Overview

overview

10

Static

static

10

Nota-fiscal2.1.msi

windows7-x64

10

Nota-fiscal2.1.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2025, 21:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Nota-fiscal2.1.msi

  • Size

    2.9MB

  • MD5

    6032d2452e05a12f1449182deb3ab258

  • SHA1

    03a992f9020a003fe86e477ac28698afc16a73d3

  • SHA256

    394659c01bd981c3a4d5840fbd624c20e3270c9defc432ff3fe6ddb482b5ad46

  • SHA512

    1318d1844efe031d05499e642c9509422a9f92977b8b4c76d38c6c614d81813af4ec927d2dd807e9b7b205ab06ea1800eb4a082f1a89a4e3721a37301165e28d

  • SSDEEP

    49152:9+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:9+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoveryexecutionpersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Nota-fiscal2.1.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2184
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4560
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A74B49A91B6BAD375960011376D5EA6D
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID1A8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636531 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1464
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID4C6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637171 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2076
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID9B8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638406 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:552
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIE621.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240641656 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4976
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding FDA58C453568526F17CCA378DEF1FE67 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1148
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4100
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1400
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000QFoFLIA1" /AgentId="e0ce4e54-2a5c-4dac-ba6c-0494599babf5"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:3496
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C7906578E4373DD062CC3EFD00242E51 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:208
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{47F67A65-321E-4F47-AF5A-226F938D38B2}
          3⤵
          • Executes dropped EXE
          PID:5096
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7A321DF8-1FD2-4F17-9B0B-254F36CDD46D}
          3⤵
          • Executes dropped EXE
          PID:4328
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B3B59FAC-CA73-422D-8D67-B7DD3DA6074F}
          3⤵
          • Executes dropped EXE
          PID:2532
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6FCFD6EF-EA6C-4A67-B33C-8252498ED01C}
          3⤵
          • Executes dropped EXE
          PID:1392
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4D23FAB-FA9D-48E7-955C-1DE0FFE48C68}
          3⤵
          • Executes dropped EXE
          PID:2104
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A5EB7530-C49D-4B59-B8AC-EB409BC1ACC4}
          3⤵
          • Executes dropped EXE
          PID:3200
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{768E548E-3DE8-4FA3-A21F-CAAA144131A6}
          3⤵
          • Executes dropped EXE
          PID:3848
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{977439BA-2299-40CD-9323-7A72864410C0}
          3⤵
          • Executes dropped EXE
          PID:1712
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{641EA027-67CF-462E-91BE-F79682838814}
          3⤵
          • Executes dropped EXE
          PID:1796
        • C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe
          C:\Windows\TEMP\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_is1FB8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{63F71B8A-DF29-4866-80D0-7A29F623BB53}
          3⤵
          • Executes dropped EXE
          PID:4012
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4428
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3660
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3364
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2184
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:528
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:2532
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAppPB.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1516
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4012
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRFeature.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:3660
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
            3⤵
              PID:4776
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRFeatMini.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:1824
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5148
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRManager.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5316
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5408
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRAgent.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5452
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
              3⤵
                PID:5484
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill.exe /F /IM SRChat.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5528
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5556
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill.exe /F /IM SRAudioChat.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5600
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5628
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill.exe /F /IM SRVirtualDisplay.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5672
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A1491E2-09A7-410E-892A-52C1B0A883A8}
                3⤵
                • Executes dropped EXE
                PID:5796
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59E02610-5912-4346-AEBB-9AAB334EF479}
                3⤵
                • Executes dropped EXE
                PID:5832
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C5E912D-BBE4-4D52-9F30-C26D5D072164}
                3⤵
                • Executes dropped EXE
                PID:5864
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F4545DF-E1AD-45E7-911A-E74A9FE6FDD3}
                3⤵
                • Executes dropped EXE
                PID:5896
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C84D143B-0D7D-4F86-A204-453B380DD227}
                3⤵
                • Executes dropped EXE
                PID:5928
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BACE14AC-E3DF-4EDD-AF7F-225AD6DC2AEC}
                3⤵
                • Executes dropped EXE
                PID:6008
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{05149BE4-91C8-412D-9F8A-A375E1A99C61}
                3⤵
                • Executes dropped EXE
                PID:6040
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{36FA8C22-F223-4ADE-9D9A-767FD8E4BCCF}
                3⤵
                • Executes dropped EXE
                PID:6072
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F61225C-E7D3-4223-97BE-C717E7F39574}
                3⤵
                • Executes dropped EXE
                PID:6104
              • C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                C:\Windows\TEMP\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF0A6F60-F6CC-4492-B384-91B41B2F4C8E}
                3⤵
                • Executes dropped EXE
                PID:6136
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2E16711C-333C-4218-B0D9-3F27982965B6}
                3⤵
                • Executes dropped EXE
                PID:5740
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3B74B68-DD63-41F2-A62B-C18F60D21585}
                3⤵
                • Executes dropped EXE
                PID:4408
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8959884E-CF84-4E82-8BCE-FA2E3A27B0C9}
                3⤵
                • Executes dropped EXE
                PID:5524
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{088AEBCF-E57B-4B1F-9243-DE63BA253370}
                3⤵
                • Executes dropped EXE
                PID:3848
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B4EB0001-7CD0-4065-8534-2FB69AAB39C5}
                3⤵
                • Executes dropped EXE
                PID:5600
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E6045E5B-EA4A-4233-9DA5-D1CA762602B5}
                3⤵
                • Executes dropped EXE
                PID:5664
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{160BCB97-0271-4B39-B5CD-652DB8AF46B4}
                3⤵
                • Executes dropped EXE
                PID:4444
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6F69D2E6-2CB1-483A-AB1F-B377D703DCED}
                3⤵
                • Executes dropped EXE
                PID:5704
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD72334F-05AE-42A5-81A0-D99C7072CD2E}
                3⤵
                • Executes dropped EXE
                PID:5724
              • C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe
                C:\Windows\TEMP\{09F393F8-0221-4FF9-BDDF-9AD82DF68179}\_is4236.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71489084-5EFE-4BFF-A991-358BCADC9A11}
                3⤵
                • Executes dropped EXE
                PID:5368
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5884
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4380
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5288
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                  4⤵
                    PID:6100
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                    4⤵
                      PID:5388
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4276
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{46D3D7B2-4112-4430-AEF5-7F7F3A054E89}
                    3⤵
                    • Executes dropped EXE
                    PID:5356
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{28B15A10-5605-4991-AB35-396A25B6D1B5}
                    3⤵
                    • Executes dropped EXE
                    PID:5168
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FCD9E2B7-8432-4C23-AC57-827CC49DFEB4}
                    3⤵
                    • Executes dropped EXE
                    PID:5456
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{88F58057-47C2-41BF-A776-9AF8C0AE9DF0}
                    3⤵
                    • Executes dropped EXE
                    PID:6048
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{69109DBE-3B55-434F-93E5-3B44000C33E9}
                    3⤵
                    • Executes dropped EXE
                    PID:5496
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8AE67F86-5825-4027-97C9-D5EE2A93F1A0}
                    3⤵
                    • Executes dropped EXE
                    PID:5528
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5DC0553B-35D4-4AA6-AEA2-8D03E7EF6D6A}
                    3⤵
                    • Executes dropped EXE
                    PID:5492
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0A69496B-B6D8-48E2-8349-99A5D5D856F7}
                    3⤵
                    • Executes dropped EXE
                    PID:5608
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B169A4C-D36F-4A04-B1D4-32119B5E10DE}
                    3⤵
                    • Executes dropped EXE
                    PID:5592
                  • C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe
                    C:\Windows\TEMP\{5CE4DD18-959C-44BC-88ED-9BC2B7D378A0}\_is55B1.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{131CE9C0-1B11-4E13-82B9-66E5585FBFB3}
                    3⤵
                    • Executes dropped EXE
                    PID:5676
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:4444
                  • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                    C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{51444DFF-612A-4180-988C-A126A653392C}
                    3⤵
                    • Executes dropped EXE
                    PID:5780
                  • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                    C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8033087B-5117-45F5-AAE1-B40A7B089851}
                    3⤵
                    • Executes dropped EXE
                    PID:5808
                  • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                    C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CDFB2043-6EB3-4B22-8477-DC25454987FD}
                    3⤵
                    • Executes dropped EXE
                    PID:5832
                  • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                    C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{64BA016F-CEC6-4C8A-85B1-AD0DC78DD89A}
                    3⤵
                    • Executes dropped EXE
                    PID:5444
                  • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                    C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{85F24320-DF8B-4619-B824-2D86F8DCD98D}
                    3⤵
                    • Executes dropped EXE
                    PID:2944
                  • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                    C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F6D79C7E-40E2-4F35-851D-6E913D005813}
                    3⤵
                    • Executes dropped EXE
                    PID:5944
                  • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                    C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F4DBBD91-E4CC-4849-B80B-4CFC50D5A552}
                    3⤵
                      PID:5952
                    • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                      C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84BC4828-A512-43CB-BA7D-FE965C486C2A}
                      3⤵
                        PID:5996
                      • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                        C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DE35A615-192A-44EF-B591-FE25B11050B2}
                        3⤵
                          PID:6108
                        • C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe
                          C:\Windows\TEMP\{F15D4EA7-F28F-45CA-985E-FA96E71AB498}\_is5A45.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B24CA776-ADFB-4BA7-A5F0-890EFA06EED2}
                          3⤵
                            PID:2268
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5328
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding DE27DDD519BB6CADF67F8984C2428352 E Global\MSI0000
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:6140
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Windows\Installer\MSI90A5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240685296 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                            3⤵
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:3656
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Windows\Installer\MSI925B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240685687 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                            3⤵
                            • Blocklisted process makes network request
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:3200
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Windows\Installer\MSI971F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240686875 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                            3⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:4860
                          • C:\Windows\SysWOW64\NET.exe
                            "NET" STOP AteraAgent
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4484
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 STOP AteraAgent
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:2156
                          • C:\Windows\SysWOW64\TaskKill.exe
                            "TaskKill.exe" /f /im AteraAgent.exe
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            PID:4500
                          • C:\Windows\syswow64\NET.exe
                            "NET" STOP AteraAgent
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:1712
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 STOP AteraAgent
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:2028
                          • C:\Windows\syswow64\TaskKill.exe
                            "TaskKill.exe" /f /im AteraAgent.exe
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            PID:1572
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Windows\Installer\MSIC378.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698218 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                            3⤵
                            • Blocklisted process makes network request
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:536
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                          2⤵
                          • Drops file in System32 directory
                          PID:5280
                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                          "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="ee1889b1-0011-4ab4-913f-b4669c3126b3"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:1184
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 8045259D9E2B30DEBAFCB3F4BA29DFAA E Global\MSI0000
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:5592
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 392452BAAB60BB266B938606C2FE5020 E Global\MSI0000
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:4360
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding FD2C9EDBE465470455781BE9C2C858F9 E Global\MSI0000
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:3224
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4172
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                        1⤵
                        • Drops file in System32 directory
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Modifies system certificate store
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3932
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                          2⤵
                          • Launches sc.exe
                          PID:4576
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "6dff4261-6715-4b90-a5c3-124d0322307e" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QFoFLIA1
                          2⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1308
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "d8e4b8db-249e-47ca-920f-4a51e8e50a3b" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QFoFLIA1
                          2⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5068
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "a1122c05-3e3b-4ac3-8f80-2f048d940983" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000QFoFLIA1
                          2⤵
                          • Executes dropped EXE
                          PID:2312
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "183b7c4d-882e-4584-9691-a55b200a7f8b" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000QFoFLIA1
                          2⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:1028
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                            3⤵
                            • Drops file in System32 directory
                            • Command and Scripting Interpreter: PowerShell
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3588
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2448
                            • C:\Windows\system32\cscript.exe
                              cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                              4⤵
                              • Modifies data under HKEY_USERS
                              PID:2568
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "117fe3eb-13b1-40e5-93e3-f5d38d502804" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000QFoFLIA1
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3548
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "1169de15-6dcd-43c2-ae7a-3470d6ff09e3" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000QFoFLIA1
                          2⤵
                          • Downloads MZ/PE file
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:3696
                          • C:\Windows\TEMP\SplashtopStreamer.exe
                            "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:4892
                            • C:\Windows\Temp\unpack\PreVerCheck.exe
                              "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1604
                              • C:\Windows\SysWOW64\msiexec.exe
                                msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:2892
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "507924de-5c28-4e71-8ec0-6cafee15f46c" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000QFoFLIA1
                          2⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3780
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                            3⤵
                            • Drops file in System32 directory
                            • Command and Scripting Interpreter: PowerShell
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4144
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            3⤵
                              PID:5192
                              • C:\Windows\system32\cscript.exe
                                cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                4⤵
                                • Modifies data under HKEY_USERS
                                PID:5296
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                          1⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of WriteProcessMemory
                          PID:4564
                          • C:\Windows\System32\sc.exe
                            "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                            2⤵
                            • Launches sc.exe
                            PID:2600
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "507924de-5c28-4e71-8ec0-6cafee15f46c" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000QFoFLIA1
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2568
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                              3⤵
                              • Drops file in System32 directory
                              • Command and Scripting Interpreter: PowerShell
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4328
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                              3⤵
                                PID:5200
                                • C:\Windows\system32\cscript.exe
                                  cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  4⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5288
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "99bbe317-057c-4b84-81e6-dfb777d26849" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000QFoFLIA1
                              2⤵
                                PID:5864
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                                  3⤵
                                  • Drops file in System32 directory
                                  • Command and Scripting Interpreter: PowerShell
                                  • Modifies data under HKEY_USERS
                                  PID:6128
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  3⤵
                                    PID:4204
                                    • C:\Windows\system32\cscript.exe
                                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      4⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1148
                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "f265b2d0-ff2f-4a77-bff4-df90c95a18ce" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000QFoFLIA1
                                  2⤵
                                    PID:5980
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=aec296714ecc863d0a1481ed38725dc5&rmm_session_pwd_ttl=86400"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5512
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "a4393caf-711d-46bb-8b55-3ae22666f990" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000QFoFLIA1
                                    2⤵
                                      PID:6132
                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "377d8e26-ec71-4cf3-833e-87c20c34269f" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QFoFLIA1
                                      2⤵
                                      • Drops file in System32 directory
                                      PID:6096
                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "5d699014-989c-4e02-a585-af7d9641c989" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000QFoFLIA1
                                      2⤵
                                        PID:5368
                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "63296cb5-c96b-4a89-9d56-b2cf7ca8530e" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000QFoFLIA1
                                        2⤵
                                        • Drops file in System32 directory
                                        PID:6068
                                        • C:\Windows\SYSTEM32\msiexec.exe
                                          "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                                          3⤵
                                            PID:5808
                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "5ae6951c-4bbd-47aa-8969-5ae12f8d3d9d" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000QFoFLIA1
                                          2⤵
                                          • Drops file in System32 directory
                                          PID:1308
                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "d67146e0-28b3-4884-97b7-cf77d21c9430" agent-api.atera.com/Production 443 or8ixLi90Mf "getinstalledapps" 001Q300000QFoFLIA1
                                          2⤵
                                          • Drops file in Program Files directory
                                          PID:4328
                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "2ade0495-b91f-4c61-8068-c6a5e6caf14f" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000QFoFLIA1
                                          2⤵
                                            PID:3116
                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "e1509c76-64c8-4585-8a7b-d9e0ed317ce5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000QFoFLIA1
                                            2⤵
                                              PID:2828
                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "c7811e33-d44d-4de3-beb7-a34aa88888f6" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000QFoFLIA1
                                              2⤵
                                              • Drops file in System32 directory
                                              PID:3660
                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "e73a7c68-baa0-4b0d-ae08-22f7fac792b1" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000QFoFLIA1
                                              2⤵
                                              • Drops file in System32 directory
                                              PID:4284
                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "44935e2e-f648-4916-9ba8-fa9620228243" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000QFoFLIA1
                                              2⤵
                                                PID:2440
                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "f510591f-9da7-468c-ac81-3cde4162f5ed" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000QFoFLIA1
                                                2⤵
                                                • Drops file in System32 directory
                                                • Drops file in Program Files directory
                                                • Modifies registry class
                                                PID:3428
                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "5682bb59-4412-48d5-91af-ef970ffe0627" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000QFoFLIA1
                                                2⤵
                                                • Writes to the Master Boot Record (MBR)
                                                • Drops file in Program Files directory
                                                PID:5712
                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "f6be25a3-f49e-4ac9-9ad9-2f53dd8a161a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000QFoFLIA1
                                                2⤵
                                                • Downloads MZ/PE file
                                                PID:832
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                  3⤵
                                                  • System Time Discovery
                                                  PID:5508
                                                  • C:\Program Files\dotnet\dotnet.exe
                                                    dotnet --list-runtimes
                                                    4⤵
                                                    • System Time Discovery
                                                    PID:5552
                                                • C:\Program Files\dotnet\dotnet.exe
                                                  "C:\Program Files\dotnet\dotnet" --list-runtimes
                                                  3⤵
                                                  • System Time Discovery
                                                  PID:5492
                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe
                                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" /repair /quiet /norestart
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5192
                                                  • C:\Windows\Temp\{C2A2A463-1546-4EE7-A33E-72C74547EBCC}\.cr\8-0-11.exe
                                                    "C:\Windows\Temp\{C2A2A463-1546-4EE7-A33E-72C74547EBCC}\.cr\8-0-11.exe" -burn.clean.room="C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" -burn.filehandle.attached=720 -burn.filehandle.self=724 /repair /quiet /norestart
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • System Time Discovery
                                                    • Modifies data under HKEY_USERS
                                                    PID:3252
                                                    • C:\Windows\Temp\{F393A28B-A280-4A6D-A9D8-7FED3BC8D9C5}\.be\dotnet-runtime-8.0.11-win-x64.exe
                                                      "C:\Windows\Temp\{F393A28B-A280-4A6D-A9D8-7FED3BC8D9C5}\.be\dotnet-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{8B5BD5DF-1968-44B2-A9ED-4703B9EA5C61} {32AEA599-55DF-4F50-A406-BC7F6E50A4C1} 3252
                                                      5⤵
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      • System Time Discovery
                                                      • Modifies registry class
                                                      PID:5644
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                  3⤵
                                                  • System Time Discovery
                                                  PID:5412
                                                  • C:\Program Files\dotnet\dotnet.exe
                                                    dotnet --list-runtimes
                                                    4⤵
                                                    • System Time Discovery
                                                    PID:3240
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                  3⤵
                                                  • System Time Discovery
                                                  PID:5100
                                                  • C:\Program Files\dotnet\dotnet.exe
                                                    dotnet --list-runtimes
                                                    4⤵
                                                    • System Time Discovery
                                                    PID:4716
                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                              1⤵
                                              • Drops file in Program Files directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:6136
                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                                2⤵
                                                • Drops file in System32 directory
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6104
                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                                  -h
                                                  3⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:812
                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                                  3⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5360
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                                    4⤵
                                                      PID:5204
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5320
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5572
                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                      SRUtility.exe -r
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3836
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5948
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                                      4⤵
                                                        PID:4964
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ver
                                                          5⤵
                                                            PID:5092
                                                          • C:\Windows\system32\sc.exe
                                                            sc query ddmgr
                                                            5⤵
                                                            • Launches sc.exe
                                                            PID:2568
                                                          • C:\Windows\system32\sc.exe
                                                            sc query lci_proxykmd
                                                            5⤵
                                                            • Launches sc.exe
                                                            PID:3340
                                                          • C:\Windows\system32\rundll32.exe
                                                            rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                                            5⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:5176
                                                  • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                                    1⤵
                                                    • Drops file in Program Files directory
                                                    • Modifies data under HKEY_USERS
                                                    PID:6060
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:4816
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "8ea04c94-57ed-4c50-84bc-67b6baa94a35" agent-api.atera.com/Production 443 or8ixLi90Mf "getinstalledapps" 001Q300000QFoFLIA1
                                                      2⤵
                                                        PID:5952
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "3641ce1e-fdb2-44ce-9d6c-a41e30e364eb" agent-api.atera.com/Production 443 or8ixLi90Mf "getinstalledapps" 001Q300000QFoFLIA1
                                                        2⤵
                                                          PID:5876
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "20b47172-a5c9-4df1-85b2-290e93b73bf3" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000QFoFLIA1
                                                          2⤵
                                                            PID:5644
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "0f8bfee0-fa98-4f26-8784-b93f68cfc47e" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000QFoFLIA1
                                                            2⤵
                                                              PID:4460
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "6f465aa1-9e8d-44ba-8df8-de01c54266fd" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000QFoFLIA1
                                                              2⤵
                                                                PID:2880
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "69372091-f9d6-4095-99df-25ee3caf2d23" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000QFoFLIA1
                                                                2⤵
                                                                  PID:5212
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "ee379bbb-afb4-4f1e-a852-774700ff8225" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000QFoFLIA1
                                                                  2⤵
                                                                    PID:3960
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                                      3⤵
                                                                      • System Time Discovery
                                                                      PID:5032
                                                                      • C:\Program Files\dotnet\dotnet.exe
                                                                        dotnet --list-runtimes
                                                                        4⤵
                                                                        • System Time Discovery
                                                                        PID:3520
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "98bf46a6-96bc-4a1e-b561-847f7881946f" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000QFoFLIA1
                                                                    2⤵
                                                                    • Writes to the Master Boot Record (MBR)
                                                                    PID:1148
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "6b86b37a-d6dc-4aaf-8470-8faf6ce1c473" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000QFoFLIA1
                                                                    2⤵
                                                                      PID:2500
                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "30e9d1ea-c9c9-48fb-9a0f-a823a7571ec8" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QFoFLIA1
                                                                      2⤵
                                                                        PID:3368
                                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "b7cd7abb-08c3-4889-ac1c-2e54bbbdcc48" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000QFoFLIA1
                                                                        2⤵
                                                                          PID:3060
                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "08f6782c-6ba1-4578-82ba-a610ad17afb8" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000QFoFLIA1
                                                                          2⤵
                                                                            PID:5144
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                                                                              3⤵
                                                                              • Drops file in System32 directory
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:1388
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                                              3⤵
                                                                                PID:3564
                                                                                • C:\Windows\system32\cscript.exe
                                                                                  cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                                                  4⤵
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:5924
                                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "147844b5-b084-4d3f-92ea-23deeaf9dd8b" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000QFoFLIA1
                                                                              2⤵
                                                                                PID:4704
                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "24445fff-925f-4855-94eb-6b8cadd6b698" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000QFoFLIA1
                                                                                2⤵
                                                                                  PID:5236
                                                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=aec296714ecc863d0a1481ed38725dc5&rmm_session_pwd_ttl=86400"
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2808
                                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "9e92dec4-62e8-4228-acb0-467121bf1356" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000QFoFLIA1
                                                                                  2⤵
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:3240
                                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "ee2e82e5-218d-447a-9a30-8794c0e30259" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000QFoFLIA1
                                                                                  2⤵
                                                                                  • Drops file in Program Files directory
                                                                                  • Modifies registry class
                                                                                  PID:5028
                                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "3c3721dd-172f-4a44-bb11-021d3e1031cc" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000QFoFLIA1
                                                                                  2⤵
                                                                                    PID:4456
                                                                                    • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                                                      "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "e0ce4e54-2a5c-4dac-ba6c-0494599babf5" "3c3721dd-172f-4a44-bb11-021d3e1031cc" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000QFoFLIA1"
                                                                                      3⤵
                                                                                        PID:3508
                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" e0ce4e54-2a5c-4dac-ba6c-0494599babf5 "30e9d1ea-c9c9-48fb-9a0f-a823a7571ec8" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QFoFLIA1
                                                                                      2⤵
                                                                                        PID:4128
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                      1⤵
                                                                                      • Checks SCSI registry key(s)
                                                                                      PID:5964
                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                                        2⤵
                                                                                        • Drops file in System32 directory
                                                                                        • Checks SCSI registry key(s)
                                                                                        • Modifies data under HKEY_USERS
                                                                                        PID:3024
                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000164" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                                        2⤵
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Windows directory
                                                                                        • Checks SCSI registry key(s)
                                                                                        • Modifies data under HKEY_USERS
                                                                                        PID:2348
                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000164"
                                                                                        2⤵
                                                                                        • Drops file in Drivers directory
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Windows directory
                                                                                        • Checks SCSI registry key(s)
                                                                                        PID:5136
                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                                        2⤵
                                                                                        • Drops file in Drivers directory
                                                                                        • Checks SCSI registry key(s)
                                                                                        PID:4568

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Reconnaissance

                                                                                    Resource Development

                                                                                    Initial Access

                                                                                    Execution

                                                                                    Command and Scripting Interpreter

                                                                                    1
                                                                                    T1059

                                                                                    PowerShell

                                                                                    1
                                                                                    T1059.001

                                                                                    Persistence

                                                                                    Boot or Logon Autostart Execution

                                                                                    1
                                                                                    T1547

                                                                                    Registry Run Keys / Startup Folder

                                                                                    1
                                                                                    T1547.001

                                                                                    Event Triggered Execution

                                                                                    2
                                                                                    T1546

                                                                                    Component Object Model Hijacking

                                                                                    1
                                                                                    T1546.015

                                                                                    Installer Packages

                                                                                    1
                                                                                    T1546.016

                                                                                    Pre-OS Boot

                                                                                    1
                                                                                    T1542

                                                                                    Bootkit

                                                                                    1
                                                                                    T1542.003

                                                                                    Privilege Escalation

                                                                                    Boot or Logon Autostart Execution

                                                                                    1
                                                                                    T1547

                                                                                    Registry Run Keys / Startup Folder

                                                                                    1
                                                                                    T1547.001

                                                                                    Event Triggered Execution

                                                                                    2
                                                                                    T1546

                                                                                    Component Object Model Hijacking

                                                                                    1
                                                                                    T1546.015

                                                                                    Installer Packages

                                                                                    1
                                                                                    T1546.016

                                                                                    Defense Evasion

                                                                                    Modify Registry

                                                                                    2
                                                                                    T1112

                                                                                    Pre-OS Boot

                                                                                    1
                                                                                    T1542

                                                                                    Bootkit

                                                                                    1
                                                                                    T1542.003

                                                                                    Subvert Trust Controls

                                                                                    1
                                                                                    T1553

                                                                                    Install Root Certificate

                                                                                    1
                                                                                    T1553.004

                                                                                    System Binary Proxy Execution

                                                                                    1
                                                                                    T1218

                                                                                    Msiexec

                                                                                    1
                                                                                    T1218.007

                                                                                    Credential Access

                                                                                    Discovery

                                                                                    Peripheral Device Discovery

                                                                                    2
                                                                                    T1120

                                                                                    Query Registry

                                                                                    4
                                                                                    T1012

                                                                                    System Information Discovery

                                                                                    3
                                                                                    T1082

                                                                                    System Location Discovery

                                                                                    1
                                                                                    T1614

                                                                                    System Language Discovery

                                                                                    1
                                                                                    T1614.001

                                                                                    System Time Discovery

                                                                                    1
                                                                                    T1124

                                                                                    Lateral Movement

                                                                                    Collection

                                                                                    Command and Control

                                                                                    Exfiltration

                                                                                    Impact

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Config.Msi\e57d0ed.rbs
                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      eccea7352daa870f38bc8191eba406b1

                                                                                      SHA1

                                                                                      faeae4b684ed51d74b6b6f91d0e4dd6245039588

                                                                                      SHA256

                                                                                      4956f6607c35350c6689b0ee328342841a279b77c439e59b5d06ccfc2f23499d

                                                                                      SHA512

                                                                                      d334000baf5145f05aec9751f5578e48d76305d86aac0598dae4d174a4edaf234d21500a12946845cc17f53cbd07446a558fe02e162d8935bd47e7cd3acbe289

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d0f2.rbs
                                                                                      Filesize

                                                                                      74KB

                                                                                      MD5

                                                                                      2935f71bb9fab6c44ebd4cfdcb11d60d

                                                                                      SHA1

                                                                                      530c8d580f21f44e2c36158c738b672660910f7a

                                                                                      SHA256

                                                                                      db34032560ea43da485ff32318a2b8fec92590fa6bf2a21a303b66bc0f090e67

                                                                                      SHA512

                                                                                      dc9cdd0a573bd50ffcfea5c84ff2c1ede9c2841a3339956d7ba4492bcb62067f9c12ee15bb93f70976b68ead4dc5f91c5e7e265d62e6c449b66052c8e8eb27be

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d0f4.rbs
                                                                                      Filesize

                                                                                      464B

                                                                                      MD5

                                                                                      bddd35c20ab3adb1576cd80f35116cb8

                                                                                      SHA1

                                                                                      7ea3de79efe8aefea20bbeebf51db2a44f6212e2

                                                                                      SHA256

                                                                                      edee670e2bc807c9eeb2fda57c39f109322021de97c6c34dffe9312d181e6b6f

                                                                                      SHA512

                                                                                      89fac38c150548374c35bd99010e320233ca78dcd42c3b33772eff6263f92f904e89ec815ba23ff98ad151b1442c673b87a6f8b5243dc4260fbff33cfafc2ab1

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d0fa.rbs
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      c1c7246c7a4886f38e6bb911af47fea9

                                                                                      SHA1

                                                                                      3cd5ce362cd96160895043c6a5950ec44e362c28

                                                                                      SHA256

                                                                                      65b2a36db51a698948130a2f3a06dce755b898d3c32bac24d2c3e31c83db4842

                                                                                      SHA512

                                                                                      a7c639c0a56443ec95332680d03e8bd821ba067e34b976acddbe73997b59df33b6c2c153cfad26dee042bbd5197a9b3112bd7a357a21edf989fdff381ae3e747

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d102.rbs
                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      e3c450f6b4cf0a86548b97dca8f2fdc7

                                                                                      SHA1

                                                                                      d6b1550c83b735d748a368e50d3bb5d46f3de38f

                                                                                      SHA256

                                                                                      c42d26c5ee5fa08fc2e660558514508882266ced0d2e3c81212d656b938e2ec8

                                                                                      SHA512

                                                                                      82161f63d0896eadd13ec7fca270089eefc3a090df1bc68f6a1614ce6479e83e7086403500788b95b0a71040a081a63bfd97c342fb20046949dc53c1ee7f35f5

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d107.rbs
                                                                                      Filesize

                                                                                      48KB

                                                                                      MD5

                                                                                      a37f653fad7d99f067a5aafbb7701bbd

                                                                                      SHA1

                                                                                      55ca7f3ce815df98e6627f50de5ba6f4f5dd6c74

                                                                                      SHA256

                                                                                      3076d8c0b9ed169384779492fc87cdbe996c62cadced9c4d923efbd624bcd621

                                                                                      SHA512

                                                                                      d5ccb0502558e3a99d401a825b7f5b17fbb664adee1bdfc11a06e406acb66585873e20bd932af9dea4d3fb00617060a519d8dbcb66b5137b699c26b37ed603ff

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d10c.rbs
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      c99778bf110bf1283c19a0c1594645de

                                                                                      SHA1

                                                                                      b61f7c87deba92888c3ae742566e7a4545c1bf9d

                                                                                      SHA256

                                                                                      c71a64127e3c0858fdfdf8d7798c2f95c63b30a1b1d10d328804d218184658ff

                                                                                      SHA512

                                                                                      464deb3a80d7476ae566c92da76f0f3ac04608b5b2902b226bb875d5255b6f32f9ca581146a604f335f240f182566cabcccddc2922925cf7f806d2c5be38e0af

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d111.rbs
                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      2ee532221836698f3570548c97d86d68

                                                                                      SHA1

                                                                                      ee767c3e4e645faf86c76559023b31287e5bc89e

                                                                                      SHA256

                                                                                      37849e2ae603ca39364c9551a4fde07526cb2036fd352a6b50ff6438b6df73a5

                                                                                      SHA512

                                                                                      8880fb2767d43f20f93fb93e86fafb4196efcb9ccfa86dfd87836cf349860017448de41f2608389265a57d04679519860e8a5c0a4fb66bac4ad0f7eea4558ee3

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d116.rbs
                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      f0ff300461ae018a61a05ecdf1ad1f8e

                                                                                      SHA1

                                                                                      a887b3c5ec693f5573eccc40d694cff44f9840fd

                                                                                      SHA256

                                                                                      e55cf748118e79b0ae49bcdb5b558bbcf9d2b3e20877c71a897b70d2f7980328

                                                                                      SHA512

                                                                                      30adf84d43c270fe4ee803fd1698da70bf8658d87aa649b34297f2337c390b3ed36cae5019c849c1e0f37087eba3ab2195f1c8275f65200be0c35cb2e347947a

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d117.rbf
                                                                                      Filesize

                                                                                      143KB

                                                                                      MD5

                                                                                      33b4c87f18b4c49114d7a8980241657a

                                                                                      SHA1

                                                                                      254c67b915e45ad8584434a4af5e06ca730baa3b

                                                                                      SHA256

                                                                                      587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662

                                                                                      SHA512

                                                                                      42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

                                                                                      Download Submit

                                                                                    • C:\Config.Msi\e57d118.rbf
                                                                                      Filesize

                                                                                      3B

                                                                                      MD5

                                                                                      21438ef4b9ad4fc266b6129a2f60de29

                                                                                      SHA1

                                                                                      5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

                                                                                      SHA256

                                                                                      13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

                                                                                      SHA512

                                                                                      37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      3840b31c383fdf49bfd6740d945c9032

                                                                                      SHA1

                                                                                      a6f50164a69718bcef4664d7c47534f0d721866a

                                                                                      SHA256

                                                                                      1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                                                      SHA512

                                                                                      f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                                      Filesize

                                                                                      142KB

                                                                                      MD5

                                                                                      477293f80461713d51a98a24023d45e8

                                                                                      SHA1

                                                                                      e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                                      SHA256

                                                                                      a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                                      SHA512

                                                                                      23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      b3bb71f9bb4de4236c26578a8fae2dcd

                                                                                      SHA1

                                                                                      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                                      SHA256

                                                                                      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                                      SHA512

                                                                                      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                                      Filesize

                                                                                      210KB

                                                                                      MD5

                                                                                      c106df1b5b43af3b937ace19d92b42f3

                                                                                      SHA1

                                                                                      7670fc4b6369e3fb705200050618acaa5213637f

                                                                                      SHA256

                                                                                      2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                                      SHA512

                                                                                      616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                                      Filesize

                                                                                      693KB

                                                                                      MD5

                                                                                      2c4d25b7fbd1adfd4471052fa482af72

                                                                                      SHA1

                                                                                      fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                                      SHA256

                                                                                      2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                                      SHA512

                                                                                      f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                                      Filesize

                                                                                      146KB

                                                                                      MD5

                                                                                      8d477b63bc5a56ae15314bda8dea7a3a

                                                                                      SHA1

                                                                                      3ca390584cd3e11172a014784e4c968e7cbb18f5

                                                                                      SHA256

                                                                                      9eec91cdd39cbb560ad5b1d063df67088f412da4b851ae41e71304fb8a444293

                                                                                      SHA512

                                                                                      44e3d91ad96b4cb919c06ccb91d3c3e31165b2412e1d78bfbaca0bee6f0c1a3253b3e3ddf19009cebf12c261a0392f6a0b7091cf8aba1d0cc4c1ed61c1b6dc42

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                                      Filesize

                                                                                      145KB

                                                                                      MD5

                                                                                      2b9beb2fdbc41afc48d68d32ef41dd08

                                                                                      SHA1

                                                                                      4a9ea4cf8e02e34ef2dd0ef849ffc0cd9ea6f91c

                                                                                      SHA256

                                                                                      977d48979e30a146417937d7e11b26334edec2abddfae1369a9c4348e34857b1

                                                                                      SHA512

                                                                                      3e3c3e39ff2df0d1ed769e6c5acba6f7c5d2737d3c426fb4f0e19f3cf6c604707155917584e454a3f208524ed46766b7a3d2d861fa7419f8258c3b6022238e10

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                                      Filesize

                                                                                      51KB

                                                                                      MD5

                                                                                      3180c705182447f4bcc7ce8e2820b25d

                                                                                      SHA1

                                                                                      ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                                      SHA256

                                                                                      5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                                      SHA512

                                                                                      228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                                      Filesize

                                                                                      12B

                                                                                      MD5

                                                                                      1e065e191e89cc811ff49c96fa8fa5e6

                                                                                      SHA1

                                                                                      bc50ff2a20a8b83683583684fcac640a91689ed4

                                                                                      SHA256

                                                                                      d88faf6d47342587ea5fbcaf2ef88fb403f7fcdc08fcab67d4f4f381c237a61e

                                                                                      SHA512

                                                                                      5a710e168316c30ca10f7b126e870621f46cca6200e206a9984d144abd11fea045bc475599b18597bbed1e4f00e832d94576837f643b22ffaee56871629290dd

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                                      Filesize

                                                                                      247KB

                                                                                      MD5

                                                                                      aa5cf64d575b7544eefd77f256c4dc57

                                                                                      SHA1

                                                                                      bd23989db4f9af0aae34d032e817d802c06ca5a9

                                                                                      SHA256

                                                                                      79c5afd94d0ffa3519a90e691a6d47f9c2eec93277f7d369aa34e64b171fc920

                                                                                      SHA512

                                                                                      774aeb5188c536d556a8c7a0cd3dfd9ab22d7bc0ad13353d11c9153232585da352552a69eb967a741372a99db490df355a5a47696b2ea446582c834c963cfeff

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                                      Filesize

                                                                                      546B

                                                                                      MD5

                                                                                      158fb7d9323c6ce69d4fce11486a40a1

                                                                                      SHA1

                                                                                      29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                                      SHA256

                                                                                      5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                                      SHA512

                                                                                      7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                                      Filesize

                                                                                      94KB

                                                                                      MD5

                                                                                      c69c7690482c75a8fc70df2990d7afc6

                                                                                      SHA1

                                                                                      79d72d32a03151823bbf0953d5c2ce6bc2bde4b1

                                                                                      SHA256

                                                                                      580415595e5936d5f3945e9eeee63f6f4dbacd327aa46e2b7625b638715c27f5

                                                                                      SHA512

                                                                                      ed80ade3519345552ca74958efc9c122de840d2844baa08c94400f15168b6fc25377628a55ed12488ea790aaa40bc5bb77b6586de4f1ecd296902bbe36fba4f4

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                                      Filesize

                                                                                      688KB

                                                                                      MD5

                                                                                      111e2e63bccead95bb5ffc53c9282070

                                                                                      SHA1

                                                                                      eaae7df21e291aa089bc101b1e265ca202be1225

                                                                                      SHA256

                                                                                      9615fe5fe63c48b13ffd8c9bc76170a9ed1cfea6a3d0901e857a1c6c6edaea76

                                                                                      SHA512

                                                                                      ffc818615fb30e24633c90b8f5a55c100b5f307414ec54e5a2914bb4ea36d3fb3aa6ed0e5815976a2f6d1b7f056e7da1f108a8eed81b458decebe721ad30b920

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      797c9554ec56fd72ebb3f6f6bef67fb5

                                                                                      SHA1

                                                                                      40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                                      SHA256

                                                                                      7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                                      SHA512

                                                                                      4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                                      Filesize

                                                                                      214KB

                                                                                      MD5

                                                                                      01807774f043028ec29982a62fa75941

                                                                                      SHA1

                                                                                      afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                                      SHA256

                                                                                      9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                                      SHA512

                                                                                      33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                                      Filesize

                                                                                      37KB

                                                                                      MD5

                                                                                      efb4712c8713cb05eb7fe7d87a83a55a

                                                                                      SHA1

                                                                                      c94d106bba77aecf88540807da89349b50ea5ae7

                                                                                      SHA256

                                                                                      30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                                      SHA512

                                                                                      3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                                      Filesize

                                                                                      3.4MB

                                                                                      MD5

                                                                                      93e4c198656fc267f392de11dee01cd0

                                                                                      SHA1

                                                                                      e92cb59486745ee7564f5b374e790a065e1f4678

                                                                                      SHA256

                                                                                      88b220f9f9bf25f856dda714aa1a1ae998720780cd3ec5b968154e03834fa965

                                                                                      SHA512

                                                                                      3a04a02982dbbbb9d54b6c5674f2f2c10e0cbce580e3974cd924cc9131cd94aece71c7b975c9abaae82f057c70243fb016d31339e8700c96bd55c434bb98105f

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                                      Filesize

                                                                                      397KB

                                                                                      MD5

                                                                                      810f893e58861909b134fa72e3bc90cd

                                                                                      SHA1

                                                                                      524977f32836634132d23997b23304574d8d156a

                                                                                      SHA256

                                                                                      b83b6c1f64b6700d7444586a6214858a1479c58571f5e7bf4f023166c9016733

                                                                                      SHA512

                                                                                      db463d34a37403a9248d463ae63989b40a0172d9543bda922dacb10a624eb603700628a67d9c86df2605c36d789902ec79228aa29f26c49be0195c54a9e4a191

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                      Filesize

                                                                                      48KB

                                                                                      MD5

                                                                                      c9d388217c9323853f2a240f58407ecb

                                                                                      SHA1

                                                                                      ea595aff4071cdb9bcca42845844dc1c52ddb013

                                                                                      SHA256

                                                                                      4b59ea82a4475a3e1ab98150787e501ee9d4f304d081c26956e88837677a186c

                                                                                      SHA512

                                                                                      bfa26ff1db662ce1d185818b3d6b4a9923e50ae4f21e158d0f1c602a299a5d6cc1ca40558731a1ea87b9249ccba252158de78b37c1d23595a4a2843d4b75e730

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                                      Filesize

                                                                                      197KB

                                                                                      MD5

                                                                                      d0d21e16e57a1a73056eae228da1e287

                                                                                      SHA1

                                                                                      ab5a27b1d3d977a7f657d0acdf047067c625869f

                                                                                      SHA256

                                                                                      3db5809f23020f9988d5db0cf494f014a87b9dc1547cf804ae9d66667505a60c

                                                                                      SHA512

                                                                                      470bac3e691525ff6007293bac32198c0021a1411ba9d069f88f8603189b1617c2265fe6553c1f60ef788e69afcb8aa790714c59260b7c015a5be5b149222c48

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                                      Filesize

                                                                                      56KB

                                                                                      MD5

                                                                                      d0aa95693d78fd438552bd9df01fec78

                                                                                      SHA1

                                                                                      0e7173c1af5d5543d5a41aed690e59f3ae4bb0b9

                                                                                      SHA256

                                                                                      11201ece7c3ee4bbcde0b84a2bc7c251ef57fce5200b2a1ae437fc959c7ad8a7

                                                                                      SHA512

                                                                                      7b48864e72627bb51063ea49f6459eb6c05baa64066d8e6c85f2ff7b7de26b633ff973e2a830da63b6824eaea65690e3f6b29af8adbc0c24724016a8764f3b15

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      9d1528a2ce17522f6de064ae2c2b608e

                                                                                      SHA1

                                                                                      2f1ce8b589e57ab300bb93dde176689689f75114

                                                                                      SHA256

                                                                                      11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                                      SHA512

                                                                                      a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.4328.update
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      14ffcf07375b3952bd3f2fe52bb63c14

                                                                                      SHA1

                                                                                      ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                                      SHA256

                                                                                      6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                                      SHA512

                                                                                      14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      af2322452a113ec26899346a5dbb6e3d

                                                                                      SHA1

                                                                                      73211c8b1967c79be188dda42e7c06356b8339d0

                                                                                      SHA256

                                                                                      f597fafb91fc1b193e6d69ac0bce47ddbd542ce43386bbd30d58f5aee2363ea3

                                                                                      SHA512

                                                                                      db917c20a820c1f414220e2ed5d3af90a11a858768beb44b55d37f2e4e64aebaeb55bb337864b6b8055449d91d3c273899e478d24704e2ae02b9b4f7f9df0583

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      81051bcc2cf1bedf378224b0a93e2877

                                                                                      SHA1

                                                                                      ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                                      SHA256

                                                                                      7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                                      SHA512

                                                                                      1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                                      Filesize

                                                                                      54KB

                                                                                      MD5

                                                                                      77c613ffadf1f4b2f50d31eeec83af30

                                                                                      SHA1

                                                                                      76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                                      SHA256

                                                                                      2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                                      SHA512

                                                                                      29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                                      Filesize

                                                                                      333KB

                                                                                      MD5

                                                                                      745714d838c4d4f88c6e0db6a434f444

                                                                                      SHA1

                                                                                      90689ce709bf2464b678c7afa7b1e18f080d52bb

                                                                                      SHA256

                                                                                      e35302995dad1d5e4b7147d8763f7262500271cf01eac8edfa896b392ac7139f

                                                                                      SHA512

                                                                                      08cbfac0b604530108978c757ad8481c69ed62deac5520777bacee9751f3f260d2c3158609fd723819d8d6626c46b302fe7da7005efc09ab571871ac9d58a0ed

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                                      Filesize

                                                                                      70KB

                                                                                      MD5

                                                                                      e9b3a59f67febdd7f8fbe68d71c5d0ab

                                                                                      SHA1

                                                                                      22bd3ec3f8e0be2f317ade9d553acdb3ea11f52e

                                                                                      SHA256

                                                                                      bff4de54dacec104e1e63659857ca99d3e9658dcc09d6e1cbf54dc7b22629cbf

                                                                                      SHA512

                                                                                      00e95ea600777025a30e23c755522b869320ca445ac5bd74f123306457d0793efa338220cba9d064e5d25cc3dcf19d66e4e48d3a1c72d196eeb77fb61e4b0688

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                                      Filesize

                                                                                      50KB

                                                                                      MD5

                                                                                      5bb0687e2384644ea48f688d7e75377b

                                                                                      SHA1

                                                                                      44e4651a52517570894cfec764ec790263b88c4a

                                                                                      SHA256

                                                                                      963a4c7863beae55b1058f10f38b5f0d026496c28c78246230d992fd7b19b70a

                                                                                      SHA512

                                                                                      260b661f52287af95c5033b0a03ac2e182211d165cadb7c4a19e5a8ca765e76fc84b0daf298c3eccb4904504a204194a9bf2547fc91039c3ec2d41f9977ff650

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                                      Filesize

                                                                                      32KB

                                                                                      MD5

                                                                                      2ec1d28706b9713026e8c6814e231d7c

                                                                                      SHA1

                                                                                      7ef12a01182d28a5ebf049cc1cb80619cd1e391a

                                                                                      SHA256

                                                                                      c9514bf67df87ac6cc1002f3585d5b6f7d4093a7a794d524fa8c635f052733de

                                                                                      SHA512

                                                                                      9e23588dc6d721f42e309974c3f3089f845f10d1dee87fb26213ba3810ee3c272d758632cf1c9157f6862ba0e582afc49c1ee51540461f41840650f216f35aeb

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                                      Filesize

                                                                                      59KB

                                                                                      MD5

                                                                                      26c25e48b69eb8df7d6cea01fd66f3df

                                                                                      SHA1

                                                                                      d70e92a8b8d358c7a2e200b11e23703cf43d93e9

                                                                                      SHA256

                                                                                      f6da2cc4a4ca0a4cff92a2c9f61e546255bfe9d02eb1087a033b1a45e06fec87

                                                                                      SHA512

                                                                                      6414db6ba626fe4b39155052638a15707cf60836056560fceeb5a1ea8faee1bee830840900f1635ff5a0ce1d271f73062660bd0ec582815e0bc56f4997a45feb

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                                      Filesize

                                                                                      588KB

                                                                                      MD5

                                                                                      17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                                      SHA1

                                                                                      bc0316e11c119806907c058d62513eb8ce32288c

                                                                                      SHA256

                                                                                      13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                                      SHA512

                                                                                      f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                                      Filesize

                                                                                      218B

                                                                                      MD5

                                                                                      521e78ef3a79503774e3669abb6c316b

                                                                                      SHA1

                                                                                      5d0179764d045e3e792392c91e950215a779931c

                                                                                      SHA256

                                                                                      7ebfe2f0814819d706c34186675144848f3c770a66b041c8da0daa3c60d4a5f2

                                                                                      SHA512

                                                                                      3984dae066e5cf611b955881033aad2009d0167545e828934069b3cb9a5f13745ddda8db63bf628bc5f025d364a0b608dd4c26fe4c0d69513b8330ba8c69feee

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      1ef7574bc4d8b6034935d99ad884f15b

                                                                                      SHA1

                                                                                      110709ab33f893737f4b0567f9495ac60c37667c

                                                                                      SHA256

                                                                                      0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                                      SHA512

                                                                                      947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                                      Filesize

                                                                                      10KB

                                                                                      MD5

                                                                                      f512536173e386121b3ebd22aac41a4e

                                                                                      SHA1

                                                                                      74ae133215345beaebb7a95f969f34a40dda922a

                                                                                      SHA256

                                                                                      a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                                      SHA512

                                                                                      1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                                      Filesize

                                                                                      76KB

                                                                                      MD5

                                                                                      b40fe65431b18a52e6452279b88954af

                                                                                      SHA1

                                                                                      c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                                      SHA256

                                                                                      800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                                      SHA512

                                                                                      e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                                      Filesize

                                                                                      80KB

                                                                                      MD5

                                                                                      3904d0698962e09da946046020cbcb17

                                                                                      SHA1

                                                                                      edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                                      SHA256

                                                                                      a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                                      SHA512

                                                                                      c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                                      Download Submit

                                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                                                      Filesize

                                                                                      92KB

                                                                                      MD5

                                                                                      9fb20bd27a3a07c866d79f0d07b35381

                                                                                      SHA1

                                                                                      ff6be95664a6b34bbe7d62e0b938ad648adad27e

                                                                                      SHA256

                                                                                      d34d36ecc1c1de29a1849899e5eed156cd3774fd30d0dbcd56cbf897ac683d75

                                                                                      SHA512

                                                                                      9e3f729bd15463f5eb8c8cf76b1a59523ca70439c61a8d8dd8dc478d5d05439223fb772bd75096bb331f3158fd81a5f7d0675bd3dd7716705f55a68fbefcf7a7

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                                      Filesize

                                                                                      433B

                                                                                      MD5

                                                                                      cf5f69533151675ab4f248fbc8cdedeb

                                                                                      SHA1

                                                                                      eb736e17118ac79e341b49eb29ea04433e65e66f

                                                                                      SHA256

                                                                                      e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                                                      SHA512

                                                                                      e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                                      Filesize

                                                                                      717B

                                                                                      MD5

                                                                                      ef0a07aec4367a64c16c581da2657aa9

                                                                                      SHA1

                                                                                      13011a5abcbadb3424fb6ecee560665556bb1d24

                                                                                      SHA256

                                                                                      f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                                                      SHA512

                                                                                      35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                                      Filesize

                                                                                      7KB

                                                                                      MD5

                                                                                      362ce475f5d1e84641bad999c16727a0

                                                                                      SHA1

                                                                                      6b613c73acb58d259c6379bd820cca6f785cc812

                                                                                      SHA256

                                                                                      1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                                      SHA512

                                                                                      7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability.zip
                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      40df7f2a02cdfa70ae76d70d21473428

                                                                                      SHA1

                                                                                      4baddbc082fdb197c77bc1c232be2881a82a7ec8

                                                                                      SHA256

                                                                                      f037309cf6b0174ba282106da31c141e3912486c69c438a53afe7ff589743dc2

                                                                                      SHA512

                                                                                      2522483e9d1b9fc20f14ffab3dcb2a9e5735a260e08e7196a05319076ad9b4d7a9fe94b28c52559022f003d2fe55ec5e4abcecb1b11f4000e804dae5b1c0126f

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                                      Filesize

                                                                                      1.8MB

                                                                                      MD5

                                                                                      5ed9543e9f5826ead203316ef0a8863d

                                                                                      SHA1

                                                                                      8235c0e7568ec42d6851c198adc76f006883eb4b

                                                                                      SHA256

                                                                                      33583a8e2dcf039382e80bfa855944407bcba71976ec41c52810cb8358f42043

                                                                                      SHA512

                                                                                      5b4318ddc6953f31531ee8163463259da5546f1018c0fe671280337751f1c57398a5fd28583afba85e93d70167494b8997c23fee121e67bf2f6fb4ca076e9d9f

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                                      Filesize

                                                                                      1.1MB

                                                                                      MD5

                                                                                      9a9b1fd85b5f1dcd568a521399a0d057

                                                                                      SHA1

                                                                                      34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                                      SHA256

                                                                                      88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                                      SHA512

                                                                                      7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                                      Filesize

                                                                                      383KB

                                                                                      MD5

                                                                                      f6f297c704f4f4c13d50f971daea3b56

                                                                                      SHA1

                                                                                      118581c847ea863ff8bca0a38b5469577ac6b227

                                                                                      SHA256

                                                                                      a92e1c423c30b6bb4c73f8807890b6020e12cad4143ebf6548d6562cd04f0b4b

                                                                                      SHA512

                                                                                      b312447f381d48b68308b68cd841a4274897fe4e4bd5ea3fcdfd598a6926db1ad43443bf7c0b103fdf06e1b511f5ea1b2e8018abc62a39b9b7f2d4be17a7c848

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                                      Filesize

                                                                                      321KB

                                                                                      MD5

                                                                                      d3901e62166e9c42864fe3062cb4d8d5

                                                                                      SHA1

                                                                                      c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                                      SHA256

                                                                                      dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                                      SHA512

                                                                                      ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                                      Filesize

                                                                                      814KB

                                                                                      MD5

                                                                                      9b1f97a41bfb95f148868b49460d9d04

                                                                                      SHA1

                                                                                      768031d5e877e347a249dfdeab7c725df941324b

                                                                                      SHA256

                                                                                      09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                                      SHA512

                                                                                      9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                                      Filesize

                                                                                      1.2MB

                                                                                      MD5

                                                                                      e74d2a16da1ddb7f9c54f72b8a25897c

                                                                                      SHA1

                                                                                      32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                                      SHA256

                                                                                      a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                                      SHA512

                                                                                      52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                                      Filesize

                                                                                      12B

                                                                                      MD5

                                                                                      a6bd887ee94e12d3c42a5d47b4c73826

                                                                                      SHA1

                                                                                      6b30541a5b528ff8a8befdb5cab0b9dccf4b2491

                                                                                      SHA256

                                                                                      643d32f1b400e5cdc5b76067eac006167c07b321d5abd06b30f1a45e9fe2253c

                                                                                      SHA512

                                                                                      ec86b4beda8995c13f550ce0f1c60b7bf384f706d37c516a12c6e6d6e0040bc11f72e9af09117d78b46bb799e9e41f4f6b2e78b84c2cf087ac76a1eb94986171

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                      Filesize

                                                                                      48KB

                                                                                      MD5

                                                                                      468203ede178192cef954f2923eac07a

                                                                                      SHA1

                                                                                      d5fdaf5195acd18e293088484c522e408916c3b3

                                                                                      SHA256

                                                                                      3056be0f4cca3bc68a8db162fd2d8c6d515b3964760225daf182f9be7595cda7

                                                                                      SHA512

                                                                                      66df734e31625ee916f7e1ba09022a24098a18ce9f6c45486021cdf26d276d828316cf8b17f886c950c73ce3106945b6b9bf7fde8afd5b4dc78ad8c5977ff6ea

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                      Filesize

                                                                                      48KB

                                                                                      MD5

                                                                                      6c57a897c2381295dab71791d915a070

                                                                                      SHA1

                                                                                      c6ca295d868c234376d6e01c1635d54fa947f5ed

                                                                                      SHA256

                                                                                      3cbf1f8bf5d9b21aa8409f97e9dad1821ad5362f5a4f9caf6855159c5a773651

                                                                                      SHA512

                                                                                      5df984c909fd6e3d68ad3889389baea2e9843e2bb4c62e3262f4599596b42d08c8bdd3d9d2df2d980de49cacc50cf375c6223e14613cbc2b26c7e505d750f76f

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                                      Filesize

                                                                                      2.8MB

                                                                                      MD5

                                                                                      ab8d85c093d6f0180bf09ec0f466b78b

                                                                                      SHA1

                                                                                      1daf355d14d45b1e411f96fa394a98a84c09e53e

                                                                                      SHA256

                                                                                      d1e08c8dbf3bfc34e3fdfc390d2e7f5b871f95376e7dda93e3dd0051d580db40

                                                                                      SHA512

                                                                                      2882292301e1fb85b410570ece6cf05f3e89968a02450dba192a1f97282f1c08ed30819e3d36c524fba3baeb6a2c22a10a762c8313e8823c07554b4b975cc00e

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.ini
                                                                                      Filesize

                                                                                      12B

                                                                                      MD5

                                                                                      9a5e9a329e4e73e0c499371205a810db

                                                                                      SHA1

                                                                                      5b6d85657d4acd89867283fbe372e9e85c30686f

                                                                                      SHA256

                                                                                      d109087c4ca318cad74b7560c32594d37181885adbdc9348ba1dd35d47b35b92

                                                                                      SHA512

                                                                                      02bd5261b9e795ed5a07badd65a6cf71d18751452fb44bdd424dfcc6c50ba7441e0066b125e731018fd6f1a8a002ac4e6961c7eff21c36fbda58c8015a100c43

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                                      Filesize

                                                                                      2.9MB

                                                                                      MD5

                                                                                      f39fbf03ca870084bde8bfd5e6e1ec39

                                                                                      SHA1

                                                                                      00febae56b76f76166fa64a0c0dc746b9feb61e4

                                                                                      SHA256

                                                                                      1c2761c31cf551a7b3034618fd0018d1a304bbcb97383d2bb13c47aeb8b23c60

                                                                                      SHA512

                                                                                      4c974603fb33e3711dc7f28e4580fef2a197ee1abfcc2c2384e4053c939847fa94b5d27a44ca6ad1fc8799dd80c2cc975c87e55e15902786e4b1e8dbe362bf7a

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.ini
                                                                                      Filesize

                                                                                      12B

                                                                                      MD5

                                                                                      98bfec9955150d3ac5ef2e72c167b714

                                                                                      SHA1

                                                                                      9542c4697ed1d6677497271ad1e59383481dbcce

                                                                                      SHA256

                                                                                      319f0b3871f6dbb8a8ada2d5bc077f43c8f0513eead866f3d116d5f317877a09

                                                                                      SHA512

                                                                                      767837490f41f9b3af4aa99248cf89606d88b2808f8d0b14bd8507f14162b42bcba1f9c067966f6493541b59541febf6b494854fe6bbdb78dcf581d41ab91696

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                                      Filesize

                                                                                      1.1MB

                                                                                      MD5

                                                                                      6c6f85e896655a6eb726482f04c49086

                                                                                      SHA1

                                                                                      2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                                      SHA256

                                                                                      e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                                      SHA512

                                                                                      b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.ini
                                                                                      Filesize

                                                                                      11B

                                                                                      MD5

                                                                                      5eda46a55c61b07029e7202f8cf1781c

                                                                                      SHA1

                                                                                      862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                                      SHA256

                                                                                      12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                                      SHA512

                                                                                      4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                                      Filesize

                                                                                      541B

                                                                                      MD5

                                                                                      d0efb0a6d260dbe5d8c91d94b77d7acd

                                                                                      SHA1

                                                                                      e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                                                      SHA256

                                                                                      7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                                                      SHA512

                                                                                      a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                                      Filesize

                                                                                      12B

                                                                                      MD5

                                                                                      880d31390a25de6a9cd34463b46c75e6

                                                                                      SHA1

                                                                                      837af65938c9606b5de3c6f2195fc3e855554cd7

                                                                                      SHA256

                                                                                      425adf50cf113d68bd6aa8dc1015db43422bbc1c977933d5f8c1ecaabf18eb2e

                                                                                      SHA512

                                                                                      8e9dd066ff73625a5a55d1ece5ba1e4fb248ab14a32880a3d4d86266176cb4f1c61f8301e1ff49839c283affe877b9fbcd3bc2b9763c08b0b63ba56023c2282b

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                                      Filesize

                                                                                      670KB

                                                                                      MD5

                                                                                      96e50bbca30d75af7b8b40acf8dda817

                                                                                      SHA1

                                                                                      4b1255280dff8de8b7be47def58f83f6ec39ded6

                                                                                      SHA256

                                                                                      a3ad00ccb61bc87d58eb7977f68130b78a0b95e74d61e6a4624ac114ccde5736

                                                                                      SHA512

                                                                                      0034c08cb878b703f272e3fd2734bb928ff1bdba85cf79a151519b019c83bd4d199c80af0aa30db28ef82f7ee68a9d59dcaede92f83bfe8787f6a5d4d5e9817c

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                                      Filesize

                                                                                      3.1MB

                                                                                      MD5

                                                                                      8e70af11d0ee2abe139b40d67e70b73c

                                                                                      SHA1

                                                                                      18582e88e16255d5d267904bdf0357ec9ff333e0

                                                                                      SHA256

                                                                                      5c687adaa48b83de220e8489e0ceb0093be1f94260750c8d94a1b8497781327e

                                                                                      SHA512

                                                                                      3a845ed4ab368b0dde7e98d77fb796e9070f6bb9472ea833e52b19eb5bd47260e0b288fd3c8d19235bd9ded6f7b11ea10985ad871c8f5c82751249301d3ee4a6

                                                                                      Download Submit

                                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                                      Filesize

                                                                                      572KB

                                                                                      MD5

                                                                                      7062f2490fde7624ceab2fac6a996b98

                                                                                      SHA1

                                                                                      63a355ebf702bd6fb4e10f4353e5dbaa036ff635

                                                                                      SHA256

                                                                                      dbf3e40e068c22a995bb917ef51153bf1d4dd06ab8a5bb5486ea017245edbf1c

                                                                                      SHA512

                                                                                      5674e823473887669a1d12ecea9f7569633fb885f570b3c7bd8fbb706b214c564a0aaf0bedebd0a61add76582316c7de9a2f5af5b4cd8d04f426d80987f2d7b3

                                                                                      Download Submit

                                                                                    • C:\Program Files\dotnet\dotnet.exe
                                                                                      Filesize

                                                                                      143KB

                                                                                      MD5

                                                                                      71026b098f8fb39c88b003df746d9fa0

                                                                                      SHA1

                                                                                      013ca259f551ad6f33db53fff0e121e74408e20e

                                                                                      SHA256

                                                                                      11058e8c2cd05f30dcf1775644bf19d2913c9a6d674c12f91d1896d95d9cc5c2

                                                                                      SHA512

                                                                                      9830be3444225a4b2f9fa4aedbc8af4f45fdb2548f0b6a2eba2a2a407ea3c7d8fd78c0e37fac66cafbdfad781ae78b076d225fd5c836a451f57a54053ccef9ad

                                                                                      Download Submit

                                                                                    • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\dd3a9a0accee26c21df5bc76ba33a70d
                                                                                      Filesize

                                                                                      16KB

                                                                                      MD5

                                                                                      b2e89027a140a89b6e3eb4e504e93d96

                                                                                      SHA1

                                                                                      f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                                      SHA256

                                                                                      5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                                      SHA512

                                                                                      93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                                      Download Submit

                                                                                    • C:\ProgramData\chocolatey\config\chocolatey.config
                                                                                      Filesize

                                                                                      809B

                                                                                      MD5

                                                                                      8b6737800745d3b99886d013b3392ac3

                                                                                      SHA1

                                                                                      bb94da3f294922d9e8d31879f2d145586a182e19

                                                                                      SHA256

                                                                                      86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                                      SHA512

                                                                                      654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                                      Download Submit

                                                                                    • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      24356cce3271bed1a132c6285455cf64

                                                                                      SHA1

                                                                                      b5277f2236dab8c1ba9bfc2ddec3456fdbcbbaa3

                                                                                      SHA256

                                                                                      88814c04746618d0235084657ebeef8e0a8e5313412ae01108f85c2cd510e44b

                                                                                      SHA512

                                                                                      7fd006fbf6eeed11eed7792b8f6e90a23ac6cb960bd46a174e68cef02527cec5c60267122d2aba5865765d5ccd5d37a822da00529af347ba2b6de8053d53d975

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                      Filesize

                                                                                      471B

                                                                                      MD5

                                                                                      a92359bcd40ab68df3b2a726b293703e

                                                                                      SHA1

                                                                                      03af49fbe93ce7312ceb352c712941d1ac5fd2f0

                                                                                      SHA256

                                                                                      e61fca89129e6e9eecaafaa8612f1d82efb267b900a8ca27427fa0b32e065c63

                                                                                      SHA512

                                                                                      f2f2ff4c354ce68642ec37357e40c28cfc2449bfa9971ffe59c800a50287f8a39b5729a6fb2aaf8f23b9f45ea3e478a9f12dbba0479d93e4c2c598263aa7ce92

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                                      Filesize

                                                                                      727B

                                                                                      MD5

                                                                                      62f50b09757845b91a11afe304f912e7

                                                                                      SHA1

                                                                                      ca2093d46e2a9138ef71e5cb6d53d6ced356ec76

                                                                                      SHA256

                                                                                      9979dad90650f1a6d82d38cb84e4055e46b88f28bcc099b51cd5e2444cc280e9

                                                                                      SHA512

                                                                                      6b54ad0a12455914f3140a1f5341807cbd97470419109470eabab6cfa1083b703dfd19ea276caba534777bcc8265d80659e6d8db06bc03de57fb6fb3d9e68133

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                      Filesize

                                                                                      727B

                                                                                      MD5

                                                                                      7ede1c2319349ee09eef9b918f848ee1

                                                                                      SHA1

                                                                                      907bc671d8865713c6c6758ab35d880bc195cd26

                                                                                      SHA256

                                                                                      0091300b2b650fad4fdf32c8681ca431aa280403bb7afec50e1e3b2232537c9e

                                                                                      SHA512

                                                                                      673710e89af144f22a6a69011341e48681cf2b46ec58fa7ceed13688f3dfa17e5c8ea9f8054cb99c054864ec980fa0acebdb480ce9abf4d1d7a8ec46dcfb5866

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                      Filesize

                                                                                      400B

                                                                                      MD5

                                                                                      8af5c0857e95ff45dc47a844b86180dc

                                                                                      SHA1

                                                                                      4da49255fc4f4442b8e994936c8753749dfc2b04

                                                                                      SHA256

                                                                                      455b7788139dd121264037502d2c9cd795c34a5eaf9bae39a66d68c015cb82f4

                                                                                      SHA512

                                                                                      1c6adfb9337cfea4b0590137ca31236b6bddc6dbdf400330832615a9f8bb249ace9a7123f2a6fc2d3bcf79b3e3ea5f73eccea318abe2a6b4dec407d09da830af

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                                      Filesize

                                                                                      404B

                                                                                      MD5

                                                                                      b967d72097b70c96c6eff956830af407

                                                                                      SHA1

                                                                                      343478499de3f3ef74c76c565bf0eaa7ebd84379

                                                                                      SHA256

                                                                                      ec03662bdbea2f07e6dbb6a524800b02c61d35de2dd54bcaf591a381eaa4ce05

                                                                                      SHA512

                                                                                      807a52f42e48e29fa68345e855c28aeee7c3e456f1de27d6df8c7d5497817b4700f639cda1cfd6bcdc907f03444ad0e163922c20e10b479e17dd963ae060d2ad

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                      Filesize

                                                                                      412B

                                                                                      MD5

                                                                                      dfd7743d460005a56fbb44075b43dd39

                                                                                      SHA1

                                                                                      049b330112a5b7a81c399a83c85cf1810710d839

                                                                                      SHA256

                                                                                      eb1efe7ab38b7ab3c1f2c882de0e9a8101be5757dee367cd42e040dbf9a92f7f

                                                                                      SHA512

                                                                                      04e5563667e9e94d66aab6f9f6026dd19c9f83d04f06e63e7ab2815500d5c701dea8414d2125de91a8e5fcdd8f9ac5a85945339f14e600e5a61ac42ba477edf9

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                                      Filesize

                                                                                      651B

                                                                                      MD5

                                                                                      9bbfe11735bac43a2ed1be18d0655fe2

                                                                                      SHA1

                                                                                      61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                                      SHA256

                                                                                      549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                                      SHA512

                                                                                      a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSI41D5.tmp
                                                                                      Filesize

                                                                                      4.5MB

                                                                                      MD5

                                                                                      08211c29e0d617a579ffa2c41bde1317

                                                                                      SHA1

                                                                                      4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                                                      SHA256

                                                                                      3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                                                      SHA512

                                                                                      d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSI90A5.tmp-\System.Management.dll
                                                                                      Filesize

                                                                                      60KB

                                                                                      MD5

                                                                                      878e361c41c05c0519bfc72c7d6e141c

                                                                                      SHA1

                                                                                      432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                                      SHA256

                                                                                      24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                                      SHA512

                                                                                      59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSID1A8.tmp
                                                                                      Filesize

                                                                                      509KB

                                                                                      MD5

                                                                                      88d29734f37bdcffd202eafcdd082f9d

                                                                                      SHA1

                                                                                      823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                                      SHA256

                                                                                      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                                      SHA512

                                                                                      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSID1A8.tmp-\AlphaControlAgentInstallation.dll
                                                                                      Filesize

                                                                                      25KB

                                                                                      MD5

                                                                                      aa1b9c5c685173fad2dabebeb3171f01

                                                                                      SHA1

                                                                                      ed756b1760e563ce888276ff248c734b7dd851fb

                                                                                      SHA256

                                                                                      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                                      SHA512

                                                                                      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSID1A8.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                                      Filesize

                                                                                      179KB

                                                                                      MD5

                                                                                      1a5caea6734fdd07caa514c3f3fb75da

                                                                                      SHA1

                                                                                      f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                                      SHA256

                                                                                      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                                      SHA512

                                                                                      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSID4C6.tmp-\CustomAction.config
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      bc17e956cde8dd5425f2b2a68ed919f8

                                                                                      SHA1

                                                                                      5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                                      SHA256

                                                                                      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                                      SHA512

                                                                                      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSID4C6.tmp-\Newtonsoft.Json.dll
                                                                                      Filesize

                                                                                      695KB

                                                                                      MD5

                                                                                      715a1fbee4665e99e859eda667fe8034

                                                                                      SHA1

                                                                                      e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                                      SHA256

                                                                                      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                                      SHA512

                                                                                      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSIDB9F.tmp
                                                                                      Filesize

                                                                                      211KB

                                                                                      MD5

                                                                                      a3ae5d86ecf38db9427359ea37a5f646

                                                                                      SHA1

                                                                                      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                                      SHA256

                                                                                      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                                      SHA512

                                                                                      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\MSIDCC0.tmp
                                                                                      Filesize

                                                                                      219KB

                                                                                      MD5

                                                                                      928f4b0fc68501395f93ad524a36148c

                                                                                      SHA1

                                                                                      084590b18957ca45b4a0d4576d1cc72966c3ea10

                                                                                      SHA256

                                                                                      2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae

                                                                                      SHA512

                                                                                      7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\e57d0ec.msi
                                                                                      Filesize

                                                                                      2.9MB

                                                                                      MD5

                                                                                      6032d2452e05a12f1449182deb3ab258

                                                                                      SHA1

                                                                                      03a992f9020a003fe86e477ac28698afc16a73d3

                                                                                      SHA256

                                                                                      394659c01bd981c3a4d5840fbd624c20e3270c9defc432ff3fe6ddb482b5ad46

                                                                                      SHA512

                                                                                      1318d1844efe031d05499e642c9509422a9f92977b8b4c76d38c6c614d81813af4ec927d2dd807e9b7b205ab06ea1800eb4a082f1a89a4e3721a37301165e28d

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\e57d108.msi
                                                                                      Filesize

                                                                                      26.3MB

                                                                                      MD5

                                                                                      b9c6d23462adef092b8a5b7880531b03

                                                                                      SHA1

                                                                                      9e8c4f7f48d38fb54a93789a583852869c074f2d

                                                                                      SHA256

                                                                                      2e23da54aa1ff64de09021ab089c1be6d4a323bdf0d8f46f78b5c6a33df83109

                                                                                      SHA512

                                                                                      18623991c5690e516541eaf867f22b3a1a02317392178943143bedc7f7eda5e02e69665c3c4a5fa50ade516a191bbbf16fd71e60f3225f660fb10ebc25cd01a5

                                                                                      Download Submit

                                                                                    • C:\Windows\Installer\e57d109.msi
                                                                                      Filesize

                                                                                      772KB

                                                                                      MD5

                                                                                      d73de5788ab129f16afdd990d8e6bfa9

                                                                                      SHA1

                                                                                      88cb87af50ea4999e2079d9269ce64c8eb1a584e

                                                                                      SHA256

                                                                                      4f9ac5a094e9b1b4f0285e6e69c2e914e42dcc184dfe6fe93894f8e03ca6c193

                                                                                      SHA512

                                                                                      bfc32f9a20e30045f5207446c6ab6e8ef49a3fd7a5a41491c2242e10fee8efd2f82f81c3ff3bf7681e5e660fde065a315a89d87e9f488c863421fe1d6381ba3b

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{2323a735-37f1-2040-b611-f712f09762db}\lci_proxywddm.cat
                                                                                      Filesize

                                                                                      12KB

                                                                                      MD5

                                                                                      8e16d54f986dbe98812fd5ec04d434e8

                                                                                      SHA1

                                                                                      8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                                      SHA256

                                                                                      7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                                      SHA512

                                                                                      e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{2323a735-37f1-2040-b611-f712f09762db}\lci_proxywddm.inf
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      0315a579f5afe989154cb7c6a6376b05

                                                                                      SHA1

                                                                                      e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                                      SHA256

                                                                                      d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                                      SHA512

                                                                                      c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{2323a735-37f1-2040-b611-f712f09762db}\x64\lci_proxyumd.dll
                                                                                      Filesize

                                                                                      179KB

                                                                                      MD5

                                                                                      4dc11547a5fc28ca8f6965fa21573481

                                                                                      SHA1

                                                                                      d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                                      SHA256

                                                                                      e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                                      SHA512

                                                                                      bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{2323a735-37f1-2040-b611-f712f09762db}\x64\lci_proxyumd32.dll
                                                                                      Filesize

                                                                                      135KB

                                                                                      MD5

                                                                                      67ae7b2c36c9c70086b9d41b4515b0a8

                                                                                      SHA1

                                                                                      ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                                      SHA256

                                                                                      79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                                      SHA512

                                                                                      4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{2323a735-37f1-2040-b611-f712f09762db}\x64\lci_proxywddm.sys
                                                                                      Filesize

                                                                                      119KB

                                                                                      MD5

                                                                                      b9b0e9b4d93b18b99ece31a819d71d00

                                                                                      SHA1

                                                                                      2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                                      SHA256

                                                                                      0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                                      SHA512

                                                                                      465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{78f92ac9-69a0-3642-adc7-b2ce1a286616}\lci_iddcx.cat
                                                                                      Filesize

                                                                                      10KB

                                                                                      MD5

                                                                                      62458e58313475c9a3642a392363e359

                                                                                      SHA1

                                                                                      e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                                      SHA256

                                                                                      85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                                      SHA512

                                                                                      49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{78f92ac9-69a0-3642-adc7-b2ce1a286616}\lci_iddcx.inf
                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      1cec22ca85e1b5a8615774fca59a420b

                                                                                      SHA1

                                                                                      049a651751ef38321a1088af6a47c4380f9293fc

                                                                                      SHA256

                                                                                      60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                                      SHA512

                                                                                      0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                                      Download Submit

                                                                                    • C:\Windows\System32\DriverStore\Temp\{78f92ac9-69a0-3642-adc7-b2ce1a286616}\x64\lci_iddcx.dll
                                                                                      Filesize

                                                                                      52KB

                                                                                      MD5

                                                                                      01e8bc64139d6b74467330b11331858d

                                                                                      SHA1

                                                                                      b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                                      SHA256

                                                                                      148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                                      SHA512

                                                                                      4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-21-37-57.dat
                                                                                      Filesize

                                                                                      602B

                                                                                      MD5

                                                                                      d0308faee4f7bf5babe295f72dacb960

                                                                                      SHA1

                                                                                      63cf076745fe6afb57e861ac721d2dea5c386abb

                                                                                      SHA256

                                                                                      43b8d9d207597cd2b761a8be8d2e2ba9f0442f058ee784724b80a4e7d8b15fce

                                                                                      SHA512

                                                                                      4c0e29ced9f10ee5ba482f7925b2c9e9c11bc83aa13b3cfbecab6cbe6c7d04377af08c6f11c58243fc750537777bd5bee32789d78d822b5d2bc1c513b1c5ace6

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      9d9918136a353e04668b2d6635244a37

                                                                                      SHA1

                                                                                      2eaf147a69b03818daaee781311a8a31cbfc0801

                                                                                      SHA256

                                                                                      7c2ffc60364a31bc2b980ab9ef5dcbcf070b8860c160af7ffb317522ef41f0de

                                                                                      SHA512

                                                                                      5ee5747b05f2021805eb57c96ca21eb2f3a37cebd28ee6677878b3923fa9278503980d59016841f419b05eacf122cea1755afed299505b0edb458b81a08de440

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                                      Filesize

                                                                                      850B

                                                                                      MD5

                                                                                      3af9ac2596f9033bb76745403473ef7d

                                                                                      SHA1

                                                                                      868e40a10be7812bde5a527d05f0ef9972937343

                                                                                      SHA256

                                                                                      f5514fb4c5c65d5af06b0b14c2f25f3249a5246dc6496d68a4a1d4db29b2a185

                                                                                      SHA512

                                                                                      9ce117868fcd67358062be334834e16897dfed5b223a7ca0fe098694f8c211bf9587c9efcceea2ff306ec0fdb5a42ce078b83b08bf3ee0a26a806515d4b167d4

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      e8edac48bd84afc0fa55d31ac541b662

                                                                                      SHA1

                                                                                      c9f629092d1e824d893493acfe70901309322a6f

                                                                                      SHA256

                                                                                      9738893f0042b3db5db0409fab4b4ab7c8598916635c42e5f2ba22f59a2bbe21

                                                                                      SHA512

                                                                                      e597208510040ac596f5e4d5e720d6a32a186771672dfca64d3d8f30f800d82347d8415f2e414e4d0b46967f04a4073907062c59a4a3e32b55a9a3d61b24cf14

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\PreVer.log
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      9a1350cbb372ee2c2a4167a60ae5c0ec

                                                                                      SHA1

                                                                                      110a5e9eee28ff0a08e55642504ac2f62ae39630

                                                                                      SHA256

                                                                                      c2e988a2af4f0bff9834930dcff83ccad4aafb0df18d209597b93a259c2bab9e

                                                                                      SHA512

                                                                                      c8e255bee0254472512667d93948773d2d8ecbcc88ef2542142ed9772120887a857af5106f0df8a0615f9df76d4228613c8df7a329e03ae63b7fea58389c434a

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\__PSScriptPolicyTest_13gnefd2.yd5.ps1
                                                                                      Filesize

                                                                                      60B

                                                                                      MD5

                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                      SHA1

                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                      SHA256

                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                      SHA512

                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\unpack.log
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      81d9c72a70eb14b86eb1776fbfce9bc9

                                                                                      SHA1

                                                                                      ea881a13a037b8e9bf5043095dadb983d721b427

                                                                                      SHA256

                                                                                      7dc2ba4ac65f562a304a0d76d064c48b5cd9bb3f389e170ee770128a65a41542

                                                                                      SHA512

                                                                                      1e3d5adf346e3fec1efe159f7d15fa253612296148a387cb31eb54b95f02d3dec96d36bc76585e6dc3f9bf1dc9ab845a1a907c10c2488fa554eebdaa71ec177f

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\unpack.log
                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      8a109fdf3f7e8dbf9f638f715f534304

                                                                                      SHA1

                                                                                      551aa5c9d38832123e4c6e1d1dcb8951ea6fdb28

                                                                                      SHA256

                                                                                      9d683e4d74c2b54873242a33d104cc433210b5c79b3d3437c44f4a6cb1fac622

                                                                                      SHA512

                                                                                      eacfb5e47cd65b95f7571913f4962557f0c2390e307c654b9df17360582d37e2a30c0a7617ec30d7d5324365190bb93f495523fcb3cba3b877409d13bc9164e4

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                                      Filesize

                                                                                      3.2MB

                                                                                      MD5

                                                                                      2c18826adf72365827f780b2a1d5ea75

                                                                                      SHA1

                                                                                      a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                                                      SHA256

                                                                                      ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                                                      SHA512

                                                                                      474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\ISRT.dll
                                                                                      Filesize

                                                                                      427KB

                                                                                      MD5

                                                                                      85315ad538fa5af8162f1cd2fce1c99d

                                                                                      SHA1

                                                                                      31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                                      SHA256

                                                                                      70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                                      SHA512

                                                                                      877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{21E11B80-7BFC-4F43-9A30-FB9309C871D7}\_isres_0x0409.dll
                                                                                      Filesize

                                                                                      1.8MB

                                                                                      MD5

                                                                                      befe2ef369d12f83c72c5f2f7069dd87

                                                                                      SHA1

                                                                                      b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                                      SHA256

                                                                                      9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                                      SHA512

                                                                                      760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\IsConfig.ini
                                                                                      Filesize

                                                                                      571B

                                                                                      MD5

                                                                                      d239b8964e37974225ad69d78a0a8275

                                                                                      SHA1

                                                                                      cf208e98a6f11d1807cd84ca61504ad783471679

                                                                                      SHA256

                                                                                      0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                                                      SHA512

                                                                                      88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\String1033.txt
                                                                                      Filesize

                                                                                      182KB

                                                                                      MD5

                                                                                      99bbffd900115fe8672c73fb1a48a604

                                                                                      SHA1

                                                                                      8f587395fa6b954affef337c70781ce00913950e

                                                                                      SHA256

                                                                                      57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                                                      SHA512

                                                                                      d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\_is2E21.exe
                                                                                      Filesize

                                                                                      179KB

                                                                                      MD5

                                                                                      7a1c100df8065815dc34c05abc0c13de

                                                                                      SHA1

                                                                                      3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                                      SHA256

                                                                                      e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                                      SHA512

                                                                                      bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{91316DC1-A768-4D60-BCCC-9452C5D9F6F8}\setup.inx
                                                                                      Filesize

                                                                                      345KB

                                                                                      MD5

                                                                                      0376dd5b7e37985ea50e693dc212094c

                                                                                      SHA1

                                                                                      02859394164c33924907b85ab0aaddc628c31bf1

                                                                                      SHA256

                                                                                      c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                                      SHA512

                                                                                      69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{F393A28B-A280-4A6D-A9D8-7FED3BC8D9C5}\.ba\bg.png
                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      9eb0320dfbf2bd541e6a55c01ddc9f20

                                                                                      SHA1

                                                                                      eb282a66d29594346531b1ff886d455e1dcd6d99

                                                                                      SHA256

                                                                                      9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

                                                                                      SHA512

                                                                                      9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

                                                                                      Download Submit

                                                                                    • C:\Windows\Temp\{F393A28B-A280-4A6D-A9D8-7FED3BC8D9C5}\.be\dotnet-runtime-8.0.11-win-x64.exe
                                                                                      Filesize

                                                                                      607KB

                                                                                      MD5

                                                                                      669de3ab32955e69decfe13a3c89891e

                                                                                      SHA1

                                                                                      ab2e90613c8b9261f022348ca11952a29f9b2c73

                                                                                      SHA256

                                                                                      2240e6318171b3cddcee6a801488f59145c1f54ca123068c2a73564535954677

                                                                                      SHA512

                                                                                      be5d737a7d25cc779736b60b1ea59982593f0598e207340219a13fd9572d140cfbcd112e3cf93e3be6085fe284a54d4458563e6f6e4e1cfe7c919685c9ee5442

                                                                                      Download Submit

                                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                                      Filesize

                                                                                      404B

                                                                                      MD5

                                                                                      b3d00f2e08e772aa83a4978c78d06de2

                                                                                      SHA1

                                                                                      f718de20e1b783c7da7d025192f72eedce683d36

                                                                                      SHA256

                                                                                      218ed04387cc1eeac988484f5d718b548fb3bf494a51edd41d6a9128d9da3fb3

                                                                                      SHA512

                                                                                      86ffdb83f35fbadfa52541f3d08ca823d75c533e3483a71da9025320cef207ecab2c0989b419a2aaa906641b636aff990c2b6f8b48b0578f6a0b933b348ade1d

                                                                                      Download Submit

                                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                      Filesize

                                                                                      412B

                                                                                      MD5

                                                                                      10b59cf8659bd3a54d86138139bad308

                                                                                      SHA1

                                                                                      96afed9a0a42703bf9390d18ef49bf55a6f47031

                                                                                      SHA256

                                                                                      e07cbe05d118d9e93a3de61acf4a914d9bed52f5886ad6c390e5d2a5b010cd44

                                                                                      SHA512

                                                                                      0314a126b4abaed0329f3627ac7303b0b45318dfcfa3eb7003491598637686735c73359da2a5d986681f3e2071686d356427fd422ca6ff1d05fa7767b5adbcc5

                                                                                      Download Submit

                                                                                    • memory/208-493-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/208-939-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/208-496-0x0000000003490000-0x0000000003657000-memory.dmp

                                                                                      Filesize

                                                                                      1.8MB

                                                                                      Download

                                                                                    • memory/208-942-0x00000000034D0000-0x0000000003697000-memory.dmp

                                                                                      Filesize

                                                                                      1.8MB

                                                                                      Download

                                                                                    • memory/208-1026-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/208-1118-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/208-547-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/552-110-0x00000000024B0000-0x0000000002516000-memory.dmp

                                                                                      Filesize

                                                                                      408KB

                                                                                      Download

                                                                                    • memory/812-4712-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/812-3462-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/812-3461-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/812-4713-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/812-1238-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/812-1237-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/832-1915-0x00000174CF190000-0x00000174CF1A2000-memory.dmp

                                                                                      Filesize

                                                                                      72KB

                                                                                      Download

                                                                                    • memory/832-1918-0x00000174CFA10000-0x00000174CFA5A000-memory.dmp

                                                                                      Filesize

                                                                                      296KB

                                                                                      Download

                                                                                    • memory/1308-275-0x0000022C77A10000-0x0000022C77A2C000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/1308-273-0x0000022C77AA0000-0x0000022C77B50000-memory.dmp

                                                                                      Filesize

                                                                                      704KB

                                                                                      Download

                                                                                    • memory/1308-1903-0x00000161CE040000-0x00000161CE69C000-memory.dmp

                                                                                      Filesize

                                                                                      6.4MB

                                                                                      Download

                                                                                    • memory/1308-1870-0x00000161B4F30000-0x00000161B4F40000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                      Download

                                                                                    • memory/1308-1868-0x00000161B45F0000-0x00000161B4602000-memory.dmp

                                                                                      Filesize

                                                                                      72KB

                                                                                      Download

                                                                                    • memory/1308-270-0x0000022C77050000-0x0000022C77092000-memory.dmp

                                                                                      Filesize

                                                                                      264KB

                                                                                      Download

                                                                                    • memory/1308-1875-0x00000161CD770000-0x00000161CD822000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/1308-1889-0x00000161B4F70000-0x00000161B4F90000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/1388-4648-0x000001F4B5440000-0x000001F4B565C000-memory.dmp

                                                                                      Filesize

                                                                                      2.1MB

                                                                                      Download

                                                                                    • memory/1464-39-0x0000000002EE0000-0x0000000002F0E000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                      Download

                                                                                    • memory/1464-43-0x0000000002F20000-0x0000000002F2C000-memory.dmp

                                                                                      Filesize

                                                                                      48KB

                                                                                      Download

                                                                                    • memory/2076-79-0x00000000049A0000-0x00000000049C2000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                      Download

                                                                                    • memory/2076-76-0x0000000004A10000-0x0000000004AC2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/2076-80-0x0000000004AD0000-0x0000000004E24000-memory.dmp

                                                                                      Filesize

                                                                                      3.3MB

                                                                                      Download

                                                                                    • memory/3116-1912-0x000001F37FEE0000-0x000001F37FF90000-memory.dmp

                                                                                      Filesize

                                                                                      704KB

                                                                                      Download

                                                                                    • memory/3116-1877-0x000001F367770000-0x000001F36778C000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/3116-1873-0x000001F366F40000-0x000001F366F4C000-memory.dmp

                                                                                      Filesize

                                                                                      48KB

                                                                                      Download

                                                                                    • memory/3116-1876-0x000001F3677D0000-0x000001F36781A000-memory.dmp

                                                                                      Filesize

                                                                                      296KB

                                                                                      Download

                                                                                    • memory/3428-1906-0x000001E7F6710000-0x000001E7F67C2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/3428-1914-0x000001E7F5E10000-0x000001E7F5E30000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/3428-1902-0x000001E7F5580000-0x000001E7F558C000-memory.dmp

                                                                                      Filesize

                                                                                      48KB

                                                                                      Download

                                                                                    • memory/3428-1905-0x000001E7F5DD0000-0x000001E7F5DE8000-memory.dmp

                                                                                      Filesize

                                                                                      96KB

                                                                                      Download

                                                                                    • memory/3496-148-0x00000190AB850000-0x00000190AB878000-memory.dmp

                                                                                      Filesize

                                                                                      160KB

                                                                                      Download

                                                                                    • memory/3496-165-0x00000190AD5B0000-0x00000190AD5EC000-memory.dmp

                                                                                      Filesize

                                                                                      240KB

                                                                                      Download

                                                                                    • memory/3496-164-0x00000190AD420000-0x00000190AD432000-memory.dmp

                                                                                      Filesize

                                                                                      72KB

                                                                                      Download

                                                                                    • memory/3496-160-0x00000190C5E60000-0x00000190C5EF8000-memory.dmp

                                                                                      Filesize

                                                                                      608KB

                                                                                      Download

                                                                                    • memory/3548-361-0x000001B2EAB80000-0x000001B2EAC5C000-memory.dmp

                                                                                      Filesize

                                                                                      880KB

                                                                                      Download

                                                                                    • memory/3548-371-0x000001B2EB990000-0x000001B2EB9CA000-memory.dmp

                                                                                      Filesize

                                                                                      232KB

                                                                                      Download

                                                                                    • memory/3548-356-0x000001B2D2030000-0x000001B2D203A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                      Download

                                                                                    • memory/3548-365-0x000001B2EAC60000-0x000001B2EAD12000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/3548-352-0x000001B2D2090000-0x000001B2D20DC000-memory.dmp

                                                                                      Filesize

                                                                                      304KB

                                                                                      Download

                                                                                    • memory/3548-354-0x000001B2EA8D0000-0x000001B2EA918000-memory.dmp

                                                                                      Filesize

                                                                                      288KB

                                                                                      Download

                                                                                    • memory/3548-366-0x000001B2D20E0000-0x000001B2D20E8000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                      Download

                                                                                    • memory/3548-350-0x000001B2D1FB0000-0x000001B2D1FCC000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/3548-367-0x000001B2EA920000-0x000001B2EA928000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                      Download

                                                                                    • memory/3548-368-0x000001B2EA930000-0x000001B2EA938000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                      Download

                                                                                    • memory/3548-369-0x000001B2EAB10000-0x000001B2EAB78000-memory.dmp

                                                                                      Filesize

                                                                                      416KB

                                                                                      Download

                                                                                    • memory/3548-355-0x000001B2D1FD0000-0x000001B2D1FD8000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                      Download

                                                                                    • memory/3548-370-0x000001B2EAAD0000-0x000001B2EAAFA000-memory.dmp

                                                                                      Filesize

                                                                                      168KB

                                                                                      Download

                                                                                    • memory/3548-337-0x000001B2D1FE0000-0x000001B2D202A000-memory.dmp

                                                                                      Filesize

                                                                                      296KB

                                                                                      Download

                                                                                    • memory/3548-336-0x000001B2D1720000-0x000001B2D1788000-memory.dmp

                                                                                      Filesize

                                                                                      416KB

                                                                                      Download

                                                                                    • memory/3548-372-0x000001B2EAAA0000-0x000001B2EAAC6000-memory.dmp

                                                                                      Filesize

                                                                                      152KB

                                                                                      Download

                                                                                    • memory/3660-1913-0x00000212FF550000-0x00000212FF59A000-memory.dmp

                                                                                      Filesize

                                                                                      296KB

                                                                                      Download

                                                                                    • memory/3660-1895-0x00000212E63D0000-0x00000212E6404000-memory.dmp

                                                                                      Filesize

                                                                                      208KB

                                                                                      Download

                                                                                    • memory/3660-1908-0x00000212E6C50000-0x00000212E6C5A000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                      Download

                                                                                    • memory/3660-1897-0x00000212E6DB0000-0x00000212E6DFA000-memory.dmp

                                                                                      Filesize

                                                                                      296KB

                                                                                      Download

                                                                                    • memory/3660-1901-0x00000212E6C30000-0x00000212E6C4C000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/3660-1907-0x00000212E6C70000-0x00000212E6C88000-memory.dmp

                                                                                      Filesize

                                                                                      96KB

                                                                                      Download

                                                                                    • memory/3696-359-0x000001CBB0BA0000-0x000001CBB0BBC000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/3696-353-0x000001CB97B40000-0x000001CB97B56000-memory.dmp

                                                                                      Filesize

                                                                                      88KB

                                                                                      Download

                                                                                    • memory/3696-357-0x000001CBB0C40000-0x000001CBB0CF2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/3932-241-0x000001B8E3580000-0x000001B8E35B8000-memory.dmp

                                                                                      Filesize

                                                                                      224KB

                                                                                      Download

                                                                                    • memory/3932-202-0x000001B8E3060000-0x000001B8E3082000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                      Download

                                                                                    • memory/3932-195-0x000001B8E2F70000-0x000001B8E3022000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/4284-1911-0x0000019DB22C0000-0x0000019DB22DC000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/4284-1900-0x0000019DB2760000-0x0000019DB27AA000-memory.dmp

                                                                                      Filesize

                                                                                      296KB

                                                                                      Download

                                                                                    • memory/4284-1917-0x0000019DCB290000-0x0000019DCB36C000-memory.dmp

                                                                                      Filesize

                                                                                      880KB

                                                                                      Download

                                                                                    • memory/4284-1898-0x0000019DB1EF0000-0x0000019DB1F00000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                      Download

                                                                                    • memory/4328-1910-0x000001C5F63A0000-0x000001C5F63E6000-memory.dmp

                                                                                      Filesize

                                                                                      280KB

                                                                                      Download

                                                                                    • memory/5360-1188-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/5360-1189-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/5360-4714-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/5360-4715-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/5360-1856-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/5360-1859-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/5368-1872-0x0000028744FA0000-0x0000028744FB4000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                      Download

                                                                                    • memory/5368-1857-0x0000028744730000-0x0000028744740000-memory.dmp

                                                                                      Filesize

                                                                                      64KB

                                                                                      Download

                                                                                    • memory/5368-1862-0x0000028744AF0000-0x0000028744B10000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5368-1866-0x000002875D8D0000-0x000002875D982000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/5368-1867-0x0000028745140000-0x00000287451A6000-memory.dmp

                                                                                      Filesize

                                                                                      408KB

                                                                                      Download

                                                                                    • memory/5512-1884-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/5512-1886-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/5512-1824-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/5512-1840-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/6068-1869-0x0000016849C80000-0x0000016849C9C000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/6068-1878-0x0000016862560000-0x0000016862612000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/6068-1865-0x0000016849420000-0x0000016849432000-memory.dmp

                                                                                      Filesize

                                                                                      72KB

                                                                                      Download

                                                                                    • memory/6068-1919-0x0000016862720000-0x0000016862774000-memory.dmp

                                                                                      Filesize

                                                                                      336KB

                                                                                      Download

                                                                                    • memory/6096-1754-0x000002170E360000-0x000002170E37A000-memory.dmp

                                                                                      Filesize

                                                                                      104KB

                                                                                      Download

                                                                                    • memory/6096-1858-0x00000217270C0000-0x0000021727172000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/6096-1904-0x0000021727840000-0x0000021727D68000-memory.dmp

                                                                                      Filesize

                                                                                      5.2MB

                                                                                      Download

                                                                                    • memory/6096-1595-0x000002170DED0000-0x000002170DEDA000-memory.dmp

                                                                                      Filesize

                                                                                      40KB

                                                                                      Download

                                                                                    • memory/6104-1287-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/6104-1300-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/6104-2522-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/6104-1172-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/6104-2523-0x0000000072620000-0x00000000729ED000-memory.dmp

                                                                                      Filesize

                                                                                      3.8MB

                                                                                      Download

                                                                                    • memory/6104-1171-0x00000000729F0000-0x0000000072B0C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      Download

                                                                                    • memory/6132-1894-0x0000016F220E0000-0x0000016F22128000-memory.dmp

                                                                                      Filesize

                                                                                      288KB

                                                                                      Download

                                                                                    • memory/6132-1890-0x0000016F22070000-0x0000016F2208C000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                      Download

                                                                                    • memory/6132-1888-0x0000016F3A810000-0x0000016F3A8C2000-memory.dmp

                                                                                      Filesize

                                                                                      712KB

                                                                                      Download

                                                                                    • memory/6132-1592-0x0000016F21650000-0x0000016F2168A000-memory.dmp

                                                                                      Filesize

                                                                                      232KB

                                                                                      Download