bddf99c59e899e3b6257dc8e

                                                                SHA1

                                                                6540cf5cbf3790840ec3a9d5644106895a98523a

                                                                SHA256

                                                                85839872a437e67907189ce9e7523c91c700472bb150ee39db06c3dfb91e4cf1

                                                                SHA512

                                                                36d0a63a1785999c2b6f38c701662b66fa14da92120929e39bee561749a036920181e5f8db512e51e9050c61c41f0b2ddce4bed1d932d8a5821972a9242ec062

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                Filesize

                                                                717B

                                                                MD5

                                                                ef0a07aec4367a64c16c581da2657aa9

                                                                SHA1

                                                                13011a5abcbadb3424fb6ecee560665556bb1d24

                                                                SHA256

                                                                f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                                SHA512

                                                                35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                Filesize

                                                                7KB

                                                                MD5

                                                                362ce475f5d1e84641bad999c16727a0

                                                                SHA1

                                                                6b613c73acb58d259c6379bd820cca6f785cc812

                                                                SHA256

                                                                1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                SHA512

                                                                7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                dc34fb149320b8344ef62548a634f290

                                                                SHA1

                                                                d5008caa155335ec563e47f00ab83c1b87ac732a

                                                                SHA256

                                                                5caeaa7a9f680c9e332d445b2a0b1679e028fe92ad3ed713c51a24acfc1eaed4

                                                                SHA512

                                                                97ccdbbff6b6ea6b644cabc285c0e6147c43f9b3fa451a8b7851fd0664dc9504fffe3223205f11ce2b3d6ba816891393a86aeecf86bd6daf06c889421a91192b

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                9a9b1fd85b5f1dcd568a521399a0d057

                                                                SHA1

                                                                34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                SHA256

                                                                88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                SHA512

                                                                7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                Filesize

                                                                375KB

                                                                MD5

                                                                4a09a87d2004dac4b00687e9c9f15036

                                                                SHA1

                                                                c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                                                                SHA256

                                                                2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                                                                SHA512

                                                                f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                Filesize

                                                                321KB

                                                                MD5

                                                                d3901e62166e9c42864fe3062cb4d8d5

                                                                SHA1

                                                                c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                SHA256

                                                                dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                SHA512

                                                                ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                Filesize

                                                                814KB

                                                                MD5

                                                                9b1f97a41bfb95f148868b49460d9d04

                                                                SHA1

                                                                768031d5e877e347a249dfdeab7c725df941324b

                                                                SHA256

                                                                09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                SHA512

                                                                9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                e74d2a16da1ddb7f9c54f72b8a25897c

                                                                SHA1

                                                                32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                SHA256

                                                                a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                SHA512

                                                                52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\3f36c1e2-8b93-481f-ad2b-655cd3487762_56d7960d-e1f2-450e-82c3-a597bcac4d90.ps1
                                                                Filesize

                                                                272B

                                                                MD5

                                                                c62976830cf2d90bd751dccf4dfa3735

                                                                SHA1

                                                                e33261b4a39e5720fce3972937cbe669f2e7adbc

                                                                SHA256

                                                                67585b281b8ce93afd2e6195fa983869264ee4d1fc5e6a6208c71f7830cb003c

                                                                SHA512

                                                                4db9fa2f1d72d3eb3efbf6cf3d52214321650c0b75b29ffadad40ad19d5c8a4267b094c5f02c46c54f4b412d22d8d9a95ffdb02021c78ea33a44be3de17a950d

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                                Filesize

                                                                11B

                                                                MD5

                                                                5eda46a55c61b07029e7202f8cf1781c

                                                                SHA1

                                                                862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                SHA256

                                                                12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                SHA512

                                                                4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                Filesize

                                                                12B

                                                                MD5

                                                                5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                                SHA1

                                                                93012724e6cc0a298838aede678806e6c0c6517d

                                                                SHA256

                                                                a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                                SHA512

                                                                890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                Filesize

                                                                48KB

                                                                MD5

                                                                b4a865268d5aca5f93bab91d7d83c800

                                                                SHA1

                                                                95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                                SHA256

                                                                5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                                SHA512

                                                                c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                Filesize

                                                                48KB

                                                                MD5

                                                                83fbda00ff9cd80ad60e1242434868d4

                                                                SHA1

                                                                30d4e17c90588f4dd528fbaa2e589463ca3ad2a6

                                                                SHA256

                                                                8ac5cd3fe26e3d400ae61f7d781add5672460e91222791b1baf95b0c5b0ae854

                                                                SHA512

                                                                7d4ace45653b3b5279487f94596667dd15ebd07383fbba82616eff790eeb82152d87e635a93ca6490b774691a92f8f951ccb9c8eb4480de7f144020f83f833eb

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                Filesize

                                                                48KB

                                                                MD5

                                                                d05bd655ef2ab9ebd20697ca5aaced05

                                                                SHA1

                                                                bcd4ebdb72ab0a6e4b6614a102d3b9059e9be020

                                                                SHA256

                                                                66b3afa10a18749ec51c152e66c488c7e4f1f6ef6762edc30caffdd088602340

                                                                SHA512

                                                                61e6068a4402852138d08531e7bbb27fa6b8dddfd5e6f3379a67ef7abad405f1e2456f73dcdd6605f8be375692379532f99a221cc1001b7f1fa8c186bbcc10d2

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                Filesize

                                                                2.8MB

                                                                MD5

                                                                a7bf0da8e308248aefd69586e1f8a312

                                                                SHA1

                                                                f1df1b8f00087260c9c7c2ba46cb98903f98bf73

                                                                SHA256

                                                                b8c4a5ec9357ace0e98bf2e7550d691af280a387fc9636260ea6bc2c2b5b6ba6

                                                                SHA512

                                                                e9edd7b668136e3a16b070c13bedb5465ab1cee02cc84f84f40a80aca12cd3ce2a781724f53fecae891a390fc257bec727fb6e4756f644597785ff21107071fd

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                7805ea1a8dd15cac328b826efe38c2a9

                                                                SHA1

                                                                66ff8eafb2424717c4394bae28a8683db1244527

                                                                SHA256

                                                                7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                                                                SHA512

                                                                17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                6c6f85e896655a6eb726482f04c49086

                                                                SHA1

                                                                2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                SHA256

                                                                e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                SHA512

                                                                b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                Filesize

                                                                541B

                                                                MD5

                                                                d0efb0a6d260dbe5d8c91d94b77d7acd

                                                                SHA1

                                                                e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                                SHA256

                                                                7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                                SHA512

                                                                a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                Filesize

                                                                12B

                                                                MD5

                                                                213da2b23ec7ec5259829958b2cf42be

                                                                SHA1

                                                                5b7dfb867ed116395f0c8d8299d7357e1f5355fc

                                                                SHA256

                                                                eb70db8191a629c3c2a53d07ee68ce9e4a906defd701b4a08cab8a410df29457

                                                                SHA512

                                                                2b5500f9062c8c44ee4bb2ba81f4b0f948e07c1182525fbdc72a1ab6e304055e04100cce41dc3e68a7cec3557ed39a755eb1ef38e3db6cf56102f5a20e6601d2

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                Filesize

                                                                646KB

                                                                MD5

                                                                0e6af651f8be91dc9dde2faab59c9a77

                                                                SHA1

                                                                f199693bb55864f8497227c1c14244ff3e6e423e

                                                                SHA256

                                                                895f2593cf3f365046f33e9cf5ebcb2a17e7af1c592decc82bfe8ff5d5653a20

                                                                SHA512

                                                                fd770888310dd2e58124eae49bdc6e715fde9b100010ef224e10f6a757629c2c55d12c0e4cede3f8cf8e89d1267e4820c9bf82df5f6263675ecc3596895da4af

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                Filesize

                                                                3.1MB

                                                                MD5

                                                                ff671b6085ba35e1bbebd5d2389ab7d6

                                                                SHA1

                                                                d7719a66e303c4e854faba873b781e0084f36998

                                                                SHA256

                                                                4f2a43098f6eff50a03fde9e134a4c8b7df6fe7e9a9c6913afeefe0deeb1463e

                                                                SHA512

                                                                f5a63eeb6a239d7be9935ceb1240aae7c9f3a8d5740d665b5fde6f28a7667feb345f88bc440ebe7d6a0512b448f4e3772a49823bc6ad8ba7372e0a31b5f9f200

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                Filesize

                                                                570KB

                                                                MD5

                                                                b50834694383960830cf48d9836e1108

                                                                SHA1

                                                                adc80813181b98a8296befa2960a55f939f3bfee

                                                                SHA256

                                                                370a259808052366888284b0cc4c91ff8f23e8008003959b8d0efb1adbf00cd6

                                                                SHA512

                                                                f87be933e87275b000be031aa5df7536dfd5fe9b99a607ce0904f206e074d3a0687a00654b9b78edaa2fccf3d30526e0ee5bd7dcba4a5daafd6fc60eeaaa15c5

                                                                Download Submit

                                                              • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\e601f1169366672eb7923896662dc374
                                                                Filesize

                                                                16KB

                                                                MD5

                                                                b2e89027a140a89b6e3eb4e504e93d96

                                                                SHA1

                                                                f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                SHA256

                                                                5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                SHA512

                                                                93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                Download Submit

                                                              • C:\ProgramData\chocolatey\config\chocolatey.config
                                                                Filesize

                                                                809B

                                                                MD5

                                                                8b6737800745d3b99886d013b3392ac3

                                                                SHA1

                                                                bb94da3f294922d9e8d31879f2d145586a182e19

                                                                SHA256

                                                                86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                SHA512

                                                                654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                Download Submit

                                                              • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                99573a993f04609309727a329d9e01fa

                                                                SHA1

                                                                736c1cf2e57f266407755730d98f1e88ab58fe57

                                                                SHA256

                                                                871cf7f534de9c9df04db4527f10ed87979de69a8739e93aa6ceb14d733990ff

                                                                SHA512

                                                                932af31c01ead922863cf5e7b3f971fbf02763d6f08cbce14a78fc1c4a5a6cd692cec0b2f3c1c8aadecf6b6222684218cc47eebec7e8ebd8db0acfe6cb3b25b3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                Filesize

                                                                471B

                                                                MD5

                                                                b6102b47f3d2450f02c1167e5b337e9b

                                                                SHA1

                                                                91a6e5d7b3540556c971bcd6cdf52abd2cffcbfe

                                                                SHA256

                                                                e0c2d57c8661d444666ae009725ee84cd33a29ac48738277ea37bfd56b3cf8c4

                                                                SHA512

                                                                62bb67b325b56c41544956928ef0991262df019a470fc5792ba5abb7096e419f7ea3c8326560ffbe2b50ed0612fbc968fdf7564793a4d550b2465b799cbfcedf

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                Filesize

                                                                727B

                                                                MD5

                                                                a433d0bd40ae75fbd372efe3fd3e2bc6

                                                                SHA1

                                                                137005873f5a1d269a7047adbcd08f5d204a323b

                                                                SHA256

                                                                83599ee2c90c3ef5da0f1d87bb6155bdcd2e70b97ad2163e4247f74f0925e1ec

                                                                SHA512

                                                                dca032c59d56db32821d19d913cb7519fbc0545bdc5b19cc6ca9eebf2faa8dca9739d4190b269c34438bca85879a271108f0641c2b653df37f08bfb9224150cb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                Filesize

                                                                727B

                                                                MD5

                                                                1dc1121e24814ab2e9102c631f6368e5

                                                                SHA1

                                                                55f7935319102e893d0df7ba28c35343456300ee

                                                                SHA256

                                                                8ed09687565336351ef88085dcf6cfc841af12a63433ecc12c2f13a9557c3c59

                                                                SHA512

                                                                132158f8f2bdf5d66cd4f3fed37405027d4233c79a365027e5d8d0ea20c5d23805bd298358df371b625486282867ba93a3ff5945dddf3ae8d91dd2630e477df4

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                Filesize

                                                                400B

                                                                MD5

                                                                418b735a117b0b0868b969a5247fa59b

                                                                SHA1

                                                                f47e4e204cedc3476e9db0b3f56c6e98d82a1392

                                                                SHA256

                                                                e5215413065b7b58c7d8acf661a93b5e4857b87ed9848ed106112f350fab8ccc

                                                                SHA512

                                                                b8bdcb3869c8c6760261376ca4b9d0696fbe9761162d68d51630d0e2b03e9081dbfd0934d4fce64badd2f7e8aed86c8d88451c0d6b86e4e155f12d57dcd07c4b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                Filesize

                                                                404B

                                                                MD5

                                                                11380fef16cde0e2d020c228f18c6763

                                                                SHA1

                                                                fedef3f43f62e99111cd52748b09916ddd0e44ad

                                                                SHA256

                                                                338792272b3f3b335f68189bfb6e55d1ddc4bae0c57e7ca4074bfff9a0d65605

                                                                SHA512

                                                                c2e1cbecaff7ccd3659d9db477544722defdb65a26e76c8daedff88dde76e4eabc59f675c55374860585f3467a1e85e8f60cd4a106b62c00552445630b4466ff

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                Filesize

                                                                412B

                                                                MD5

                                                                212e043569996ed9fa6f2f86d039ac0f

                                                                SHA1

                                                                5e93391848988abc4d2e38b5da547d4e134689ab

                                                                SHA256

                                                                7740266b3327d8055fb65082e95e42a19a37cc432b3289b04fe80f250c551bc1

                                                                SHA512

                                                                af2efc40a20678f467ed735021dcf82dbe695f3caa13a26ed4e5f231af9fb7c4f46330034685334f58f57b2ddc8ae8ba35b995130ef841c6628ab3b31f8afc74

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                Filesize

                                                                651B

                                                                MD5

                                                                9bbfe11735bac43a2ed1be18d0655fe2

                                                                SHA1

                                                                61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                SHA256

                                                                549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                SHA512

                                                                a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI3504.tmp
                                                                Filesize

                                                                4.5MB

                                                                MD5

                                                                08211c29e0d617a579ffa2c41bde1317

                                                                SHA1

                                                                4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                                SHA256

                                                                3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                                SHA512

                                                                d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI8450.tmp-\System.Management.dll
                                                                Filesize

                                                                60KB

                                                                MD5

                                                                878e361c41c05c0519bfc72c7d6e141c

                                                                SHA1

                                                                432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                SHA256

                                                                24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                SHA512

                                                                59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                Download Submit

                                                              • C:\Windows\Installer\MSIC7C4.tmp
                                                                Filesize

                                                                509KB

                                                                MD5

                                                                88d29734f37bdcffd202eafcdd082f9d

                                                                SHA1

                                                                823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                SHA256

                                                                87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                SHA512

                                                                1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                Download Submit

                                                              • C:\Windows\Installer\MSIC7C4.tmp-\AlphaControlAgentInstallation.dll
                                                                Filesize

                                                                25KB

                                                                MD5

                                                                aa1b9c5c685173fad2dabebeb3171f01

                                                                SHA1

                                                                ed756b1760e563ce888276ff248c734b7dd851fb

                                                                SHA256

                                                                e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                SHA512

                                                                d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                Download Submit

                                                              • C:\Windows\Installer\MSIC7C4.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                Filesize

                                                                179KB

                                                                MD5

                                                                1a5caea6734fdd07caa514c3f3fb75da

                                                                SHA1

                                                                f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                SHA256

                                                                cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                SHA512

                                                                a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                Download Submit

                                                              • C:\Windows\Installer\MSICA46.tmp-\CustomAction.config
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                bc17e956cde8dd5425f2b2a68ed919f8

                                                                SHA1

                                                                5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                SHA256

                                                                e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                SHA512

                                                                02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                Download Submit

                                                              • C:\Windows\Installer\MSICA46.tmp-\Newtonsoft.Json.dll
                                                                Filesize

                                                                695KB

                                                                MD5

                                                                715a1fbee4665e99e859eda667fe8034

                                                                SHA1

                                                                e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                SHA256

                                                                c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                SHA512

                                                                bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                Download Submit

                                                              • C:\Windows\Installer\MSICF98.tmp
                                                                Filesize

                                                                211KB

                                                                MD5

                                                                a3ae5d86ecf38db9427359ea37a5f646

                                                                SHA1

                                                                eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                SHA256

                                                                c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                SHA512

                                                                96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                Download Submit

                                                              • C:\Windows\Installer\e57c738.msi
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                1f7cc0e92a85fdd5a8bfbc2462fd39bb

                                                                SHA1

                                                                d2632d95800bc3af215366d453a27fb57b4b6404

                                                                SHA256

                                                                bef23b4312dc6427c7f67271ea042200a5a529c3d7210c46a0f5c5adfc49f387

                                                                SHA512

                                                                22de5ca984e4c3c48ebb9f207d1845c6aa6fb80bd01082f2eed12354975e74d30435252f5c8a67cc3fa9caf12245b36bf649f806074eba9cf0977a69d496407e

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{8a75f3b3-d3c0-cc48-8779-a0c247431d8a}\lci_iddcx.cat
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                62458e58313475c9a3642a392363e359

                                                                SHA1

                                                                e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                SHA256

                                                                85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                SHA512

                                                                49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{8a75f3b3-d3c0-cc48-8779-a0c247431d8a}\lci_iddcx.inf
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                1cec22ca85e1b5a8615774fca59a420b

                                                                SHA1

                                                                049a651751ef38321a1088af6a47c4380f9293fc

                                                                SHA256

                                                                60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                SHA512

                                                                0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{8a75f3b3-d3c0-cc48-8779-a0c247431d8a}\x64\lci_iddcx.dll
                                                                Filesize

                                                                52KB

                                                                MD5

                                                                01e8bc64139d6b74467330b11331858d

                                                                SHA1

                                                                b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                SHA256

                                                                148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                SHA512

                                                                4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9e4e60-d88a-6141-a0b3-5e81f713eef9}\lci_proxywddm.cat
                                                                Filesize

                                                                12KB

                                                                MD5

                                                                8e16d54f986dbe98812fd5ec04d434e8

                                                                SHA1

                                                                8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                SHA256

                                                                7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                SHA512

                                                                e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9e4e60-d88a-6141-a0b3-5e81f713eef9}\lci_proxywddm.inf
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                0315a579f5afe989154cb7c6a6376b05

                                                                SHA1

                                                                e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                SHA256

                                                                d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                SHA512

                                                                c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9e4e60-d88a-6141-a0b3-5e81f713eef9}\x64\lci_proxyumd.dll
                                                                Filesize

                                                                179KB

                                                                MD5

                                                                4dc11547a5fc28ca8f6965fa21573481

                                                                SHA1

                                                                d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                SHA256

                                                                e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                SHA512

                                                                bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9e4e60-d88a-6141-a0b3-5e81f713eef9}\x64\lci_proxyumd32.dll
                                                                Filesize

                                                                135KB

                                                                MD5

                                                                67ae7b2c36c9c70086b9d41b4515b0a8

                                                                SHA1

                                                                ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                SHA256

                                                                79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                SHA512

                                                                4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9e4e60-d88a-6141-a0b3-5e81f713eef9}\x64\lci_proxywddm.sys
                                                                Filesize

                                                                119KB

                                                                MD5

                                                                b9b0e9b4d93b18b99ece31a819d71d00

                                                                SHA1

                                                                2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                SHA256

                                                                0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                SHA512

                                                                465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                Download Submit

                                                              • C:\Windows\System32\InstallUtil.InstallLog
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                bbe625903f24392c2a25bedce9fabd66

                                                                SHA1

                                                                5980c02f4570b749bcc0bed56ee9ff0dde1b1ec2

                                                                SHA256

                                                                fac60b5633a0094427f5c5916611912330def57e1418040216be71ee928d69bc

                                                                SHA512

                                                                480f79d8dfe1555431e2579b8b8fdbdbe5e0f064c316dc5caba50976436850ba6d2b413477096e97f0c5c76a21a6e38eefbf46b6e8e2f08ffe875fa3279062c6

                                                                Download Submit

                                                              • C:\Windows\Temp\Agent.Package.Availability\data\iot_conf.json
                                                                Filesize

                                                                189B

                                                                MD5

                                                                9ed2918a12f2baff4f610161c645c5f1

                                                                SHA1

                                                                3f804e7977c9b6776ecd9b134093f71a0cfb9b2d

                                                                SHA256

                                                                2b18ebcfbbb35edab17868fb90e5d616f6e5e66fe86874a23849a56c2e1ce330

                                                                SHA512

                                                                255b2b9c2b9dbc41ec4a9122bfa0e6d4650a495e2ca2b80c5c6798bb637451d191243677784072ed7a16cb02b5e205b52f0aebc89a55a1bb9f45f5f655ca04ac

                                                                Download Submit

                                                              • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-19-38-43.dat
                                                                Filesize

                                                                602B

                                                                MD5

                                                                04a15c571c24a85fd817c1585c3128a7

                                                                SHA1

                                                                c726ddb14341e50c2a1bf5fa89b81384e8c0f3bd

                                                                SHA256

                                                                67926a3a6ab36f019c4e482a22fe5224951399409e0a273088c69153e88a7bb4

                                                                SHA512

                                                                760a5448311cf6a17cddab3510d73c29efdf97cdced37bee57b656c529b1ccb76fe472b387640ce2595d1281b27c80fb3a19843d246b4fe7d49af1e6e9acede0

                                                                Download Submit

                                                              • C:\Windows\Temp\InstallUtil.log
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                fe196bdfe7224610ca87ce34b78f4656

                                                                SHA1

                                                                2824ad6fbfac5a6eb647c7ba41efca95660643d6

                                                                SHA256

                                                                4ee86e6d61b7d5d2a695d89fab81eaa0ba79ff031a521a8fb9a63ea77269c5e7

                                                                SHA512

                                                                a4ae6d2f82563b0216bcfb5a58537f76e409455925d6bb60c1ed7d844fd9a4119d077355e8904fb2bb5781ca06ba94b00a2ef4e3a61396008a076af0c16b9dd1

                                                                Download Submit

                                                              • C:\Windows\Temp\InstallUtil.log
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                49d20fa0dd24d55dc94a3832659da0b4

                                                                SHA1

                                                                fb8434aac0bb5e8859b4675ab714909ce6114355

                                                                SHA256

                                                                d889994fb4a9c4fdb4df208b87352d8f556d26795acd95e5efa023d4a1e9ac90

                                                                SHA512

                                                                46111cf95546f1a734b036a3bc1a757d7cb1873c8b68a3343fb1c989ad1aee7db99f9af5cb8b99c2166a98fc6a18cfd03bb274ef3f161998ce14d0ca30440a62

                                                                Download Submit

                                                              • C:\Windows\Temp\PreVer.log
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                8185f25db3eef2b84998db325227fdab

                                                                SHA1

                                                                464520678cdb54bf6f925a2235a7277e2400fe39

                                                                SHA256

                                                                5986b31256116cd01cd66cdcee2d9bb7ed63ef14a046b79f864bcb4deb465e60

                                                                SHA512

                                                                423815f11072535458f8e268cb4a1732b729987bb84c860f9c80713e114b941e8862a6dce705571a7c5e45ddd9339045e072aef6a74fb920486a050f002157b4

                                                                Download Submit

                                                              • C:\Windows\Temp\Tmp8373.tmp
                                                                Filesize

                                                                3KB

                                                                MD5

                                                                560af444a6a7faa0b0ca94dc16ca2a58

                                                                SHA1

                                                                df31453fafde354870a0a9a8ca50b18e284c32e4

                                                                SHA256

                                                                94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429

                                                                SHA512

                                                                7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681

                                                                Download Submit

                                                              • C:\Windows\Temp\__PSScriptPolicyTest_noncsg0l.5dg.ps1
                                                                Filesize

                                                                60B

                                                                MD5

                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                SHA1

                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                SHA256

                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                SHA512

                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                Download Submit

                                                              • C:\Windows\Temp\unpack.log
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                3d8e69656b80c9ef17647032b96ca85a

                                                                SHA1

                                                                911386a244a948fcbe899778a3b47a8014236fe8

                                                                SHA256

                                                                801eaf99818969467d9e9236c9d549557625ba89af4e08679e96d8edd1ace8ec

                                                                SHA512

                                                                0fc56e2f1e5fc1f66232610d0f11de8757cf04355db2dc2780271bbaa70bc55f8923a77c7224e624ae21eb9a66c0ebc77e6c552bfdd9b444b960ff96ba294d9d

                                                                Download Submit

                                                              • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                Filesize

                                                                3.2MB

                                                                MD5

                                                                2c18826adf72365827f780b2a1d5ea75

                                                                SHA1

                                                                a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                                SHA256

                                                                ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                                SHA512

                                                                474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                                Download Submit

                                                              • C:\Windows\Temp\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\IsConfig.ini
                                                                Filesize

                                                                571B

                                                                MD5

                                                                d239b8964e37974225ad69d78a0a8275

                                                                SHA1

                                                                cf208e98a6f11d1807cd84ca61504ad783471679

                                                                SHA256

                                                                0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                                SHA512

                                                                88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                                Download Submit

                                                              • C:\Windows\Temp\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\String1033.txt
                                                                Filesize

                                                                182KB

                                                                MD5

                                                                99bbffd900115fe8672c73fb1a48a604

                                                                SHA1

                                                                8f587395fa6b954affef337c70781ce00913950e

                                                                SHA256

                                                                57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                                SHA512

                                                                d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                                Download Submit

                                                              • C:\Windows\Temp\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\_is299C.exe
                                                                Filesize

                                                                179KB

                                                                MD5

                                                                7a1c100df8065815dc34c05abc0c13de

                                                                SHA1

                                                                3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                SHA256

                                                                e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                SHA512

                                                                bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                Download Submit

                                                              • C:\Windows\Temp\{D74F86D4-664B-4261-AE1E-4F1B7B7E7365}\setup.inx
                                                                Filesize

                                                                345KB

                                                                MD5

                                                                0376dd5b7e37985ea50e693dc212094c

                                                                SHA1

                                                                02859394164c33924907b85ab0aaddc628c31bf1

                                                                SHA256

                                                                c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                SHA512

                                                                69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                Download Submit

                                                              • C:\Windows\Temp\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\ISRT.dll
                                                                Filesize

                                                                427KB

                                                                MD5

                                                                85315ad538fa5af8162f1cd2fce1c99d

                                                                SHA1

                                                                31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                SHA256

                                                                70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                SHA512

                                                                877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                Download Submit

                                                              • C:\Windows\Temp\{E9AEA177-05CD-4DEB-8C08-E8EB904AE564}\_isres_0x0409.dll
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                befe2ef369d12f83c72c5f2f7069dd87

                                                                SHA1

                                                                b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                SHA256

                                                                9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                SHA512

                                                                760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                Download Submit

                                                              • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                Filesize

                                                                404B

                                                                MD5

                                                                ed7522b42c9947f65054159c3eebd87c

                                                                SHA1

                                                                aaaf4255271db1466f5c475e938482d91ba85796

                                                                SHA256

                                                                3b4b38da50c17c874429a5cb086bddb0d46da88141b480ef5f1da1d5b9da36d3

                                                                SHA512

                                                                f605138b8f8ee30f88f7410893274bf06e6948fd8a0815e0e4ee9fca4eabaee3a01ed95d49a0f6029cdba28ff862703c5ce4dc7176cdeb3ba906be3b00001b92

                                                                Download Submit

                                                              • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                Filesize

                                                                412B

                                                                MD5

                                                                f0b554d6a8425ddaaf898d17e473f4f6

                                                                SHA1

                                                                87ecc1811f69eb1e5255f04caed8759c46edce70

                                                                SHA256

                                                                882f952ff4d139a926055aabb3620ef0fb38c5c583fc664ea9360ae24fbf7954

                                                                SHA512

                                                                720475eed6ded838423a73b934961fc01449cfc7087748ffef3e63a3bca30f3f3c4c5ed52be5da452199d35ad3558fed2942698a0f5acdcd106ebab6481e1595

                                                                Download Submit

                                                              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                Filesize

                                                                24.1MB

                                                                MD5

                                                                921689707744bb6fce49953b8ee87382

                                                                SHA1

                                                                b95dde6e9997c79a4e46b33ef54f6dd5cd993cc3

                                                                SHA256

                                                                8fe7b8c788764c699bec694da5cb42c5e659f90859ea7764c538d970da7ff597

                                                                SHA512

                                                                5e807bfdba0575325e0e27aea0b61060bef145471cc92b7c1646544d7a2504241e8fecabdcee08de13431230a3e18c15c1932646d29cf16fa82ab47596f7cf4f

                                                                Download Submit

                                                              • \??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b1eee21a-fbfe-4478-94d5-e8f25b4698ac}_OnDiskSnapshotProp
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                1d4c8283c4247906a155ada669337660

                                                                SHA1

                                                                08272f6f3475f6f0ca2d00e2b9ea13d8ad0d536b

                                                                SHA256

                                                                52eea3754acbb6773e4a61e6ea85f4ee14df192bf278b22b5014708ed3cd4707

                                                                SHA512

                                                                4ad76ac9154d19e06e53b94697e8c3c2adcbb5ea709c0b96802e0905be54022498d8d4e9bd88e54e96a3d557f414f16e9403d7b99e9caeb0754355e2c07daf1a

                                                                Download Submit

                                                              • memory/216-112-0x00000000050B0000-0x0000000005116000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/624-357-0x0000029173920000-0x0000029173928000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/624-356-0x0000029173910000-0x0000029173918000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/624-347-0x0000029172E80000-0x0000029172EE4000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/624-352-0x00000291732D0000-0x00000291732D8000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/624-353-0x00000291732E0000-0x00000291732EA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/624-354-0x0000029174310000-0x00000291743EC000-memory.dmp

                                                                Filesize

                                                                880KB

                                                                Download

                                                              • memory/624-349-0x00000291732B0000-0x00000291732CC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/624-348-0x0000029173760000-0x00000291737AA000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/624-355-0x00000291743F0000-0x00000291744A2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/624-358-0x0000029173930000-0x0000029173938000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/624-359-0x00000291742A0000-0x0000029174308000-memory.dmp

                                                                Filesize

                                                                416KB

                                                                Download

                                                              • memory/624-360-0x0000029174260000-0x000002917428A000-memory.dmp

                                                                Filesize

                                                                168KB

                                                                Download

                                                              • memory/624-361-0x0000029174530000-0x000002917456A000-memory.dmp

                                                                Filesize

                                                                232KB

                                                                Download

                                                              • memory/624-362-0x0000029174230000-0x0000029174256000-memory.dmp

                                                                Filesize

                                                                152KB

                                                                Download

                                                              • memory/624-350-0x0000029174070000-0x00000291740BC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/624-351-0x00000291741E0000-0x0000029174228000-memory.dmp

                                                                Filesize

                                                                288KB

                                                                Download

                                                              • memory/1892-1140-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1892-1214-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/1892-1848-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/1892-2724-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1892-2725-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/1892-1847-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/1892-1141-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/1892-1213-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2464-1850-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/2464-1849-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2464-1151-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/2464-1150-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2572-1239-0x0000016A54360000-0x0000016A54412000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/2572-1447-0x0000016A54300000-0x0000016A54354000-memory.dmp

                                                                Filesize

                                                                336KB

                                                                Download

                                                              • memory/2572-1238-0x0000016A3BA60000-0x0000016A3BA7C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/2572-1237-0x0000016A3B1F0000-0x0000016A3B202000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/2920-1452-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/2920-4306-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/2920-4305-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2920-1450-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2920-1148-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2920-1149-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/2920-2912-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/2920-2913-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/3872-302-0x0000021E54360000-0x0000021E5437C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/3872-301-0x0000021E6CB90000-0x0000021E6CC42000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/3872-300-0x0000021E539E0000-0x0000021E539F6000-memory.dmp

                                                                Filesize

                                                                88KB

                                                                Download

                                                              • memory/4040-274-0x0000023BF7230000-0x0000023BF7260000-memory.dmp

                                                                Filesize

                                                                192KB

                                                                Download

                                                              • memory/4040-277-0x0000023BF83D0000-0x0000023BF8480000-memory.dmp

                                                                Filesize

                                                                704KB

                                                                Download

                                                              • memory/4040-278-0x0000023BF7AA0000-0x0000023BF7ABC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/4136-150-0x000001BC63510000-0x000001BC63538000-memory.dmp

                                                                Filesize

                                                                160KB

                                                                Download

                                                              • memory/4136-162-0x000001BC7DAE0000-0x000001BC7DB78000-memory.dmp

                                                                Filesize

                                                                608KB

                                                                Download

                                                              • memory/4136-167-0x000001BC7DA30000-0x000001BC7DA6C000-memory.dmp

                                                                Filesize

                                                                240KB

                                                                Download

                                                              • memory/4136-166-0x000001BC7D9D0000-0x000001BC7D9E2000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/4384-483-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4384-1011-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4384-486-0x0000000003870000-0x0000000003A37000-memory.dmp

                                                                Filesize

                                                                1.8MB

                                                                Download

                                                              • memory/4384-517-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4384-907-0x00000000038B0000-0x0000000003A77000-memory.dmp

                                                                Filesize

                                                                1.8MB

                                                                Download

                                                              • memory/4392-45-0x00000000027C0000-0x00000000027CC000-memory.dmp

                                                                Filesize

                                                                48KB

                                                                Download

                                                              • memory/4392-41-0x0000000002780000-0x00000000027AE000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/4500-82-0x0000000004AE0000-0x0000000004E34000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/4500-81-0x0000000002590000-0x00000000025B2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/4500-78-0x0000000004A20000-0x0000000004AD2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/4516-243-0x000001C7E9FD0000-0x000001C7EA008000-memory.dmp

                                                                Filesize

                                                                224KB

                                                                Download

                                                              • memory/4516-203-0x000001C7E9AD0000-0x000001C7E9B82000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/4516-204-0x000001C7E9930000-0x000001C7E9952000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/5108-1313-0x000001F6325B0000-0x000001F632662000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5108-1311-0x000001F6193A0000-0x000001F6193AC000-memory.dmp

                                                                Filesize

                                                                48KB

                                                                Download

                                                              • memory/5108-1312-0x000001F619780000-0x000001F619798000-memory.dmp

                                                                Filesize

                                                                96KB

                                                                Download

                                                              • memory/5108-1314-0x000001F619C10000-0x000001F619C30000-memory.dmp

                                                                Filesize

                                                                128KB

                                                                Download

                                                              • memory/5176-1858-0x00000217B5FD0000-0x00000217B60AC000-memory.dmp

                                                                Filesize

                                                                880KB

                                                                Download

                                                              • memory/5176-1857-0x00000217B5E30000-0x00000217B5EE2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5176-1743-0x000002179D3E0000-0x000002179D3FC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5176-1699-0x000002179D410000-0x000002179D45A000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5176-1674-0x000002179CA70000-0x000002179CA82000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/5200-1587-0x0000029263E00000-0x0000029263E0A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/5200-1856-0x000002927D640000-0x000002927DB68000-memory.dmp

                                                                Filesize

                                                                5.2MB

                                                                Download

                                                              • memory/5200-1588-0x0000029264760000-0x000002926477A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/5200-1694-0x000002927CF50000-0x000002927D002000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5232-1854-0x000001DE55C50000-0x000001DE55C6C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5232-1846-0x000001DE55CA0000-0x000001DE55CEA000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5232-1843-0x000001DE3CC10000-0x000001DE3CC20000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/5392-1727-0x000001C9D1380000-0x000001C9D13CA000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5392-1839-0x000001C9E9B60000-0x000001C9E9BAA000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5392-1770-0x000001C9D1210000-0x000001C9D122C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5392-1800-0x000001C9E9AA0000-0x000001C9E9AB8000-memory.dmp

                                                                Filesize

                                                                96KB

                                                                Download

                                                              • memory/5392-1801-0x000001C9D1230000-0x000001C9D123A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/5392-1725-0x000001C9D09A0000-0x000001C9D09D4000-memory.dmp

                                                                Filesize

                                                                208KB

                                                                Download

                                                              • memory/5436-1627-0x000001768D420000-0x000001768D45A000-memory.dmp

                                                                Filesize

                                                                232KB

                                                                Download

                                                              • memory/5436-1841-0x00000176A66B0000-0x00000176A66F8000-memory.dmp

                                                                Filesize

                                                                288KB

                                                                Download

                                                              • memory/5436-1813-0x00000176A6710000-0x00000176A67C2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5436-1816-0x000001768DD10000-0x000001768DD2C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5476-1815-0x000001F09E0E0000-0x000001F09E100000-memory.dmp

                                                                Filesize

                                                                128KB

                                                                Download

                                                              • memory/5476-1772-0x000001F09DF80000-0x000001F09DF90000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/5476-1810-0x000001F0B6920000-0x000001F0B69D2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5476-1771-0x000001F09D740000-0x000001F09D752000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/5788-1844-0x000001D4BDFD0000-0x000001D4BE080000-memory.dmp

                                                                Filesize

                                                                704KB

                                                                Download

                                                              • memory/5788-1636-0x000001D4A4C80000-0x000001D4A4C8C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                                Download

                                                              • memory/5788-1639-0x000001D4A5630000-0x000001D4A567A000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5788-1668-0x000001D4A55E0000-0x000001D4A55FC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5840-1851-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5840-1855-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/5840-1863-0x0000000072DC0000-0x0000000072EDC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5840-1864-0x00000000729F0000-0x0000000072DBD000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/6124-1820-0x0000017B68B30000-0x0000017B68B40000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/6124-1842-0x0000017B69370000-0x0000017B69390000-memory.dmp

                                                                Filesize

                                                                128KB

                                                                Download

                                                              • memory/6124-1853-0x0000017B69BC0000-0x0000017B69BD4000-memory.dmp

                                                                Filesize

                                                                80KB

                                                                Download

                                                              • memory/6124-1845-0x0000017B69C80000-0x0000017B69D32000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/6124-1852-0x0000017B6A5F0000-0x0000017B6A656000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download