Overview

overview

10

Static

static

10

setup.msi

windows7-x64

10

setup.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 20:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.msi

  • Size

    2.9MB

  • MD5

    b6cb6aab800ff92abe77fc8ae536c763

  • SHA1

    3ee9a797c6ebf0f7f1d290d1e36eef2a8c450af7

  • SHA256

    5ddf9fd9d9f094be8fcef49db058a84615473e3832f3c4dcecd70799ac86dae5

  • SHA512

    9bf347251fe162b863749c0828c2d36e60ee51fc6709d84243b75107c2092885412659d6bd48d1a564d030e6d0a9cefda089fb4c4625bf45c2a020d9ded6c5a3

  • SSDEEP

    49152:p+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:p+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2056
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3836
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A398387940413ECD0682BD4EAD67D2C6
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2064
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICB2F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634890 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2864
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICE3E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240635468 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4280
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID2A4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636640 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1800
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIDECE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639718 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2396
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E821EE99787992BB8F42719778136BDF E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5060
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1368
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="5" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="16" /AccountId="0013z00002jUQnnAAG" /AgentId="2c42d0d1-e522-48be-a7d5-c37ee9510a9e"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:4276
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 18A1B936B70B35978B801B2EDCE5D913 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1508
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA3559C7-FA02-428C-BD80-20FA7D6C6408}
          3⤵
          • Executes dropped EXE
          PID:3328
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{78AF88CE-1003-41A4-B7EE-4698ED448B12}
          3⤵
          • Executes dropped EXE
          PID:392
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB751EC8-6894-46CD-BD6D-48BE27B1CFE0}
          3⤵
          • Executes dropped EXE
          PID:4572
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89418EDB-B7C2-40B2-B9CD-522A227DA3B9}
          3⤵
          • Executes dropped EXE
          PID:2580
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{05608C30-12A7-49E0-BB89-63136087FE11}
          3⤵
          • Executes dropped EXE
          PID:3520
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{67F63C53-5059-43E8-8D58-D4FAA2A6B4DA}
          3⤵
          • Executes dropped EXE
          PID:1252
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{39865CEB-465D-4978-852B-FBDBE227B278}
          3⤵
          • Executes dropped EXE
          PID:5088
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8CFBF45-1D63-4AE6-8C09-38D0E4985E36}
          3⤵
          • Executes dropped EXE
          PID:2212
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BBD4D1B3-8F57-4271-A0E1-EC945294ADA6}
          3⤵
          • Executes dropped EXE
          PID:2324
        • C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe
          C:\Windows\TEMP\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_is538A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5EBF0BC8-B861-46CA-89A3-A6066092F6F0}
          3⤵
          • Executes dropped EXE
          PID:4940
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1236
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1016
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4148
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:848
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1264
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2420
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3064
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4572
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4304
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1820
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3460
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4608
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:216
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4940
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4928
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3416
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1360
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2284
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2472
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{12FE66DE-3C67-4D24-B16D-9C56698AE15A}
          3⤵
          • Executes dropped EXE
          PID:1432
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DFC7D936-0573-40FD-BBC6-A9F31136E2DE}
          3⤵
          • Executes dropped EXE
          PID:1700
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F22DAD0F-CE69-4055-BA75-6B5479C0D73C}
          3⤵
          • Executes dropped EXE
          PID:3452
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2BD8AB98-D766-476B-8472-0E676779C492}
          3⤵
          • Executes dropped EXE
          PID:3016
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E063F1DF-F087-4538-9F07-4CCEDB52AD2D}
          3⤵
          • Executes dropped EXE
          PID:4124
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B7A3E484-D834-458F-801F-D293F10DC3B7}
          3⤵
          • Executes dropped EXE
          PID:4308
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{54C0CE06-5BEA-406A-935E-CB3974E01120}
          3⤵
          • Executes dropped EXE
          PID:3492
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ED15EA2F-9268-4D3F-B991-ED44DF99CB45}
          3⤵
          • Executes dropped EXE
          PID:1484
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA60F2AF-8028-4C3E-86A9-C73820A96F07}
          3⤵
          • Executes dropped EXE
          PID:1312
        • C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
          C:\Windows\TEMP\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC1829EB-2E44-49DA-8640-FFB4AA2AEBD0}
          3⤵
          • Executes dropped EXE
          PID:2928
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AE7887EC-C21D-4483-8E45-A920B422B33C}
          3⤵
          • Executes dropped EXE
          PID:3688
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E620419-DDC2-459B-96D1-947B16518347}
          3⤵
          • Executes dropped EXE
          PID:3508
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{765E51AA-1ED2-43FE-B947-F682815C1F04}
          3⤵
          • Executes dropped EXE
          PID:3504
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B211A489-2D6C-4A18-A8C1-F0153BA18C43}
          3⤵
          • Executes dropped EXE
          PID:2468
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1AE681A9-D4AE-4860-B022-4C0CAC524BA2}
          3⤵
          • Executes dropped EXE
          PID:1252
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6DFC2C53-449E-4062-A6F9-5F89317E1B03}
          3⤵
          • Executes dropped EXE
          PID:2244
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B3B0A586-559C-4070-83A8-9619209D5E4E}
          3⤵
          • Executes dropped EXE
          PID:4508
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{295F1CE5-CE19-4385-8951-FACEE646BE83}
          3⤵
          • Executes dropped EXE
          PID:3520
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4FC12C1F-A446-4DF0-B6A4-B0C425C98565}
          3⤵
          • Executes dropped EXE
          PID:1432
        • C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe
          C:\Windows\TEMP\{CF6F3C11-70D1-4CDE-BC3B-9054894F92EE}\_is70D8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{253DE196-964C-4DC4-B290-D58B6C82C2F5}
          3⤵
          • Executes dropped EXE
          PID:1700
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1476
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4552
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4572
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:4036
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:4092
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4948
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{533D8ED4-E9FE-4483-96A1-DB44C2C4680C}
              3⤵
              • Executes dropped EXE
              PID:5068
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF6474F7-A615-4871-AD62-AC0946DC422F}
              3⤵
              • Executes dropped EXE
              PID:3140
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{14987511-2513-4EE6-B557-846A96A929FF}
              3⤵
              • Executes dropped EXE
              PID:2268
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9E2196F6-AF6A-4A9F-8B52-0FA42398452C}
              3⤵
              • Executes dropped EXE
              PID:1724
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{10A79332-6652-44E7-91B4-FFACAFC5E977}
              3⤵
              • Executes dropped EXE
              PID:3088
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92D8740C-91D2-4E20-A5ED-7F8DBE66297B}
              3⤵
              • Executes dropped EXE
              PID:4916
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CAFA55C9-6FE3-4D1D-9ACD-E66E99A31C8A}
              3⤵
              • Executes dropped EXE
              PID:2256
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{08D4CC9C-C3B4-4163-A53F-20A7AC7FD445}
              3⤵
              • Executes dropped EXE
              PID:2796
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3DA5B7B-3353-473F-AE55-26EBFEA721F9}
              3⤵
              • Executes dropped EXE
              PID:336
            • C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe
              C:\Windows\TEMP\{1F607D83-6BDD-44A3-BEF6-1D3351B609A2}\_is830A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2720F20A-65A4-445E-B489-4056136F615D}
              3⤵
              • Executes dropped EXE
              PID:4128
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2588
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41F0382D-A170-49F7-AD03-EFBB9E57F232}
              3⤵
              • Executes dropped EXE
              PID:3248
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E98D4E88-A33B-4AF9-B6A6-11A424F36AAB}
              3⤵
              • Executes dropped EXE
              PID:3080
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{80A9C065-180F-4B46-8DA4-74D60BB5BC7B}
              3⤵
              • Executes dropped EXE
              PID:4536
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6C8FDEF2-7142-4722-9E5D-40C442B96E18}
              3⤵
              • Executes dropped EXE
              PID:3588
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1E48F42F-49B5-4F0C-AB8B-0AD618129962}
              3⤵
              • Executes dropped EXE
              PID:4348
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3CE37C7D-B129-48A3-9B5D-381F342E2473}
              3⤵
              • Executes dropped EXE
              PID:116
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{30D7E8AB-AEB8-4CAD-890A-B3BC96560937}
              3⤵
              • Executes dropped EXE
              PID:2928
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4FC2397F-D72F-4F87-B3F4-C0152A5E2E8E}
              3⤵
              • Executes dropped EXE
              PID:2140
            • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
              C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{947E5584-A1A4-4011-BA41-0EE28002DB22}
              3⤵
                PID:436
              • C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe
                C:\Windows\TEMP\{093A720A-EF0F-4840-B9AA-3287D87FADE7}\_is8676.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6094E3C2-BFEF-4221-ADDA-5BDFD11815F5}
                3⤵
                  PID:3016
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1468
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:3248
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 8FAAE7ED0D5274ED92D669E7DD7C48E7 E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:216
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIABDD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240692593 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                    3⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5428
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIB053.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240693359 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5224
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIB96C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240695656 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                    3⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5140
                  • C:\Windows\SysWOW64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4252
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2812
                  • C:\Windows\SysWOW64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:1016
                  • C:\Windows\syswow64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4572
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5504
                  • C:\Windows\syswow64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:4384
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIE121.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240705796 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5304
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                  2⤵
                  • Drops file in System32 directory
                  PID:4652
                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="c63d057e-799d-4b44-8fce-b195427e88e5"
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:5928
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:4884
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:980
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:1568
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "9a0bbf36-2bb1-4122-bd64-481691736664" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002jUQnnAAG
                  2⤵
                  • Executes dropped EXE
                  PID:3604
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "def272ae-5082-4dc5-917c-3f976c91d52c" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002jUQnnAAG
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  PID:440
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "552a9478-d247-4ee2-be0b-f4a0bb76ea98" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 0013z00002jUQnnAAG
                  2⤵
                  • Drops file in Program Files directory
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2200
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2024
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:736
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "1f92baf0-e9e1-44b0-aad8-b10eb5f016c5" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 0013z00002jUQnnAAG
                  2⤵
                  • Executes dropped EXE
                  PID:3280
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "126a4168-b175-4a49-bd00-dc350a2380b0" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 0013z00002jUQnnAAG
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5076
                  • C:\Windows\TEMP\SplashtopStreamer.exe
                    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2428
                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:224
                      • C:\Windows\SysWOW64\msiexec.exe
                        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:2016
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "e9c776e5-6eef-49bb-bebb-597dbec2c340" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 0013z00002jUQnnAAG
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1388
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4216
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:3260
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "a9763701-f9c2-49a3-b44c-149536b23cbf" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002jUQnnAAG
                  2⤵
                  • Drops file in Program Files directory
                  • Modifies data under HKEY_USERS
                  PID:3508
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                      PID:5524
                      • C:\Windows\system32\cscript.exe
                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:4020
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "64ad1052-87ac-4aaf-a2d6-1501c9618a82" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002jUQnnAAG
                    2⤵
                    • Drops file in System32 directory
                    PID:4420
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                      3⤵
                        PID:5404
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "04d7edcb-9624-4a0f-8dc7-2eaefdae46e5" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:3492
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "6e562d82-8354-4c16-bd47-b2b4077bfb50" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      PID:3632
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "4655f719-d7fa-431e-a9d2-b4e59ba6d960" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in System32 directory
                      PID:5328
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                        3⤵
                        • System Time Discovery
                        PID:5172
                        • C:\Program Files\dotnet\dotnet.exe
                          dotnet --list-runtimes
                          4⤵
                          • System Time Discovery
                          PID:2596
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "193a567b-66b8-4ba2-99d9-7f622b6cca8f" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in Program Files directory
                      • Modifies data under HKEY_USERS
                      PID:5464
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "478eae8c-a939-4734-954e-2cb46847cc7c" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in System32 directory
                      • Modifies registry class
                      PID:5944
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "bde54059-ce32-4acc-b3bf-ad71c4e6b349" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in System32 directory
                      PID:6104
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "33c54435-40d3-4acf-8e16-8ae15670564b" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in System32 directory
                      PID:5568
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "4aebbd38-322e-4d64-a106-416dd68daee7" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 0013z00002jUQnnAAG
                      2⤵
                      • Drops file in System32 directory
                      PID:5284
                      • C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe
                        "C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e 4aebbd38-322e-4d64-a106-416dd68daee7 agent-api.atera.com/Production 443 or8ixLi90Mf connect 0013z00002jUQnnAAG
                        3⤵
                          PID:5212
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "a902f0dd-4525-4b6f-84cd-254e35d6ddfb" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002jUQnnAAG
                        2⤵
                        • Drops file in System32 directory
                        PID:5868
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "6a0a81ea-570e-4d1a-af2b-b890384272f8" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002jUQnnAAG
                        2⤵
                        • Writes to the Master Boot Record (MBR)
                        • Modifies data under HKEY_USERS
                        PID:2028
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "dc82acb3-2713-40a5-a586-497bb85aff01" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 0013z00002jUQnnAAG
                        2⤵
                          PID:2164
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "8fb4bca9-d496-4dae-bc08-335f74decc8f" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002jUQnnAAG
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          PID:5020
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "012406d2-666c-464e-b92b-b961d43e7886" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002jUQnnAAG
                          2⤵
                            PID:5500
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=ad8b9ecd089f5f5d9dd93effd70d36c3&rmm_session_pwd_ttl=86400"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:876
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1632
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                            2⤵
                            • Drops file in System32 directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:336
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                              -h
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:1156
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:3356
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                4⤵
                                  PID:5512
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:1528
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:4724
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                  SRUtility.exe -r
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3520
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:5488
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                  4⤵
                                    PID:4924
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ver
                                      5⤵
                                        PID:3180
                                      • C:\Windows\system32\sc.exe
                                        sc query ddmgr
                                        5⤵
                                        • Launches sc.exe
                                        PID:116
                                      • C:\Windows\system32\sc.exe
                                        sc query lci_proxykmd
                                        5⤵
                                        • Launches sc.exe
                                        PID:5872
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                        5⤵
                                        • Drops file in Windows directory
                                        • Checks SCSI registry key(s)
                                        PID:5724
                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                1⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:1308
                                • C:\Windows\System32\sc.exe
                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                  2⤵
                                  • Launches sc.exe
                                  PID:5344
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "a13f3703-445b-4093-bf9c-864b89dfc921" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002jUQnnAAG
                                  2⤵
                                    PID:5184
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "fdabf749-7c40-4134-b9ea-6d0446d3675d" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002jUQnnAAG
                                    2⤵
                                      PID:2512
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "d955c0a0-f705-4409-bbf9-d8fc040cdc30" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 0013z00002jUQnnAAG
                                      2⤵
                                        PID:728
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "2781ea61-cb1e-4e07-9166-256e369e6891" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002jUQnnAAG
                                        2⤵
                                        • Modifies data under HKEY_USERS
                                        PID:3340
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                          3⤵
                                            PID:4940
                                            • C:\Windows\system32\cscript.exe
                                              cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                              4⤵
                                              • Modifies data under HKEY_USERS
                                              PID:2520
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "6af4af63-58f7-4654-957c-3450ac903751" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002jUQnnAAG
                                          2⤵
                                          • Drops file in Program Files directory
                                          PID:6100
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "2e06ad1b-05a7-4a93-b073-1a1965755479" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002jUQnnAAG
                                          2⤵
                                            PID:5416
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "bb153014-b4f7-464c-8bd0-fd382981d3a9" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002jUQnnAAG
                                            2⤵
                                            • Writes to the Master Boot Record (MBR)
                                            PID:1236
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "80647f84-0a1c-462a-a3b0-dcc8ac41c066" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002jUQnnAAG
                                            2⤵
                                              PID:4556
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "1373aef8-dcb9-432b-821e-f82945e9ee8b" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002jUQnnAAG
                                              2⤵
                                                PID:5084
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                  3⤵
                                                  • System Time Discovery
                                                  PID:2196
                                                  • C:\Program Files\dotnet\dotnet.exe
                                                    dotnet --list-runtimes
                                                    4⤵
                                                    • System Time Discovery
                                                    PID:4672
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "f3a54194-aba7-43dc-afae-e41e16caefc1" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002jUQnnAAG
                                                2⤵
                                                  PID:2408
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "5fa46ff5-0386-4147-94f2-9f7422b7b4bb" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002jUQnnAAG
                                                  2⤵
                                                    PID:5196
                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=ad8b9ecd089f5f5d9dd93effd70d36c3&rmm_session_pwd_ttl=86400"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2596
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "e305ce97-df6d-4bb9-b0b2-c31503fe9299" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002jUQnnAAG
                                                    2⤵
                                                    • Drops file in Program Files directory
                                                    PID:980
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "9816ae5b-639e-495e-95a9-0ffa872339e6" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002jUQnnAAG
                                                    2⤵
                                                      PID:5160
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "2c42d0d1-e522-48be-a7d5-c37ee9510a9e" "9816ae5b-639e-495e-95a9-0ffa872339e6" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "0013z00002jUQnnAAG"
                                                        3⤵
                                                          PID:5416
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 2c42d0d1-e522-48be-a7d5-c37ee9510a9e "a5f7e442-2ab2-45be-bff8-6e36c03fe38b" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002jUQnnAAG
                                                        2⤵
                                                          PID:5492
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                        1⤵
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:2928
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "00000000000000FC" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:6132
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000016C" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:4708
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "000000000000016C"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:4124
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:5396

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Event Triggered Execution

                                                      2
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Installer Packages

                                                      1
                                                      T1546.016

                                                      Pre-OS Boot

                                                      1
                                                      T1542

                                                      Bootkit

                                                      1
                                                      T1542.003

                                                      Privilege Escalation

                                                      Event Triggered Execution

                                                      2
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Installer Packages

                                                      1
                                                      T1546.016

                                                      Defense Evasion

                                                      Modify Registry

                                                      1
                                                      T1112

                                                      Pre-OS Boot

                                                      1
                                                      T1542

                                                      Bootkit

                                                      1
                                                      T1542.003

                                                      Subvert Trust Controls

                                                      1
                                                      T1553

                                                      Install Root Certificate

                                                      1
                                                      T1553.004

                                                      System Binary Proxy Execution

                                                      1
                                                      T1218

                                                      Msiexec

                                                      1
                                                      T1218.007

                                                      Credential Access

                                                      Discovery

                                                      Peripheral Device Discovery

                                                      2
                                                      T1120

                                                      Query Registry

                                                      4
                                                      T1012

                                                      System Information Discovery

                                                      3
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Time Discovery

                                                      1
                                                      T1124

                                                      Lateral Movement

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Config.Msi\e57ca85.rbs
                                                        Filesize

                                                        8KB

                                                        MD5

                                                        ca6c59b22db3642d0e1b2e64756bba73

                                                        SHA1

                                                        9019d163a81bf3aaa56c29f81ebf8e42f6bd8877

                                                        SHA256

                                                        2fb16d2ef9158191cbe904a7b7412b8c5e187cb77df9a4ed291783ff841c4ecd

                                                        SHA512

                                                        0b6c0cfc38e967963c166446b6bff4440db5f4b374d3cc831a1410b72a4cb9c9bf49cc5428ac84b3e2d7943aca3eb5ec53f45bd5309240d0a017d088f459bd56

                                                        Download Submit

                                                      • C:\Config.Msi\e57ca8a.rbs
                                                        Filesize

                                                        74KB

                                                        MD5

                                                        a33addedcd3de3d6e3155d48a07bf3f5

                                                        SHA1

                                                        4e71dbf43705623f35da3c0ca17b95d5f8c900c7

                                                        SHA256

                                                        aa2e961a48ab7624608e43053f1d5a12f7fb18a604e5d672c3c708d7d197deec

                                                        SHA512

                                                        d2b78ad63132b6bfeaa02f75ee5ada2961dae0ee8c79153401afa1b1f8b50b577680cb1b52ea6220942adb332367d284894c8fb9822a8cde0f02d44a73cdc7f6

                                                        Download Submit

                                                      • C:\Config.Msi\e57ca8c.rbs
                                                        Filesize

                                                        464B

                                                        MD5

                                                        053082021424586664adb1a85bb96a15

                                                        SHA1

                                                        e8752ec50d2f02c6aaa1b9d69a15ec344fbe6750

                                                        SHA256

                                                        510605cb626611bcee2585006fb9732c59713ce9243069603812cb3e06fc1843

                                                        SHA512

                                                        8f4526796ea2ce33b687fd3fb3ce6a2c7215e5acd1f98fcd68649ca19d26501ce56d1aa8225445a6cc9d989e6fc117a53d38979eb7dfd3a3e42b9ff69627439d

                                                        Download Submit

                                                      • C:\Config.Msi\e57ca92.rbs
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        2c200685ce0711dbdc995420c54b723b

                                                        SHA1

                                                        c7afe6f8052acbd96ba43071989972373e105f58

                                                        SHA256

                                                        3c3ec4b6adac8fd48323c3f0446df713e2b0ff9ae2a4f84d9b62677d89642eb7

                                                        SHA512

                                                        e1d008e0815aeb88aaac8145b2e98c50521d880273662ea563171aa0a5c6aabbb2c4b5acfce5035f08661ff0d7d39f28fe531b6cd287be33573aa1ff1eaf963a

                                                        Download Submit

                                                      • C:\Config.Msi\e57ca9a.rbs
                                                        Filesize

                                                        8KB

                                                        MD5

                                                        33a69c2ae18b715f4d50e1d4c74ab9c2

                                                        SHA1

                                                        eb5a95323099925a6915a7eccca2020d55c78ef8

                                                        SHA256

                                                        e501e638d5b2f145fb1ba888f46118ff9e67e1deab93eda5beff22ffdce59aef

                                                        SHA512

                                                        58002fc07879f8e3179200df8a2690cdc743b5bf2099a79a02c23ceea642f3bb65a05a609818676495355442cbeea6dca4f044b644c23a973dd8d00d05ced9d8

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3840b31c383fdf49bfd6740d945c9032

                                                        SHA1

                                                        a6f50164a69718bcef4664d7c47534f0d721866a

                                                        SHA256

                                                        1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                        SHA512

                                                        f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                        Filesize

                                                        142KB

                                                        MD5

                                                        477293f80461713d51a98a24023d45e8

                                                        SHA1

                                                        e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                        SHA256

                                                        a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                        SHA512

                                                        23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        b3bb71f9bb4de4236c26578a8fae2dcd

                                                        SHA1

                                                        1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                        SHA256

                                                        e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                        SHA512

                                                        fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                        Filesize

                                                        210KB

                                                        MD5

                                                        c106df1b5b43af3b937ace19d92b42f3

                                                        SHA1

                                                        7670fc4b6369e3fb705200050618acaa5213637f

                                                        SHA256

                                                        2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                        SHA512

                                                        616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                        Filesize

                                                        693KB

                                                        MD5

                                                        2c4d25b7fbd1adfd4471052fa482af72

                                                        SHA1

                                                        fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                        SHA256

                                                        2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                        SHA512

                                                        f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                        Filesize

                                                        158KB

                                                        MD5

                                                        1922740d2479c7d0cd6fb57c3d739543

                                                        SHA1

                                                        877a807a396156be1d0c2782391cabc29ea15760

                                                        SHA256

                                                        20443f66e184311fd412158cb162e36b0172332cd6d401cec9ee5fe17df75e58

                                                        SHA512

                                                        d624bad0fcd8afc190a5de241da341a3f39d6aaa0e5eacdf8b14e8e74515b688f06e2cdc75da0634880ea98238a1d26cd2d2bfaedb6d92067dace99d0963975c

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\data\iot_conf.json
                                                        Filesize

                                                        189B

                                                        MD5

                                                        6f4ad3d43e4fe851d21116ced58b0abe

                                                        SHA1

                                                        2bf78df532e4f7372e67a735dfa69d3300214be0

                                                        SHA256

                                                        519b433fbd011727873c06cb73fd3111ca9d211ceb9ed1bdef61f68ca98edb85

                                                        SHA512

                                                        c7f87c87adfaace74a8010c685bf91c92d1795abf171c573b12908132bbd809eb1c79b1bd8e744e350818236914df4589af49e464673290ca45e81a220d6e4e1

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                        Filesize

                                                        157KB

                                                        MD5

                                                        63f830bc220b8af1381f2210fdf6a258

                                                        SHA1

                                                        5651a89b75ba320ba3133826c9fca7f5baa0fbbb

                                                        SHA256

                                                        a82eec1added638aa86d4e66f3b3789e8f7e40a15d0be3b01fbe50ca85b99f9c

                                                        SHA512

                                                        ae2884f99833f11a5ce73843bb675de13c3dd362602352b3e8d3f6815bc03fb9a681f0adfeb677fa575bf3395734fc9e07ea05896e8698f875f7a6b01276a31c

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                        Filesize

                                                        51KB

                                                        MD5

                                                        3180c705182447f4bcc7ce8e2820b25d

                                                        SHA1

                                                        ad6486557819a33d3f29b18d92b43b11707aae6e

                                                        SHA256

                                                        5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                        SHA512

                                                        228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                        Filesize

                                                        12B

                                                        MD5

                                                        eb053699fc80499a7185f6d5f7d55bfe

                                                        SHA1

                                                        9700472d22b1995c320507917fa35088ae4e5f05

                                                        SHA256

                                                        bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                        SHA512

                                                        d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                        Filesize

                                                        173KB

                                                        MD5

                                                        fd9df72620bca7c4d48bc105c89dffd2

                                                        SHA1

                                                        2e537e504704670b52ce775943f14bfbaf175c1b

                                                        SHA256

                                                        847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                        SHA512

                                                        47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                        Filesize

                                                        546B

                                                        MD5

                                                        158fb7d9323c6ce69d4fce11486a40a1

                                                        SHA1

                                                        29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                        SHA256

                                                        5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                        SHA512

                                                        7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        Filesize

                                                        27KB

                                                        MD5

                                                        797c9554ec56fd72ebb3f6f6bef67fb5

                                                        SHA1

                                                        40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                        SHA256

                                                        7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                        SHA512

                                                        4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                        Filesize

                                                        214KB

                                                        MD5

                                                        01807774f043028ec29982a62fa75941

                                                        SHA1

                                                        afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                        SHA256

                                                        9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                        SHA512

                                                        33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                        Filesize

                                                        37KB

                                                        MD5

                                                        efb4712c8713cb05eb7fe7d87a83a55a

                                                        SHA1

                                                        c94d106bba77aecf88540807da89349b50ea5ae7

                                                        SHA256

                                                        30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                        SHA512

                                                        3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                        Filesize

                                                        3.4MB

                                                        MD5

                                                        e010d1f614b1a830482d3df4ba056f24

                                                        SHA1

                                                        5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                        SHA256

                                                        98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                        SHA512

                                                        727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                        Filesize

                                                        389KB

                                                        MD5

                                                        5e3252e0248b484e76fcdbf8b42a645d

                                                        SHA1

                                                        11ae92fd16ac87f6ab755911e85e263253c16516

                                                        SHA256

                                                        01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                        SHA512

                                                        540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                        Filesize

                                                        48KB

                                                        MD5

                                                        a0f66604ca170cdd5dacb1de1bdc3d1f

                                                        SHA1

                                                        69ced250a1ad4aefd91cc4cf9327cf11433b335f

                                                        SHA256

                                                        2e6d3c17b5ca7986c4e346d1b4a68fef22a81b5130cf56b3b5b14c27618e8fc2

                                                        SHA512

                                                        069c8b95d673adc7b0b18908a37f8d602792107da85e0e532a4b17981c948e4b5a4b705a23766e5492a9e042a10c042ee9bb890ff1ea458936f6dc43d0c09d4f

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                        Filesize

                                                        196KB

                                                        MD5

                                                        680bac4393da4dafe0100d9483d3b6e4

                                                        SHA1

                                                        ed211ef61232c5aacee7ca168659f02f9d4f4e53

                                                        SHA256

                                                        c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                                                        SHA512

                                                        5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                        Filesize

                                                        56KB

                                                        MD5

                                                        0f33a7acb33960d1306ba418405d8264

                                                        SHA1

                                                        bc24c37727b00d514446c8b5fb6c04f36254a067

                                                        SHA256

                                                        a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                        SHA512

                                                        72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        9d1528a2ce17522f6de064ae2c2b608e

                                                        SHA1

                                                        2f1ce8b589e57ab300bb93dde176689689f75114

                                                        SHA256

                                                        11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                        SHA512

                                                        a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5464.update
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        14ffcf07375b3952bd3f2fe52bb63c14

                                                        SHA1

                                                        ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                        SHA256

                                                        6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                        SHA512

                                                        14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                        Filesize

                                                        7KB

                                                        MD5

                                                        3ce7ece8e1bb9a4d9b00afc79f4818d8

                                                        SHA1

                                                        66c761833faccf63670632374c21ec71908fbdce

                                                        SHA256

                                                        a3d5cfccf953791068cbae3bf4a463d61597f21f8fae5d57ff4ad997fa4b20e5

                                                        SHA512

                                                        7559ec66f8db282d62413907b6046e5bc8ad17068f49f0c0af19621588802d09a4394a6ee3e5a5edb4406c0a2c26fbdcc8aa5e2e82ac32995fe4d5878d0ae855

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                        Filesize

                                                        2B

                                                        MD5

                                                        81051bcc2cf1bedf378224b0a93e2877

                                                        SHA1

                                                        ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                        SHA256

                                                        7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                        SHA512

                                                        1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                        Filesize

                                                        54KB

                                                        MD5

                                                        77c613ffadf1f4b2f50d31eeec83af30

                                                        SHA1

                                                        76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                        SHA256

                                                        2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                        SHA512

                                                        29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                        Filesize

                                                        334KB

                                                        MD5

                                                        2e2e6e6702fa92da8c08fa85617fa861

                                                        SHA1

                                                        bee96d85e39faa0d6f60fc797e0c4f0e9c01ed67

                                                        SHA256

                                                        565bbd4ed69c929cb00ce6552633382bfe46248b6e9db3293b9c031875c02b35

                                                        SHA512

                                                        35eaf569f94c69749308d30722589331ea1957f3a11f440b1eccc4aa32284681162128b2febef76c75181b49e5e57d780685a22e14e1900ffc7add3f83ac075e

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                        Filesize

                                                        71KB

                                                        MD5

                                                        5129e29d4d9a8ed94e04099622316b37

                                                        SHA1

                                                        be1c537ad5fc51bd28bd3ea23e16cbfbdaf01dfd

                                                        SHA256

                                                        17c1a413747e1dbf203f1824e45ddc0dc7afe4c529bca88cdb670f019d95db11

                                                        SHA512

                                                        7b8a1d79c069cdcbebd57255d11d96e13e291df8b99c15d6c969a66ef8af8639fac92e22b233b4b6f8b33a9c52ba2936fe59ecee2acf78c571f4920ea075e4bb

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                        Filesize

                                                        50KB

                                                        MD5

                                                        254dcbee3213189461b66e962ce8cc05

                                                        SHA1

                                                        cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                                                        SHA256

                                                        e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                                                        SHA512

                                                        7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                        Filesize

                                                        32KB

                                                        MD5

                                                        db1db66ebd9b15b7dcd55374ea56ee5e

                                                        SHA1

                                                        c22897eb20900a66cf62023c37d6a7d1192aec3d

                                                        SHA256

                                                        0263a627bbea55a66deecd7a43f8537bb68b5f95bb3d4269d3e594bd1d851e64

                                                        SHA512

                                                        b56b2143a60e6153e7fb752029c72d78547d5253f32ecbd0dda5a8acc5c3859292e860162b11a041a37b4f618f4425484b4e2385d7e2c621c8cbced073e3a67e

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                        Filesize

                                                        56KB

                                                        MD5

                                                        e9794f785780945d2dde78520b9bb59f

                                                        SHA1

                                                        293cae66cedbc7385cd49819587d3d5a61629422

                                                        SHA256

                                                        0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                                                        SHA512

                                                        1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                        Filesize

                                                        588KB

                                                        MD5

                                                        17d74c03b6bcbcd88b46fcc58fc79a0d

                                                        SHA1

                                                        bc0316e11c119806907c058d62513eb8ce32288c

                                                        SHA256

                                                        13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                        SHA512

                                                        f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                        Filesize

                                                        211B

                                                        MD5

                                                        3893583ea2acd0819ad77a1b3b6b62fd

                                                        SHA1

                                                        8ee39df76adeda0394d484f8439239de521aeec1

                                                        SHA256

                                                        51c2a6fb77fc07cd6a25790d52456cd889b5c972b0627658d22027cad945bf6f

                                                        SHA512

                                                        c6a81db47879858900cb9472f25dd34a4cb5b5fdfbcd93504a5269001387097b38f1f31f9d709caaf10c07b588f9aad92c70d817b9a7683c91cca6846a45b448

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        1ef7574bc4d8b6034935d99ad884f15b

                                                        SHA1

                                                        110709ab33f893737f4b0567f9495ac60c37667c

                                                        SHA256

                                                        0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                        SHA512

                                                        947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        f512536173e386121b3ebd22aac41a4e

                                                        SHA1

                                                        74ae133215345beaebb7a95f969f34a40dda922a

                                                        SHA256

                                                        a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                        SHA512

                                                        1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                        Filesize

                                                        76KB

                                                        MD5

                                                        b40fe65431b18a52e6452279b88954af

                                                        SHA1

                                                        c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                        SHA256

                                                        800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                        SHA512

                                                        e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                        Filesize

                                                        80KB

                                                        MD5

                                                        3904d0698962e09da946046020cbcb17

                                                        SHA1

                                                        edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                        SHA256

                                                        a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                        SHA512

                                                        c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                        Filesize

                                                        96KB

                                                        MD5

                                                        0eed60ea15ffc9fc854976485d651b34

                                                        SHA1

                                                        3af88f44470cba4cd11b29b53b407e2a56fc37ff

                                                        SHA256

                                                        ce98aa7258fda318dad6c2f794e8fb2b42beae669ae253c2181f7a6b3d3a0042

                                                        SHA512

                                                        cfcb05a737ea253ac1e24600cdf5b1eea1959ab64458ec835afa3aeb9c8ba63b46a117ccd73e648717b6e3c6dc1b407dad09c0334cde5bb9ffb20202120e9460

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                        Filesize

                                                        433B

                                                        MD5

                                                        cf5f69533151675ab4f248fbc8cdedeb

                                                        SHA1

                                                        eb736e17118ac79e341b49eb29ea04433e65e66f

                                                        SHA256

                                                        e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                        SHA512

                                                        e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                        Filesize

                                                        717B

                                                        MD5

                                                        ef0a07aec4367a64c16c581da2657aa9

                                                        SHA1

                                                        13011a5abcbadb3424fb6ecee560665556bb1d24

                                                        SHA256

                                                        f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                        SHA512

                                                        35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                        Filesize

                                                        7KB

                                                        MD5

                                                        362ce475f5d1e84641bad999c16727a0

                                                        SHA1

                                                        6b613c73acb58d259c6379bd820cca6f785cc812

                                                        SHA256

                                                        1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                        SHA512

                                                        7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                        Filesize

                                                        1.9MB

                                                        MD5

                                                        dc34fb149320b8344ef62548a634f290

                                                        SHA1

                                                        d5008caa155335ec563e47f00ab83c1b87ac732a

                                                        SHA256

                                                        5caeaa7a9f680c9e332d445b2a0b1679e028fe92ad3ed713c51a24acfc1eaed4

                                                        SHA512

                                                        97ccdbbff6b6ea6b644cabc285c0e6147c43f9b3fa451a8b7851fd0664dc9504fffe3223205f11ce2b3d6ba816891393a86aeecf86bd6daf06c889421a91192b

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                        Filesize

                                                        1.1MB

                                                        MD5

                                                        9a9b1fd85b5f1dcd568a521399a0d057

                                                        SHA1

                                                        34ed149b290a3a94260d889ba50cb286f1795fa6

                                                        SHA256

                                                        88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                        SHA512

                                                        7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                        Filesize

                                                        375KB

                                                        MD5

                                                        4a09a87d2004dac4b00687e9c9f15036

                                                        SHA1

                                                        c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                                                        SHA256

                                                        2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                                                        SHA512

                                                        f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                        Filesize

                                                        321KB

                                                        MD5

                                                        d3901e62166e9c42864fe3062cb4d8d5

                                                        SHA1

                                                        c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                        SHA256

                                                        dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                        SHA512

                                                        ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                        Filesize

                                                        814KB

                                                        MD5

                                                        9b1f97a41bfb95f148868b49460d9d04

                                                        SHA1

                                                        768031d5e877e347a249dfdeab7c725df941324b

                                                        SHA256

                                                        09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                        SHA512

                                                        9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                        Filesize

                                                        1.2MB

                                                        MD5

                                                        e74d2a16da1ddb7f9c54f72b8a25897c

                                                        SHA1

                                                        32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                        SHA256

                                                        a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                        SHA512

                                                        52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                        Filesize

                                                        11B

                                                        MD5

                                                        5eda46a55c61b07029e7202f8cf1781c

                                                        SHA1

                                                        862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                        SHA256

                                                        12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                        SHA512

                                                        4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                        Filesize

                                                        12B

                                                        MD5

                                                        5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                        SHA1

                                                        93012724e6cc0a298838aede678806e6c0c6517d

                                                        SHA256

                                                        a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                        SHA512

                                                        890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                        Filesize

                                                        48KB

                                                        MD5

                                                        b4a865268d5aca5f93bab91d7d83c800

                                                        SHA1

                                                        95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                        SHA256

                                                        5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                        SHA512

                                                        c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                        Filesize

                                                        48KB

                                                        MD5

                                                        d8b759b4fd929167b9fc710f266ff240

                                                        SHA1

                                                        84f03f6b51515d0a4fb9e8ef5c4971deb331eff6

                                                        SHA256

                                                        5f8b02f483e92a38667edf06f9b812151adb2bd02ff452ac2e2797538e96bd02

                                                        SHA512

                                                        e46152180f87bd7bac7b6e1e92d5290bac310f28d9021019fe9be32f7ffdd3cba2f6829af7ed2720ed128f029f090f28a28b5e5368ad570dd4097f4d33a9677a

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                        Filesize

                                                        2.8MB

                                                        MD5

                                                        a7bf0da8e308248aefd69586e1f8a312

                                                        SHA1

                                                        f1df1b8f00087260c9c7c2ba46cb98903f98bf73

                                                        SHA256

                                                        b8c4a5ec9357ace0e98bf2e7550d691af280a387fc9636260ea6bc2c2b5b6ba6

                                                        SHA512

                                                        e9edd7b668136e3a16b070c13bedb5465ab1cee02cc84f84f40a80aca12cd3ce2a781724f53fecae891a390fc257bec727fb6e4756f644597785ff21107071fd

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                        Filesize

                                                        2.9MB

                                                        MD5

                                                        7805ea1a8dd15cac328b826efe38c2a9

                                                        SHA1

                                                        66ff8eafb2424717c4394bae28a8683db1244527

                                                        SHA256

                                                        7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                                                        SHA512

                                                        17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                        Filesize

                                                        1.1MB

                                                        MD5

                                                        6c6f85e896655a6eb726482f04c49086

                                                        SHA1

                                                        2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                        SHA256

                                                        e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                        SHA512

                                                        b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                        Filesize

                                                        541B

                                                        MD5

                                                        d0efb0a6d260dbe5d8c91d94b77d7acd

                                                        SHA1

                                                        e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                        SHA256

                                                        7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                        SHA512

                                                        a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                        Filesize

                                                        12B

                                                        MD5

                                                        213da2b23ec7ec5259829958b2cf42be

                                                        SHA1

                                                        5b7dfb867ed116395f0c8d8299d7357e1f5355fc

                                                        SHA256

                                                        eb70db8191a629c3c2a53d07ee68ce9e4a906defd701b4a08cab8a410df29457

                                                        SHA512

                                                        2b5500f9062c8c44ee4bb2ba81f4b0f948e07c1182525fbdc72a1ab6e304055e04100cce41dc3e68a7cec3557ed39a755eb1ef38e3db6cf56102f5a20e6601d2

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                        Filesize

                                                        646KB

                                                        MD5

                                                        0e6af651f8be91dc9dde2faab59c9a77

                                                        SHA1

                                                        f199693bb55864f8497227c1c14244ff3e6e423e

                                                        SHA256

                                                        895f2593cf3f365046f33e9cf5ebcb2a17e7af1c592decc82bfe8ff5d5653a20

                                                        SHA512

                                                        fd770888310dd2e58124eae49bdc6e715fde9b100010ef224e10f6a757629c2c55d12c0e4cede3f8cf8e89d1267e4820c9bf82df5f6263675ecc3596895da4af

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                        Filesize

                                                        3.1MB

                                                        MD5

                                                        ff671b6085ba35e1bbebd5d2389ab7d6

                                                        SHA1

                                                        d7719a66e303c4e854faba873b781e0084f36998

                                                        SHA256

                                                        4f2a43098f6eff50a03fde9e134a4c8b7df6fe7e9a9c6913afeefe0deeb1463e

                                                        SHA512

                                                        f5a63eeb6a239d7be9935ceb1240aae7c9f3a8d5740d665b5fde6f28a7667feb345f88bc440ebe7d6a0512b448f4e3772a49823bc6ad8ba7372e0a31b5f9f200

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                        Filesize

                                                        570KB

                                                        MD5

                                                        b50834694383960830cf48d9836e1108

                                                        SHA1

                                                        adc80813181b98a8296befa2960a55f939f3bfee

                                                        SHA256

                                                        370a259808052366888284b0cc4c91ff8f23e8008003959b8d0efb1adbf00cd6

                                                        SHA512

                                                        f87be933e87275b000be031aa5df7536dfd5fe9b99a607ce0904f206e074d3a0687a00654b9b78edaa2fccf3d30526e0ee5bd7dcba4a5daafd6fc60eeaaa15c5

                                                        Download Submit

                                                      • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\4324aaf6bf33692bae0fd64fb8bfc200
                                                        Filesize

                                                        16KB

                                                        MD5

                                                        b2e89027a140a89b6e3eb4e504e93d96

                                                        SHA1

                                                        f3b1b34874b73ae3032decb97ef96a53a654228f

                                                        SHA256

                                                        5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                        SHA512

                                                        93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                        Download Submit

                                                      • C:\ProgramData\chocolatey\config\chocolatey.config
                                                        Filesize

                                                        809B

                                                        MD5

                                                        8b6737800745d3b99886d013b3392ac3

                                                        SHA1

                                                        bb94da3f294922d9e8d31879f2d145586a182e19

                                                        SHA256

                                                        86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                        SHA512

                                                        654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                        Download Submit

                                                      • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                        Filesize

                                                        12KB

                                                        MD5

                                                        d4bfdcd1c960d17db20005c1d8448c7a

                                                        SHA1

                                                        bb8e333d9a63f0afbf05d434fb4d60f5c7da2fd3

                                                        SHA256

                                                        b9697a85cf64b5c97cda630792b7ac5c5d4a56000ed984ac508e4fab8524d969

                                                        SHA512

                                                        1a2cc1ceff530e532a53772940b96b124b933e559760188a8ce71ff7eb064d4f4de70117eade09484c02b9a64d0f5a3d4bb6b143ba1aa4d2e439315d61fe6077

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                        Filesize

                                                        471B

                                                        MD5

                                                        b6102b47f3d2450f02c1167e5b337e9b

                                                        SHA1

                                                        91a6e5d7b3540556c971bcd6cdf52abd2cffcbfe

                                                        SHA256

                                                        e0c2d57c8661d444666ae009725ee84cd33a29ac48738277ea37bfd56b3cf8c4

                                                        SHA512

                                                        62bb67b325b56c41544956928ef0991262df019a470fc5792ba5abb7096e419f7ea3c8326560ffbe2b50ed0612fbc968fdf7564793a4d550b2465b799cbfcedf

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                        Filesize

                                                        727B

                                                        MD5

                                                        a433d0bd40ae75fbd372efe3fd3e2bc6

                                                        SHA1

                                                        137005873f5a1d269a7047adbcd08f5d204a323b

                                                        SHA256

                                                        83599ee2c90c3ef5da0f1d87bb6155bdcd2e70b97ad2163e4247f74f0925e1ec

                                                        SHA512

                                                        dca032c59d56db32821d19d913cb7519fbc0545bdc5b19cc6ca9eebf2faa8dca9739d4190b269c34438bca85879a271108f0641c2b653df37f08bfb9224150cb

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                        Filesize

                                                        727B

                                                        MD5

                                                        1dc1121e24814ab2e9102c631f6368e5

                                                        SHA1

                                                        55f7935319102e893d0df7ba28c35343456300ee

                                                        SHA256

                                                        8ed09687565336351ef88085dcf6cfc841af12a63433ecc12c2f13a9557c3c59

                                                        SHA512

                                                        132158f8f2bdf5d66cd4f3fed37405027d4233c79a365027e5d8d0ea20c5d23805bd298358df371b625486282867ba93a3ff5945dddf3ae8d91dd2630e477df4

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                        Filesize

                                                        400B

                                                        MD5

                                                        c1701310ff4d237014e71ac717b23cf9

                                                        SHA1

                                                        08218e91f5b0fcde0edf064e76905acaf34cac32

                                                        SHA256

                                                        fb960c7f38df44e902a0535b3bb8a945a84bf144b5a1c80a8f49d365701552e6

                                                        SHA512

                                                        683314a01b02b9fa519dabdf350e7dbafc66a165d70de57e01ebdc2fccd8e5b5bf73bdb0b758bfde5c3d60c24ecc2e4b79641ffbe26b128ccbbf38d9329e41b8

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                        Filesize

                                                        404B

                                                        MD5

                                                        11df38fa5b661b8f9423789fa11b9a51

                                                        SHA1

                                                        9eb670cf6b20f59ce516d4edae9cb19f6bab2364

                                                        SHA256

                                                        3cd463c9512e5928eaef447c269b59e016b7a18fad348d43755d83ab451fced2

                                                        SHA512

                                                        deb480ce4ddfd727f94f9f34a8179d8e1b8ecf5bdc45348866c9b20f7d4a752d56fce6bd9739741d83efb1c67ee4ad4efe49ae5114f9ae1df3e36d6628858914

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                        Filesize

                                                        412B

                                                        MD5

                                                        3a6693f43d52191f56dc4a5ae2d02056

                                                        SHA1

                                                        686e425d88997835d97523467d16a57e9fe4d96b

                                                        SHA256

                                                        91df19a03e8a14c6c792dc7df3f492eddc9603e6afbf3e2f027b9c619aaa7462

                                                        SHA512

                                                        f6cdd85bbcc27a97ce7517596274bf9808787ebfb02bcbd399c8b609b625abb65d38ab0a6e90d48ed0f54133399adc4dbd20556ebf5ab4699751800542922792

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                        Filesize

                                                        651B

                                                        MD5

                                                        9bbfe11735bac43a2ed1be18d0655fe2

                                                        SHA1

                                                        61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                        SHA256

                                                        549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                        SHA512

                                                        a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                        Download Submit

                                                      • C:\Windows\Installer\MSI7028.tmp
                                                        Filesize

                                                        4.5MB

                                                        MD5

                                                        08211c29e0d617a579ffa2c41bde1317

                                                        SHA1

                                                        4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                        SHA256

                                                        3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                        SHA512

                                                        d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                        Download Submit

                                                      • C:\Windows\Installer\MSIABDD.tmp-\System.Management.dll
                                                        Filesize

                                                        60KB

                                                        MD5

                                                        878e361c41c05c0519bfc72c7d6e141c

                                                        SHA1

                                                        432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                        SHA256

                                                        24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                        SHA512

                                                        59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                        Download Submit

                                                      • C:\Windows\Installer\MSICB2F.tmp
                                                        Filesize

                                                        509KB

                                                        MD5

                                                        88d29734f37bdcffd202eafcdd082f9d

                                                        SHA1

                                                        823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                        SHA256

                                                        87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                        SHA512

                                                        1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                        Download Submit

                                                      • C:\Windows\Installer\MSICB2F.tmp-\AlphaControlAgentInstallation.dll
                                                        Filesize

                                                        25KB

                                                        MD5

                                                        aa1b9c5c685173fad2dabebeb3171f01

                                                        SHA1

                                                        ed756b1760e563ce888276ff248c734b7dd851fb

                                                        SHA256

                                                        e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                        SHA512

                                                        d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                        Download Submit

                                                      • C:\Windows\Installer\MSICB2F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                        Filesize

                                                        179KB

                                                        MD5

                                                        1a5caea6734fdd07caa514c3f3fb75da

                                                        SHA1

                                                        f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                        SHA256

                                                        cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                        SHA512

                                                        a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                        Download Submit

                                                      • C:\Windows\Installer\MSICE3E.tmp-\CustomAction.config
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        bc17e956cde8dd5425f2b2a68ed919f8

                                                        SHA1

                                                        5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                        SHA256

                                                        e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                        SHA512

                                                        02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                        Download Submit

                                                      • C:\Windows\Installer\MSICE3E.tmp-\Newtonsoft.Json.dll
                                                        Filesize

                                                        695KB

                                                        MD5

                                                        715a1fbee4665e99e859eda667fe8034

                                                        SHA1

                                                        e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                        SHA256

                                                        c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                        SHA512

                                                        bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                        Download Submit

                                                      • C:\Windows\Installer\MSID47A.tmp
                                                        Filesize

                                                        211KB

                                                        MD5

                                                        a3ae5d86ecf38db9427359ea37a5f646

                                                        SHA1

                                                        eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                        SHA256

                                                        c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                        SHA512

                                                        96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                        Download Submit

                                                      • C:\Windows\Installer\e57ca84.msi
                                                        Filesize

                                                        2.9MB

                                                        MD5

                                                        b6cb6aab800ff92abe77fc8ae536c763

                                                        SHA1

                                                        3ee9a797c6ebf0f7f1d290d1e36eef2a8c450af7

                                                        SHA256

                                                        5ddf9fd9d9f094be8fcef49db058a84615473e3832f3c4dcecd70799ac86dae5

                                                        SHA512

                                                        9bf347251fe162b863749c0828c2d36e60ee51fc6709d84243b75107c2092885412659d6bd48d1a564d030e6d0a9cefda089fb4c4625bf45c2a020d9ded6c5a3

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{82fb8aa6-d078-a844-958a-24e552fddcac}\lci_iddcx.cat
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        62458e58313475c9a3642a392363e359

                                                        SHA1

                                                        e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                        SHA256

                                                        85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                        SHA512

                                                        49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{82fb8aa6-d078-a844-958a-24e552fddcac}\lci_iddcx.inf
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        1cec22ca85e1b5a8615774fca59a420b

                                                        SHA1

                                                        049a651751ef38321a1088af6a47c4380f9293fc

                                                        SHA256

                                                        60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                        SHA512

                                                        0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{82fb8aa6-d078-a844-958a-24e552fddcac}\x64\lci_iddcx.dll
                                                        Filesize

                                                        52KB

                                                        MD5

                                                        01e8bc64139d6b74467330b11331858d

                                                        SHA1

                                                        b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                        SHA256

                                                        148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                        SHA512

                                                        4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{d1131860-7056-6342-9aa1-5ecf75789d59}\lci_proxywddm.cat
                                                        Filesize

                                                        12KB

                                                        MD5

                                                        8e16d54f986dbe98812fd5ec04d434e8

                                                        SHA1

                                                        8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                        SHA256

                                                        7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                        SHA512

                                                        e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{d1131860-7056-6342-9aa1-5ecf75789d59}\lci_proxywddm.inf
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        0315a579f5afe989154cb7c6a6376b05

                                                        SHA1

                                                        e352ff670358cf71e0194918dfe47981e9ccbb88

                                                        SHA256

                                                        d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                        SHA512

                                                        c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{d1131860-7056-6342-9aa1-5ecf75789d59}\x64\lci_proxyumd.dll
                                                        Filesize

                                                        179KB

                                                        MD5

                                                        4dc11547a5fc28ca8f6965fa21573481

                                                        SHA1

                                                        d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                        SHA256

                                                        e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                        SHA512

                                                        bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{d1131860-7056-6342-9aa1-5ecf75789d59}\x64\lci_proxyumd32.dll
                                                        Filesize

                                                        135KB

                                                        MD5

                                                        67ae7b2c36c9c70086b9d41b4515b0a8

                                                        SHA1

                                                        ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                        SHA256

                                                        79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                        SHA512

                                                        4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{d1131860-7056-6342-9aa1-5ecf75789d59}\x64\lci_proxywddm.sys
                                                        Filesize

                                                        119KB

                                                        MD5

                                                        b9b0e9b4d93b18b99ece31a819d71d00

                                                        SHA1

                                                        2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                        SHA256

                                                        0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                        SHA512

                                                        465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                        Download Submit

                                                      • C:\Windows\System32\InstallUtil.InstallLog
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        bbe625903f24392c2a25bedce9fabd66

                                                        SHA1

                                                        5980c02f4570b749bcc0bed56ee9ff0dde1b1ec2

                                                        SHA256

                                                        fac60b5633a0094427f5c5916611912330def57e1418040216be71ee928d69bc

                                                        SHA512

                                                        480f79d8dfe1555431e2579b8b8fdbdbe5e0f064c316dc5caba50976436850ba6d2b413477096e97f0c5c76a21a6e38eefbf46b6e8e2f08ffe875fa3279062c6

                                                        Download Submit

                                                      • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-20-41-41.dat
                                                        Filesize

                                                        602B

                                                        MD5

                                                        8a429da25a6ef4a70fcb97a2c6aebbec

                                                        SHA1

                                                        b2cfea0730d5f2a0dcd3b494358d22b4a17664e0

                                                        SHA256

                                                        409e3f6d89904693dca18d4f910c952777c773de73ee0f60924b6b622275cb99

                                                        SHA512

                                                        e6e865abbbe5c908e71b013a389b3c8f88872af0c13829f314a9e92cd82849b7034dfbab7c4899348dcede42af29521fa390f4ace084bfcae89a59c38f859e90

                                                        Download Submit

                                                      • C:\Windows\Temp\InstallUtil.log
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        0b7d1c99b0b98ef4f82ee83e29a50fe3

                                                        SHA1

                                                        9b7aef092a36e448851c15edd6cb44048ea0c611

                                                        SHA256

                                                        6a5ddb5f7ac8cebf941930557d64184a78496c9a68b7d1d67d1ec2fe85ad6451

                                                        SHA512

                                                        37ac5dfe67b033fd6b6d0168082a10393e76eeb137be4a4e3788b38c876e1b67f0b5acfbaee84150615f4164d4767114d690a221f4f744d8f65f156a5d4d8dc1

                                                        Download Submit

                                                      • C:\Windows\Temp\InstallUtil.log
                                                        Filesize

                                                        708B

                                                        MD5

                                                        4837f9e3366818319c6858947814ecc2

                                                        SHA1

                                                        1d91b42a9465f74e979297c982b2b58020e051e9

                                                        SHA256

                                                        a8c56a893c1be70f3c7f96b65474f461a160e61a1e5b271462cb8e639ceb80d0

                                                        SHA512

                                                        53347dada32b580802d2915d9e6fbf8a9e7fd153dcde183413b3f0fa5387cb9ebad11cdbd1d581d9e8dbd45db7c434f2f985c5e7dfc6ac178a5bc450b060eb84

                                                        Download Submit

                                                      • C:\Windows\Temp\InstallUtil.log
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        c0f5b0b339d3030e695da981c4f66fb4

                                                        SHA1

                                                        efa34868ad00ff9712230a54ef94df793062e936

                                                        SHA256

                                                        121cb24f9da9a1c84cef9e1a17f838f779e5d370300de0a693bc0ba209db3a97

                                                        SHA512

                                                        165408e2cc63cdd5bd47e10e104104dc49b8a86b7e3c74ec6c9b453a409f9349823a045cabede851ee07035213b3728bf9267c083dbde3a6eb7e83a463ba10a7

                                                        Download Submit

                                                      • C:\Windows\Temp\PreVer.log
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        cd2fc30ac12e6e2163b12beb24e41d44

                                                        SHA1

                                                        c9b3c0f9c7c681be7f960c738561d3153ec256af

                                                        SHA256

                                                        95878bfc2d7d9340729109685215d7075c0f0d1e1b3278f220f945433b51ad3a

                                                        SHA512

                                                        67f359161f69c785e2affbf35927da91abe8c54d9881b6fb39134b9dcc44854bdd11fe6442a949996147c5c678c6930cb6cdf1f222bd8567cfafecf294ce4217

                                                        Download Submit

                                                      • C:\Windows\Temp\TmpA7C4.tmp
                                                        Filesize

                                                        3KB

                                                        MD5

                                                        560af444a6a7faa0b0ca94dc16ca2a58

                                                        SHA1

                                                        df31453fafde354870a0a9a8ca50b18e284c32e4

                                                        SHA256

                                                        94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429

                                                        SHA512

                                                        7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681

                                                        Download Submit

                                                      • C:\Windows\Temp\unpack.log
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        2b98c38d312f7d6863a1d48c502f126c

                                                        SHA1

                                                        14ac86606600bd34f8666c38cf05c2fdbc49cce5

                                                        SHA256

                                                        6cd2bf180cfab744a172b5f51d818e4211f1bf4a5080c9a244997d5ebd9786f8

                                                        SHA512

                                                        a4b921d45759a0ab380101c2e98617d3b32432ad9f335287883428d6589161bb6a7ba27cc3e327acdcd84277287019265f3b0b759e42565bcfced28dc16d46bb

                                                        Download Submit

                                                      • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                        Filesize

                                                        3.2MB

                                                        MD5

                                                        2c18826adf72365827f780b2a1d5ea75

                                                        SHA1

                                                        a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                        SHA256

                                                        ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                        SHA512

                                                        474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                        Download Submit

                                                      • C:\Windows\Temp\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\IsConfig.ini
                                                        Filesize

                                                        571B

                                                        MD5

                                                        d239b8964e37974225ad69d78a0a8275

                                                        SHA1

                                                        cf208e98a6f11d1807cd84ca61504ad783471679

                                                        SHA256

                                                        0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                        SHA512

                                                        88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                        Download Submit

                                                      • C:\Windows\Temp\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\String1033.txt
                                                        Filesize

                                                        182KB

                                                        MD5

                                                        99bbffd900115fe8672c73fb1a48a604

                                                        SHA1

                                                        8f587395fa6b954affef337c70781ce00913950e

                                                        SHA256

                                                        57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                        SHA512

                                                        d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                        Download Submit

                                                      • C:\Windows\Temp\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\_is64A2.exe
                                                        Filesize

                                                        179KB

                                                        MD5

                                                        7a1c100df8065815dc34c05abc0c13de

                                                        SHA1

                                                        3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                        SHA256

                                                        e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                        SHA512

                                                        bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                        Download Submit

                                                      • C:\Windows\Temp\{AEB0CAC4-04AE-4C5B-AA6F-5E33A22E1C4C}\setup.inx
                                                        Filesize

                                                        345KB

                                                        MD5

                                                        0376dd5b7e37985ea50e693dc212094c

                                                        SHA1

                                                        02859394164c33924907b85ab0aaddc628c31bf1

                                                        SHA256

                                                        c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                        SHA512

                                                        69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                        Download Submit

                                                      • C:\Windows\Temp\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\ISRT.dll
                                                        Filesize

                                                        427KB

                                                        MD5

                                                        85315ad538fa5af8162f1cd2fce1c99d

                                                        SHA1

                                                        31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                        SHA256

                                                        70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                        SHA512

                                                        877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                        Download Submit

                                                      • C:\Windows\Temp\{B940A8E5-B352-47FF-BF42-9547853C1AE7}\_isres_0x0409.dll
                                                        Filesize

                                                        1.8MB

                                                        MD5

                                                        befe2ef369d12f83c72c5f2f7069dd87

                                                        SHA1

                                                        b89c7f6da1241ed98015dc347e70322832bcbe50

                                                        SHA256

                                                        9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                        SHA512

                                                        760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                        Download Submit

                                                      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                        Filesize

                                                        404B

                                                        MD5

                                                        c983570f9758282388c9d1941ef2824b

                                                        SHA1

                                                        2a93e9639447fed277d6542e6d9dc06c51baf9cd

                                                        SHA256

                                                        3a4bae2cd5f46fed9c6c455d92f5bb3399d0acc2acf4f53e454497004bb1af71

                                                        SHA512

                                                        54413287d3155c3b763278a4c684a5393e296ce4ca3b634b376efa9c544f7248895eafc82b4b77271006e65db9141dbb55f6c4882df7f9c797f2434923926d59

                                                        Download Submit

                                                      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                        Filesize

                                                        412B

                                                        MD5

                                                        87ab8d054ca256c209fb528f12522bb7

                                                        SHA1

                                                        fe93228e015517167db093bf42be37789c9c0d63

                                                        SHA256

                                                        5e6a5c52f9dcf1e7084baedaac923bf092c196c2c954db88e0701ebf505172e8

                                                        SHA512

                                                        3feabe9e5d02398556f3479df6f39f35089f87fa472bccef51c6f50ae0a8716264b61788f842be7a7d762db31966f8f67af058861772a7a6d6e4058992983049

                                                        Download Submit

                                                      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                        Filesize

                                                        24.1MB

                                                        MD5

                                                        56700e833815ba46975f97f43af2e131

                                                        SHA1

                                                        221ede77f92abd0c9391ecb447baa7145835d084

                                                        SHA256

                                                        8bc0cbb3512d7931b302b1bb544dfa4658318d1391ca87c2bfd8a8787334fb7c

                                                        SHA512

                                                        bacfeff9c3cfedec2d8a03534bcb6a1220e7e51c2f554d8cc929d0a09c8d00a9ea65be00d4d91ee4e14db917cebdf6a5ff42f07128861f82a4d2fe76eba69b4a

                                                        Download Submit

                                                      • \??\Volume{f0eec59f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bff2a427-7904-4477-ba46-be484f3509f7}_OnDiskSnapshotProp
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        8591c433c1f3775188a850f82e2c4b3a

                                                        SHA1

                                                        376447e392a06d0675a33cb6dd81efd268cfc46f

                                                        SHA256

                                                        dc80da7a5d1fd5daca371a70b250176a3c2d52e570ce92b175a287e43be7f02c

                                                        SHA512

                                                        784ed7b5151dd6eaa69b38f7a854751ba539e5bcda55f6e03121baaf304f9ee9c8038df2b1e7601b05a438337962d7f5157d0fb9d8b54cd2fc61fe912b4f7eff

                                                        Download Submit

                                                      • memory/336-2096-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/336-1150-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/336-2745-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/336-2746-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/336-1151-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/336-2095-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/980-243-0x0000022EC9DB0000-0x0000022EC9DE8000-memory.dmp

                                                        Filesize

                                                        224KB

                                                        Download

                                                      • memory/980-203-0x0000022EC97F0000-0x0000022EC9812000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download

                                                      • memory/980-200-0x0000022EC98B0000-0x0000022EC9962000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/1156-2935-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1156-1189-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1156-1188-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1156-2936-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1156-4195-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1156-4196-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1236-4160-0x00000248D9820000-0x00000248D998A000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                        Download

                                                      • memory/1236-4192-0x00000248D9820000-0x00000248D998A000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                        Download

                                                      • memory/1388-363-0x0000020E471D0000-0x0000020E471D8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/1388-367-0x0000020E5FC90000-0x0000020E5FC98000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/1388-373-0x0000020E5FCC0000-0x0000020E5FCE6000-memory.dmp

                                                        Filesize

                                                        152KB

                                                        Download

                                                      • memory/1388-372-0x0000020E5FFB0000-0x0000020E5FFEA000-memory.dmp

                                                        Filesize

                                                        232KB

                                                        Download

                                                      • memory/1388-371-0x0000020E5FCF0000-0x0000020E5FD1A000-memory.dmp

                                                        Filesize

                                                        168KB

                                                        Download

                                                      • memory/1388-358-0x0000020E46930000-0x0000020E46994000-memory.dmp

                                                        Filesize

                                                        400KB

                                                        Download

                                                      • memory/1388-359-0x0000020E5FA60000-0x0000020E5FAAA000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/1388-360-0x0000020E471E0000-0x0000020E471FC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/1388-361-0x0000020E5FAB0000-0x0000020E5FAFC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                        Download

                                                      • memory/1388-362-0x0000020E5FB30000-0x0000020E5FB78000-memory.dmp

                                                        Filesize

                                                        288KB

                                                        Download

                                                      • memory/1388-364-0x0000020E47320000-0x0000020E4732A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/1388-365-0x0000020E5FD60000-0x0000020E5FE3C000-memory.dmp

                                                        Filesize

                                                        880KB

                                                        Download

                                                      • memory/1388-366-0x0000020E5FE40000-0x0000020E5FEF2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/1388-370-0x0000020E5FF00000-0x0000020E5FF68000-memory.dmp

                                                        Filesize

                                                        416KB

                                                        Download

                                                      • memory/1388-368-0x0000020E5FCA0000-0x0000020E5FCA8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/1388-369-0x0000020E5FCB0000-0x0000020E5FCB8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/1508-1060-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1508-494-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1508-497-0x00000000030C0000-0x0000000003287000-memory.dmp

                                                        Filesize

                                                        1.8MB

                                                        Download

                                                      • memory/1508-528-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1508-916-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1508-919-0x0000000003100000-0x00000000032C7000-memory.dmp

                                                        Filesize

                                                        1.8MB

                                                        Download

                                                      • memory/1508-1003-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1800-110-0x0000000004F60000-0x0000000004FC6000-memory.dmp

                                                        Filesize

                                                        408KB

                                                        Download

                                                      • memory/2864-43-0x0000000004B30000-0x0000000004B3C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/2864-39-0x00000000027A0000-0x00000000027CE000-memory.dmp

                                                        Filesize

                                                        184KB

                                                        Download

                                                      • memory/3356-1192-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/3356-1197-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/3356-2788-0x0000000072960000-0x0000000072A7C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/3356-2789-0x0000000072590000-0x000000007295D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/3492-1548-0x00000164964B0000-0x00000164964BA000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/3492-1715-0x0000016496E10000-0x0000016496E2A000-memory.dmp

                                                        Filesize

                                                        104KB

                                                        Download

                                                      • memory/3492-1731-0x00000164AF6C0000-0x00000164AF772000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/3492-1833-0x00000164AFCB0000-0x00000164B01D8000-memory.dmp

                                                        Filesize

                                                        5.2MB

                                                        Download

                                                      • memory/3604-289-0x00000180599B0000-0x00000180599CC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/3604-288-0x0000018059F30000-0x0000018059FE0000-memory.dmp

                                                        Filesize

                                                        704KB

                                                        Download

                                                      • memory/3604-286-0x00000180594E0000-0x0000018059510000-memory.dmp

                                                        Filesize

                                                        192KB

                                                        Download

                                                      • memory/3632-1823-0x00000205AC660000-0x00000205AC67C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/3632-1820-0x00000205AC700000-0x00000205AC7B2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/3632-1829-0x00000205C4FA0000-0x00000205C4FE8000-memory.dmp

                                                        Filesize

                                                        288KB

                                                        Download

                                                      • memory/3632-1716-0x00000205ABC30000-0x00000205ABC6A000-memory.dmp

                                                        Filesize

                                                        232KB

                                                        Download

                                                      • memory/4276-165-0x0000022A0C2A0000-0x0000022A0C2DC000-memory.dmp

                                                        Filesize

                                                        240KB

                                                        Download

                                                      • memory/4276-164-0x0000022A0C220000-0x0000022A0C232000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/4276-160-0x0000022A26460000-0x0000022A264F8000-memory.dmp

                                                        Filesize

                                                        608KB

                                                        Download

                                                      • memory/4276-148-0x0000022A0BE10000-0x0000022A0BE38000-memory.dmp

                                                        Filesize

                                                        160KB

                                                        Download

                                                      • memory/4280-80-0x0000000005500000-0x0000000005854000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                        Download

                                                      • memory/4280-79-0x0000000005350000-0x0000000005372000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download

                                                      • memory/4280-76-0x0000000005440000-0x00000000054F2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/4420-1185-0x00000299ABE30000-0x00000299ABEE2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/4420-1183-0x0000029992C40000-0x0000029992C52000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/4420-3029-0x00000299AC430000-0x00000299AC59A000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                        Download

                                                      • memory/4420-1359-0x0000029993560000-0x00000299935B4000-memory.dmp

                                                        Filesize

                                                        336KB

                                                        Download

                                                      • memory/4420-1184-0x0000029993490000-0x00000299934AC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/5020-1831-0x00000231F3160000-0x00000231F3194000-memory.dmp

                                                        Filesize

                                                        208KB

                                                        Download

                                                      • memory/5020-1838-0x00000231F3560000-0x00000231F357C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/5020-1840-0x00000231F35A0000-0x00000231F35B8000-memory.dmp

                                                        Filesize

                                                        96KB

                                                        Download

                                                      • memory/5020-1834-0x00000231F3A40000-0x00000231F3A8A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/5020-1841-0x00000231F3580000-0x00000231F358A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/5020-1873-0x00000231F3C00000-0x00000231F3C4A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/5076-311-0x00000265C30A0000-0x00000265C30B6000-memory.dmp

                                                        Filesize

                                                        88KB

                                                        Download

                                                      • memory/5076-312-0x00000265DC220000-0x00000265DC2D2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5076-313-0x00000265C3910000-0x00000265C392C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/5328-1729-0x00000147F9B20000-0x00000147F9B6A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/5328-1832-0x00000147FAC20000-0x00000147FACFC000-memory.dmp

                                                        Filesize

                                                        880KB

                                                        Download

                                                      • memory/5328-1826-0x00000147FAA80000-0x00000147FAB32000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5328-1875-0x00000147FA110000-0x00000147FA12A000-memory.dmp

                                                        Filesize

                                                        104KB

                                                        Download

                                                      • memory/5328-1799-0x00000147F9AD0000-0x00000147F9AEC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/5328-1723-0x00000147F96E0000-0x00000147F96F2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/5464-1830-0x000002346DA50000-0x000002346DA96000-memory.dmp

                                                        Filesize

                                                        280KB

                                                        Download

                                                      • memory/5464-1774-0x000002346CD10000-0x000002346CD20000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/5464-1822-0x000002346E310000-0x000002346E96C000-memory.dmp

                                                        Filesize

                                                        6.4MB

                                                        Download

                                                      • memory/5464-1732-0x000002346C940000-0x000002346C952000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/5464-1921-0x000002346DD70000-0x000002346DDC0000-memory.dmp

                                                        Filesize

                                                        320KB

                                                        Download

                                                      • memory/5464-1806-0x000002346DAE0000-0x000002346DB92000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5464-1808-0x000002346D2E0000-0x000002346D300000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5464-1922-0x000002346DE40000-0x000002346DEB6000-memory.dmp

                                                        Filesize

                                                        472KB

                                                        Download

                                                      • memory/5568-1819-0x0000022CE5290000-0x0000022CE52A4000-memory.dmp

                                                        Filesize

                                                        80KB

                                                        Download

                                                      • memory/5568-1812-0x0000022CCCBA0000-0x0000022CCCBC0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5568-1811-0x0000022CCC220000-0x0000022CCC230000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/5568-1814-0x0000022CE5350000-0x0000022CE5402000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5568-1817-0x0000022CE5410000-0x0000022CE5476000-memory.dmp

                                                        Filesize

                                                        408KB

                                                        Download

                                                      • memory/5868-1923-0x0000020AA5750000-0x0000020AA5800000-memory.dmp

                                                        Filesize

                                                        704KB

                                                        Download

                                                      • memory/5868-1818-0x0000020A8C930000-0x0000020A8C97A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/5868-1828-0x0000020A8C8E0000-0x0000020A8C8FC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/5868-1816-0x0000020A8C430000-0x0000020A8C43C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/5944-1798-0x000001D4BE570000-0x000001D4BE57C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/5944-1803-0x000001D4BEDD0000-0x000001D4BEDE8000-memory.dmp

                                                        Filesize

                                                        96KB

                                                        Download

                                                      • memory/5944-1804-0x000001D4D76F0000-0x000001D4D77A2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5944-1810-0x000001D4BEDF0000-0x000001D4BEE10000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5944-4201-0x000001D4D6FE0000-0x000001D4D714A000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                        Download

                                                      • memory/5944-4203-0x000001D4D6FE0000-0x000001D4D714A000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                        Download

                                                      • memory/6104-1837-0x00000136C51B0000-0x00000136C51B8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/6104-1815-0x00000136DDD40000-0x00000136DDE1C000-memory.dmp

                                                        Filesize

                                                        880KB

                                                        Download

                                                      • memory/6104-1827-0x00000136DDE20000-0x00000136DDED2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/6104-1807-0x00000136C5190000-0x00000136C51AC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/6104-1801-0x00000136C4950000-0x00000136C4960000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/6104-1802-0x00000136C51C0000-0x00000136C520A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download