Overview

overview

10

Static

static

10

819ad25e1d...f9.msi

windows7-x64

10

819ad25e1d...f9.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2025, 05:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    819ad25e1dfd53f40ca7d7d176c2a1abf14b16fd5325936c1390ab3001e26af9.msi

  • Size

    2.9MB

  • MD5

    eaf2eab89c1b5f8eccf2e62a5a4fb002

  • SHA1

    24e2a1958e34f8db3378c8210ef5f0e5166a1537

  • SHA256

    819ad25e1dfd53f40ca7d7d176c2a1abf14b16fd5325936c1390ab3001e26af9

  • SHA512

    25e7a8b39e585867d71b8edc472b4240e051a5ef5e2c23ddcddc20dc556a8381adc783884c7e2183c778ca445379654bc59a0cf16e4029c2b4b479243d34494a

  • SSDEEP

    49152:P+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:P+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoveryexecutionpersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\819ad25e1dfd53f40ca7d7d176c2a1abf14b16fd5325936c1390ab3001e26af9.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4924
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:464
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 8C66B4036A10E7A9E70680B935D46DB8
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC331.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240632890 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          PID:536
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC70A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240633656 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2864
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICB41.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634703 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2984
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID76B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637843 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:724
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 49B79DC66B449C4B17001EB84F6D79E6 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3668
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3888
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4984
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000Q2oReIAJ" /AgentId="442a6c94-c624-424c-83dc-4191ce6ab13c"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:3968
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B16AF7AE20E6E77DF7A1293945BDAD25 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:4228
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F2FB0C9F-214E-4954-AB4F-3262967DEB2C}
          3⤵
          • Executes dropped EXE
          PID:3488
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3567C490-DF4E-4E72-8231-E0112156EFE5}
          3⤵
          • Executes dropped EXE
          PID:3860
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{189ECBFE-9C72-4799-BD9D-2D184003C7F7}
          3⤵
          • Executes dropped EXE
          PID:2916
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB76DF3F-B1EA-4A80-AB9F-B8E835321F65}
          3⤵
          • Executes dropped EXE
          PID:3512
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C05E210A-4521-494A-A3A5-AB759325DA98}
          3⤵
          • Executes dropped EXE
          PID:1364
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{974BCE95-160F-4831-AFF2-4C472DC55F9F}
          3⤵
          • Executes dropped EXE
          PID:3352
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7D1CE7DE-8036-4F62-96EA-52C5E2E07841}
          3⤵
          • Executes dropped EXE
          PID:3888
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E18F0E58-A068-4C83-B78A-937941671DA6}
          3⤵
          • Executes dropped EXE
          PID:3408
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D48CF69E-1C57-4858-8E40-69EE45E5A5B6}
          3⤵
          • Executes dropped EXE
          PID:4064
        • C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe
          C:\Windows\TEMP\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_is1279.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C96D1D6-131F-4E27-A5A0-5090CF6FBAF3}
          3⤵
          • Executes dropped EXE
          PID:1428
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:844
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4356
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4800
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1056
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4116
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3252
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3596
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4520
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:724
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4560
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3408
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:964
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4472
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4876
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3488
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1128
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1896
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4816
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3512
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4364
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C37CD192-1E05-4907-B682-9E70BA738070}
          3⤵
          • Executes dropped EXE
          PID:4052
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A171CF1B-6349-44B1-91E2-D3639545F2B3}
          3⤵
          • Executes dropped EXE
          PID:2412
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D15ABCC7-19EA-4476-B4AA-ABAF095442AD}
          3⤵
          • Executes dropped EXE
          PID:2876
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E95A49ED-0C1B-4922-803C-0EF0F8135493}
          3⤵
          • Executes dropped EXE
          PID:4028
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3FCE798B-582A-41CC-B012-FF996E0C09A7}
          3⤵
          • Executes dropped EXE
          PID:4552
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{32A58031-B0A5-4790-9D55-6F47ED91F3C1}
          3⤵
          • Executes dropped EXE
          PID:3668
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E805BE50-2A91-46DA-8B62-C8EF67B6C988}
          3⤵
          • Executes dropped EXE
          PID:3564
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F20009BE-F05D-4387-A567-77CB6A03F844}
          3⤵
          • Executes dropped EXE
          PID:3368
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{112BBC6B-5851-45D5-A32C-5DD707504D63}
          3⤵
          • Executes dropped EXE
          PID:3352
        • C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
          C:\Windows\TEMP\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3FEC3A74-56E4-4A2C-8C98-D89E1EBFF5DA}
          3⤵
          • Executes dropped EXE
          PID:3320
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8B14D25E-156D-4AEB-ADE0-5FFCB76D5C95}
          3⤵
          • Executes dropped EXE
          PID:3888
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B890F024-13F3-496B-B506-98F4637887FD}
          3⤵
          • Executes dropped EXE
          PID:5024
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B6A1A17-BA4F-41B9-9E7E-19C0CBD02BFE}
          3⤵
          • Executes dropped EXE
          PID:1496
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9340EB08-889D-442F-A6D0-BF8C47B07260}
          3⤵
          • Executes dropped EXE
          PID:752
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A090F6D-F936-43E3-A5C9-A9C35CDCB31C}
          3⤵
          • Executes dropped EXE
          PID:3252
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C823F65-D72E-4E41-B953-E27087250479}
          3⤵
          • Executes dropped EXE
          PID:392
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD509E97-C4B2-4D60-B061-0F5EAB224073}
          3⤵
          • Executes dropped EXE
          PID:408
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D80A372C-73FB-40D7-B049-C3553F391496}
          3⤵
          • Executes dropped EXE
          PID:4656
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F27084A3-051A-4E6E-A7AC-35FCD0A2E3A8}
          3⤵
          • Executes dropped EXE
          PID:3256
        • C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe
          C:\Windows\TEMP\{8F0AD53F-1365-488E-9A41-7F285B1726D9}\_is2B53.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4B6F52F9-F6DD-49A2-9FB0-21349535895F}
          3⤵
          • Executes dropped EXE
          PID:3040
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4028
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2556
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3352
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:4968
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:636
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4520
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B7D9F945-7E8B-429E-9404-9CD9678117EF}
              3⤵
              • Executes dropped EXE
              PID:1608
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5FCD6B6-5BBC-4226-8B01-473A6892951D}
              3⤵
              • Executes dropped EXE
              PID:3308
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D1D7AF92-8ADB-4E62-84FA-A96BF400C072}
              3⤵
              • Executes dropped EXE
              PID:1140
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E4952A91-9113-4094-8113-1C707366C35C}
              3⤵
              • Executes dropped EXE
              PID:2024
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C9A70623-BEDB-48F7-B782-C56D7323DEE3}
              3⤵
              • Executes dropped EXE
              PID:3384
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{418090DD-0CC5-4A21-B8D6-A6648549F551}
              3⤵
              • Executes dropped EXE
              PID:4656
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A324DC19-056F-4905-BD6F-A53D0A30C867}
              3⤵
              • Executes dropped EXE
              PID:2392
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7EBCB575-2E84-4328-9929-62209C72F834}
              3⤵
              • Executes dropped EXE
              PID:740
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{057899B8-FD9E-4CB8-91F0-FB61B608514D}
              3⤵
              • Executes dropped EXE
              PID:4440
            • C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe
              C:\Windows\TEMP\{CCD50F0C-EC68-4A1D-AB2B-40766FBF510B}\_is3D66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B999EDC-D116-45EE-A76F-163B60931830}
              3⤵
              • Executes dropped EXE
              PID:624
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2276
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DCED630C-C6C1-4F65-8B5D-42CD8600991C}
              3⤵
              • Executes dropped EXE
              PID:2352
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35B704D6-E4AC-4B02-83BA-D843DA484125}
              3⤵
              • Executes dropped EXE
              PID:4736
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E5726CA-8973-45A8-85ED-AF0E6B70BC7F}
              3⤵
              • Executes dropped EXE
              PID:1772
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1628F52-FC89-40C1-B5B9-D6F8E2EE9A4F}
              3⤵
              • Executes dropped EXE
              PID:4032
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B45F913-8799-4C66-A2AF-44E5C15D2910}
              3⤵
              • Executes dropped EXE
              PID:3796
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CC4EF454-8529-4146-AE9E-FDE294D158AD}
              3⤵
              • Executes dropped EXE
              PID:4484
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3B8D87E3-02CA-4138-A262-865D40C9A737}
              3⤵
              • Executes dropped EXE
              PID:408
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F3636A9-872E-44A7-A372-50D3F3E43D2C}
              3⤵
              • Executes dropped EXE
              PID:2768
            • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
              C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF48CD98-0607-4900-B29C-2BAFBA3AD829}
              3⤵
                PID:852
              • C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe
                C:\Windows\TEMP\{6D886802-6F89-4967-9664-1BF70A8B5C0B}\_is4016.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C895A3C1-AE0E-4B0B-A243-F6459B4DDA43}
                3⤵
                  PID:5012
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4092
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding D14F4B76B82CD6886530431CCD60533D E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5908
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI7A3E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240679531 464 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3948
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI7BE5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240679906 468 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4620
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI883A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240683062 473 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5384
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1460
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3668
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:2788
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5572
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:1000
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5988
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIB261.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240693843 511 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3456
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:5768
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="33b32839-a107-4fd9-88ef-74735d170e9b"
                2⤵
                • Drops file in Program Files directory
                • Modifies data under HKEY_USERS
                PID:5728
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding C635B11C629FEA5865C647AA0C9A276B E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5404
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 93ADEAEED10687D8C38401D1F09A0E20 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:6056
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding DBFA955247A9920882B50C1453199F1B E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3500
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:5060
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3608
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:4420
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "7998e9ee-ade5-46aa-b715-9371e670c8f3" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000Q2oReIAJ
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:3040
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "6837bfcc-ae64-4c78-a68e-1198986b41e1" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000Q2oReIAJ
                2⤵
                • Executes dropped EXE
                PID:3600
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "c00fab3e-736b-4215-991a-6aa78feb1165" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000Q2oReIAJ
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3408
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                  3⤵
                  • Drops file in System32 directory
                  • Command and Scripting Interpreter: PowerShell
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3912
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5024
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:4056
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "2687c6af-083e-423f-be94-96b06b440c0d" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOm51bGwsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000Q2oReIAJ
                2⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2788
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:388
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3380
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:208
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "f260411c-4cee-429a-9ad2-55557c816fb1" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000Q2oReIAJ
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:908
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4824
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:2412
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "f260411c-4cee-429a-9ad2-55557c816fb1" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000Q2oReIAJ
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1292
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "fa7660c8-62fe-46b5-ad7a-a5fe9a1b8dbe" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000Q2oReIAJ
                2⤵
                  PID:1928
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                    3⤵
                    • Drops file in System32 directory
                    • Command and Scripting Interpreter: PowerShell
                    • Modifies data under HKEY_USERS
                    PID:5260
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                      PID:5196
                      • C:\Windows\system32\cscript.exe
                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        4⤵
                        • Modifies data under HKEY_USERS
                        • Modifies system certificate store
                        PID:6000
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "d7a59889-c3e8-4433-815c-02636e7994e3" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000Q2oReIAJ
                    2⤵
                    • Writes to the Master Boot Record (MBR)
                    • Drops file in Program Files directory
                    PID:4056
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "aa6aa197-8119-4577-9895-b15d6b2b3f3d" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000Q2oReIAJ
                    2⤵
                      PID:1356
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=0df879732affe96c49b4989ce534a575&rmm_session_pwd_ttl=86400"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5996
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "6d32948e-a128-425b-9633-650cf2d98ba2" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000Q2oReIAJ
                      2⤵
                      • Drops file in System32 directory
                      • Modifies registry class
                      PID:2556
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "4cd422ce-cc22-4d3d-972a-059d3eaafb6b" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000Q2oReIAJ
                      2⤵
                      • Drops file in System32 directory
                      PID:2748
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "7791f1ff-5cfd-4d15-b68e-f5237df19168" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000Q2oReIAJ
                      2⤵
                      • Drops file in System32 directory
                      PID:1860
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "def430c4-40a2-4fed-9014-cbf4de85b3fc" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000Q2oReIAJ
                      2⤵
                        PID:3456
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "81afd3e0-55ea-4ab6-97e6-69d85a76c817" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000Q2oReIAJ
                        2⤵
                          PID:2292
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "47c48d8e-36bf-44b9-b6dd-7db5617b354e" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000Q2oReIAJ
                          2⤵
                          • Drops file in Program Files directory
                          PID:5248
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "bae68871-d6d7-4d14-8d3f-c52a4f0ad604" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000Q2oReIAJ
                          2⤵
                          • Downloads MZ/PE file
                          • Drops file in System32 directory
                          PID:5184
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                            3⤵
                            • System Time Discovery
                            PID:5548
                            • C:\Program Files\dotnet\dotnet.exe
                              dotnet --list-runtimes
                              4⤵
                              • System Time Discovery
                              PID:5344
                          • C:\Program Files\dotnet\dotnet.exe
                            "C:\Program Files\dotnet\dotnet" --list-runtimes
                            3⤵
                            • System Time Discovery
                            PID:1644
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" /repair /quiet /norestart
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2900
                            • C:\Windows\Temp\{6C2369A4-2DEB-4E82-A099-B047ABE586F9}\.cr\8-0-11.exe
                              "C:\Windows\Temp\{6C2369A4-2DEB-4E82-A099-B047ABE586F9}\.cr\8-0-11.exe" -burn.clean.room="C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" -burn.filehandle.attached=584 -burn.filehandle.self=724 /repair /quiet /norestart
                              4⤵
                              • System Location Discovery: System Language Discovery
                              • System Time Discovery
                              PID:5796
                              • C:\Windows\Temp\{300B01C4-BE77-4A15-BE10-CDB81D40A165}\.be\dotnet-runtime-8.0.11-win-x64.exe
                                "C:\Windows\Temp\{300B01C4-BE77-4A15-BE10-CDB81D40A165}\.be\dotnet-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{159E11DB-34D6-41C7-848D-EAB8E6EA5ACB} {6545DE50-D0E5-4B41-AAB8-2A40A4D2F157} 5796
                                5⤵
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • System Time Discovery
                                • Modifies registry class
                                PID:5992
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                            3⤵
                            • System Time Discovery
                            PID:5932
                            • C:\Program Files\dotnet\dotnet.exe
                              dotnet --list-runtimes
                              4⤵
                              • System Time Discovery
                              PID:6104
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                            3⤵
                            • System Time Discovery
                            PID:1664
                            • C:\Program Files\dotnet\dotnet.exe
                              dotnet --list-runtimes
                              4⤵
                              • System Time Discovery
                              PID:5208
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "37fc9a52-9c3a-4a49-bc13-bcc514df003e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000Q2oReIAJ
                          2⤵
                          • Drops file in System32 directory
                          PID:5320
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "2e69feda-aee1-48d4-9682-190707268923" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000Q2oReIAJ
                          2⤵
                          • Drops file in System32 directory
                          PID:6052
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "ab0138ea-4914-4aab-b512-f39dbed7f4b0" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000Q2oReIAJ
                          2⤵
                          • Drops file in System32 directory
                          PID:5536
                          • C:\Windows\SYSTEM32\msiexec.exe
                            "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                            3⤵
                            • Modifies data under HKEY_USERS
                            PID:5956
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "295cc106-36f2-4aac-b670-0d472b9caf6f" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000Q2oReIAJ
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          PID:5864
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "cfda045b-5110-4ecc-a069-fe0253a52a2b" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000Q2oReIAJ
                          2⤵
                            PID:5396
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                          1⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1128
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                            2⤵
                            • Drops file in System32 directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1492
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                              -h
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:832
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                              3⤵
                              • Drops file in Program Files directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1068
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                4⤵
                                  PID:2292
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:1440
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:1772
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                  SRUtility.exe -r
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:100
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:1792
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                  4⤵
                                    PID:3596
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ver
                                      5⤵
                                        PID:5480
                                      • C:\Windows\system32\sc.exe
                                        sc query ddmgr
                                        5⤵
                                        • Launches sc.exe
                                        PID:5252
                                      • C:\Windows\system32\sc.exe
                                        sc query lci_proxykmd
                                        5⤵
                                        • Launches sc.exe
                                        PID:4404
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                        5⤵
                                        • Checks SCSI registry key(s)
                                        • Modifies data under HKEY_USERS
                                        PID:100
                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                1⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:1928
                                • C:\Windows\System32\sc.exe
                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                  2⤵
                                  • Launches sc.exe
                                  PID:5028
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "144d5c30-5dd2-4e67-a2b6-440f05f51c10" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000Q2oReIAJ
                                  2⤵
                                    PID:3256
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                                      3⤵
                                      • Drops file in System32 directory
                                      • Command and Scripting Interpreter: PowerShell
                                      • Modifies data under HKEY_USERS
                                      PID:1000
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      3⤵
                                        PID:5668
                                        • C:\Windows\system32\cscript.exe
                                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                          4⤵
                                          • Modifies data under HKEY_USERS
                                          PID:6076
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "748aec3c-a65e-4132-9b08-caf36260a82f" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000Q2oReIAJ
                                      2⤵
                                        PID:6112
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "82c7f35e-17df-4424-93d2-077b543a583d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000Q2oReIAJ
                                        2⤵
                                          PID:3400
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "1ff53bfb-1c21-4ebd-ab6b-2adeb376c767" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000Q2oReIAJ
                                          2⤵
                                            PID:208
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "422a65e3-1aa6-468a-a35a-11853ccc3898" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000Q2oReIAJ
                                            2⤵
                                              PID:5660
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "e5757298-23f5-4f36-aa26-e5701e992eb6" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000Q2oReIAJ
                                              2⤵
                                                PID:6136
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "c2f27bd6-3686-4aae-b003-0e8cf21cc634" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000Q2oReIAJ
                                                2⤵
                                                  PID:1356
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                    3⤵
                                                    • System Time Discovery
                                                    PID:2884
                                                    • C:\Program Files\dotnet\dotnet.exe
                                                      dotnet --list-runtimes
                                                      4⤵
                                                      • System Time Discovery
                                                      PID:5956
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "aec40d49-2525-4dba-9f9f-da5f8c5216fc" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000Q2oReIAJ
                                                  2⤵
                                                    PID:5748
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "9a2e333f-e64c-4a41-9158-1cda5c58e32f" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000Q2oReIAJ
                                                    2⤵
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:2752
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "391477f1-afa8-4d55-bff5-d56d80721412" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000Q2oReIAJ
                                                    2⤵
                                                      PID:5624
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "55b0bac0-9db0-4ee4-945d-f411c9a9e2a4" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000Q2oReIAJ
                                                      2⤵
                                                        PID:4772
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "3359fe84-d4cf-4b7e-a54e-ec4fc8cba633" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000Q2oReIAJ
                                                        2⤵
                                                          PID:1908
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "ddd0ba76-e9d9-420e-97a1-7337f47be7e0" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000Q2oReIAJ
                                                          2⤵
                                                            PID:5548
                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=0df879732affe96c49b4989ce534a575&rmm_session_pwd_ttl=86400"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5472
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "6f304b39-462e-4c86-be47-5abdf9841f6b" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000Q2oReIAJ
                                                            2⤵
                                                            • Modifies registry class
                                                            PID:5356
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              3⤵
                                                                PID:6112
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "b2fc1eff-1d0f-4476-8b75-da3c28a3120b" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000Q2oReIAJ
                                                              2⤵
                                                                PID:4028
                                                                • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                                  "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "442a6c94-c624-424c-83dc-4191ce6ab13c" "b2fc1eff-1d0f-4476-8b75-da3c28a3120b" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000Q2oReIAJ"
                                                                  3⤵
                                                                    PID:5316
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 442a6c94-c624-424c-83dc-4191ce6ab13c "55b0bac0-9db0-4ee4-945d-f411c9a9e2a4" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000Q2oReIAJ
                                                                  2⤵
                                                                    PID:5160
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                  1⤵
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:6032
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Windows directory
                                                                    • Checks SCSI registry key(s)
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:5200
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000164" "WinSta0\Default" "00000000000000E8" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Windows directory
                                                                    • Checks SCSI registry key(s)
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2024
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000164"
                                                                    2⤵
                                                                    • Drops file in Drivers directory
                                                                    • Drops file in System32 directory
                                                                    • Checks SCSI registry key(s)
                                                                    PID:2652
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                    2⤵
                                                                    • Drops file in Drivers directory
                                                                    • Checks SCSI registry key(s)
                                                                    PID:2064

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Command and Scripting Interpreter

                                                                1
                                                                T1059

                                                                PowerShell

                                                                1
                                                                T1059.001

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Event Triggered Execution

                                                                2
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Installer Packages

                                                                1
                                                                T1546.016

                                                                Pre-OS Boot

                                                                1
                                                                T1542

                                                                Bootkit

                                                                1
                                                                T1542.003

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Event Triggered Execution

                                                                2
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Installer Packages

                                                                1
                                                                T1546.016

                                                                Defense Evasion

                                                                Modify Registry

                                                                2
                                                                T1112

                                                                Pre-OS Boot

                                                                1
                                                                T1542

                                                                Bootkit

                                                                1
                                                                T1542.003

                                                                Subvert Trust Controls

                                                                1
                                                                T1553

                                                                Install Root Certificate

                                                                1
                                                                T1553.004

                                                                System Binary Proxy Execution

                                                                1
                                                                T1218

                                                                Msiexec

                                                                1
                                                                T1218.007

                                                                Credential Access

                                                                Discovery

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Query Registry

                                                                4
                                                                T1012

                                                                System Information Discovery

                                                                3
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Config.Msi\e57c295.rbs
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  39f400d290f1baada9098502da0232a8

                                                                  SHA1

                                                                  72f8bd309d823a9e647ed1c92320eb3bf49dc77c

                                                                  SHA256

                                                                  93ce570c6fbbf32fadf289298be938467e0e7cc7db106be1f4d3fa910df2675f

                                                                  SHA512

                                                                  238024bfe02877dc2d777a2135a616c74e9400b5cd2d8673076d3f1c7d53d7c0f1c613a58d8a1e4a460db80b811bafa7949ceefa968f3e98646266e6a2033ab7

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c29a.rbs
                                                                  Filesize

                                                                  74KB

                                                                  MD5

                                                                  b97ed33938fa231a4c9a583c2d33a975

                                                                  SHA1

                                                                  f3828c9bbd6121c9a061cccc99d144d9bfd17cf2

                                                                  SHA256

                                                                  79ddd955bbb431d7cbbf8d8eaf72717f23f42df03f19685a9eb2c7b494315be3

                                                                  SHA512

                                                                  f2f7c75ed75154040a921496ac32fe7a5e0afcf37b28ffb795e373a13968a0eebfcfac4db3262522570f632a8a4d7d56e54e57449e245d2fdf258633538a8978

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c29c.rbs
                                                                  Filesize

                                                                  464B

                                                                  MD5

                                                                  5aa670679e940722b581c4e79d682c4b

                                                                  SHA1

                                                                  7549824a9258070146d7fc7abb4496c8326f1f5c

                                                                  SHA256

                                                                  e2b45fa70a42cc4c1e4db708bf72647cf311c6873a3059d7ac8433caae3c571f

                                                                  SHA512

                                                                  7a07136fc03d8f43882c40e73bc12813143434157cc2c7bcbc9399eae11a3343ecad38a7fd1384ef71e3e27469191fce3e0aac6da2cc333fa7cbd63520e0828d

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2a2.rbs
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  2ce8ab369948007218837ff662d4228c

                                                                  SHA1

                                                                  6cd8a59b84a28624c0970a81b09dad8eb25283d8

                                                                  SHA256

                                                                  734e883b8fad81fdb65a2d74a5e2cfc6d7af872712d4377a72b0a8aef490dd75

                                                                  SHA512

                                                                  4b6342745989643a4f61f8776a82ee1f22c339b4196ada5f02f04b17b1ee1a97abf25b77722dbab06a6d8514f59b182ad8235b9379ff316febf57b0ae4b19eac

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2aa.rbs
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  91bae1fc8da69a23de197bd4c9893479

                                                                  SHA1

                                                                  eacb83147589a8e06089372e7352678807a67625

                                                                  SHA256

                                                                  a06ac6dfa1959f94f08e952ae4ac5cce0ce1c54124aec4106bbf950a8fd3313e

                                                                  SHA512

                                                                  cf3a42a6d2435701579c6345efb88aea85b82007cf02337e251aaac6eafbe0ed070339aa45a6d5ba42d339272d8223f83aafccf949de9c2cf2528cf42ced3f1a

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2af.rbs
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  15b0b887822b116f8717912967f7d0bc

                                                                  SHA1

                                                                  06756f198ade11710ae69f02905c29a1ed5e05c3

                                                                  SHA256

                                                                  b33de62ef0b1fab126cc556e29e80ced8f3f01168e76bc0cce133d9f3c7bd389

                                                                  SHA512

                                                                  2958288a5def1f6f1baf9df6d056b3f08e5b46951d341a52a3b42a1330e2a75b43efbeafc76680bad7deef3eb732755e83deb13b3c40af3aa3435772496f36d0

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2b4.rbs
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  9e9d094915d6475d14c1dcfaf50f77cd

                                                                  SHA1

                                                                  43aad9e3ba7c5d1dfc8d2009292e03af11f1813e

                                                                  SHA256

                                                                  b6a26119e1dc20be7eeaa7d5553e00a9a0348ac4d8bf0ecf405ad2fbe865a706

                                                                  SHA512

                                                                  415c9975ae172babed5a1854e3b123f50b8fc12cc20c34a7644a8e73fdf37cefdcf6c4cf760e565847c39eee455d050db42b33403e2c6506bc2f8e5308688b3f

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2b9.rbs
                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  d550d26ff62fb3c2580be2583f3f5db1

                                                                  SHA1

                                                                  b394ad4e335490bce3655cdcc3dcf8b259a43acf

                                                                  SHA256

                                                                  98bac52552a9cb690fd764ddacdd4f4aa1db92569307169f33775e8224cb7db5

                                                                  SHA512

                                                                  4cf3a0e53d444c4b8a2b59f2e615ec8a031b7a809098bb2bc383beb768dbb0491d50d7c83e5d71915672d4e1ba5a41f398a9a54ba20201d34861b60bf59f368b

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2be.rbs
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  d32042e5ab037355c2d7c9c585532ab3

                                                                  SHA1

                                                                  d3309f4c417a2ba0058a7eb5a37a334eaacb634b

                                                                  SHA256

                                                                  855cd9156f81f1fcb083ecac4562b7fdb62fd309cbd808ff6b9642d3a3f6d377

                                                                  SHA512

                                                                  c396858ec31b5211dd35519d4dc46069a8b0d021c6a55d260977cb546d1dac13dbfb33152e025dd662bdbb71aa948c0e9f82355cf0eac1364033ab5427142cb1

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2bf.rbf
                                                                  Filesize

                                                                  143KB

                                                                  MD5

                                                                  33b4c87f18b4c49114d7a8980241657a

                                                                  SHA1

                                                                  254c67b915e45ad8584434a4af5e06ca730baa3b

                                                                  SHA256

                                                                  587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662

                                                                  SHA512

                                                                  42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

                                                                  Download Submit

                                                                • C:\Config.Msi\e57c2c0.rbf
                                                                  Filesize

                                                                  3B

                                                                  MD5

                                                                  21438ef4b9ad4fc266b6129a2f60de29

                                                                  SHA1

                                                                  5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

                                                                  SHA256

                                                                  13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

                                                                  SHA512

                                                                  37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  3840b31c383fdf49bfd6740d945c9032

                                                                  SHA1

                                                                  a6f50164a69718bcef4664d7c47534f0d721866a

                                                                  SHA256

                                                                  1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                                  SHA512

                                                                  f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                  Filesize

                                                                  142KB

                                                                  MD5

                                                                  477293f80461713d51a98a24023d45e8

                                                                  SHA1

                                                                  e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                  SHA256

                                                                  a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                  SHA512

                                                                  23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  b3bb71f9bb4de4236c26578a8fae2dcd

                                                                  SHA1

                                                                  1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                  SHA256

                                                                  e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                  SHA512

                                                                  fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                  Filesize

                                                                  210KB

                                                                  MD5

                                                                  c106df1b5b43af3b937ace19d92b42f3

                                                                  SHA1

                                                                  7670fc4b6369e3fb705200050618acaa5213637f

                                                                  SHA256

                                                                  2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                  SHA512

                                                                  616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                  Filesize

                                                                  693KB

                                                                  MD5

                                                                  2c4d25b7fbd1adfd4471052fa482af72

                                                                  SHA1

                                                                  fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                  SHA256

                                                                  2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                  SHA512

                                                                  f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                  Filesize

                                                                  146KB

                                                                  MD5

                                                                  8d477b63bc5a56ae15314bda8dea7a3a

                                                                  SHA1

                                                                  3ca390584cd3e11172a014784e4c968e7cbb18f5

                                                                  SHA256

                                                                  9eec91cdd39cbb560ad5b1d063df67088f412da4b851ae41e71304fb8a444293

                                                                  SHA512

                                                                  44e3d91ad96b4cb919c06ccb91d3c3e31165b2412e1d78bfbaca0bee6f0c1a3253b3e3ddf19009cebf12c261a0392f6a0b7091cf8aba1d0cc4c1ed61c1b6dc42

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                  Filesize

                                                                  145KB

                                                                  MD5

                                                                  2b9beb2fdbc41afc48d68d32ef41dd08

                                                                  SHA1

                                                                  4a9ea4cf8e02e34ef2dd0ef849ffc0cd9ea6f91c

                                                                  SHA256

                                                                  977d48979e30a146417937d7e11b26334edec2abddfae1369a9c4348e34857b1

                                                                  SHA512

                                                                  3e3c3e39ff2df0d1ed769e6c5acba6f7c5d2737d3c426fb4f0e19f3cf6c604707155917584e454a3f208524ed46766b7a3d2d861fa7419f8258c3b6022238e10

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                  Filesize

                                                                  51KB

                                                                  MD5

                                                                  3180c705182447f4bcc7ce8e2820b25d

                                                                  SHA1

                                                                  ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                  SHA256

                                                                  5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                  SHA512

                                                                  228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                  Filesize

                                                                  12B

                                                                  MD5

                                                                  1e065e191e89cc811ff49c96fa8fa5e6

                                                                  SHA1

                                                                  bc50ff2a20a8b83683583684fcac640a91689ed4

                                                                  SHA256

                                                                  d88faf6d47342587ea5fbcaf2ef88fb403f7fcdc08fcab67d4f4f381c237a61e

                                                                  SHA512

                                                                  5a710e168316c30ca10f7b126e870621f46cca6200e206a9984d144abd11fea045bc475599b18597bbed1e4f00e832d94576837f643b22ffaee56871629290dd

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                  Filesize

                                                                  247KB

                                                                  MD5

                                                                  aa5cf64d575b7544eefd77f256c4dc57

                                                                  SHA1

                                                                  bd23989db4f9af0aae34d032e817d802c06ca5a9

                                                                  SHA256

                                                                  79c5afd94d0ffa3519a90e691a6d47f9c2eec93277f7d369aa34e64b171fc920

                                                                  SHA512

                                                                  774aeb5188c536d556a8c7a0cd3dfd9ab22d7bc0ad13353d11c9153232585da352552a69eb967a741372a99db490df355a5a47696b2ea446582c834c963cfeff

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                  Filesize

                                                                  546B

                                                                  MD5

                                                                  158fb7d9323c6ce69d4fce11486a40a1

                                                                  SHA1

                                                                  29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                  SHA256

                                                                  5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                  SHA512

                                                                  7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                  Filesize

                                                                  94KB

                                                                  MD5

                                                                  c69c7690482c75a8fc70df2990d7afc6

                                                                  SHA1

                                                                  79d72d32a03151823bbf0953d5c2ce6bc2bde4b1

                                                                  SHA256

                                                                  580415595e5936d5f3945e9eeee63f6f4dbacd327aa46e2b7625b638715c27f5

                                                                  SHA512

                                                                  ed80ade3519345552ca74958efc9c122de840d2844baa08c94400f15168b6fc25377628a55ed12488ea790aaa40bc5bb77b6586de4f1ecd296902bbe36fba4f4

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                  Filesize

                                                                  688KB

                                                                  MD5

                                                                  111e2e63bccead95bb5ffc53c9282070

                                                                  SHA1

                                                                  eaae7df21e291aa089bc101b1e265ca202be1225

                                                                  SHA256

                                                                  9615fe5fe63c48b13ffd8c9bc76170a9ed1cfea6a3d0901e857a1c6c6edaea76

                                                                  SHA512

                                                                  ffc818615fb30e24633c90b8f5a55c100b5f307414ec54e5a2914bb4ea36d3fb3aa6ed0e5815976a2f6d1b7f056e7da1f108a8eed81b458decebe721ad30b920

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                  Filesize

                                                                  27KB

                                                                  MD5

                                                                  797c9554ec56fd72ebb3f6f6bef67fb5

                                                                  SHA1

                                                                  40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                  SHA256

                                                                  7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                  SHA512

                                                                  4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                  Filesize

                                                                  214KB

                                                                  MD5

                                                                  01807774f043028ec29982a62fa75941

                                                                  SHA1

                                                                  afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                  SHA256

                                                                  9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                  SHA512

                                                                  33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                  Filesize

                                                                  37KB

                                                                  MD5

                                                                  efb4712c8713cb05eb7fe7d87a83a55a

                                                                  SHA1

                                                                  c94d106bba77aecf88540807da89349b50ea5ae7

                                                                  SHA256

                                                                  30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                  SHA512

                                                                  3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                  Filesize

                                                                  3.4MB

                                                                  MD5

                                                                  93e4c198656fc267f392de11dee01cd0

                                                                  SHA1

                                                                  e92cb59486745ee7564f5b374e790a065e1f4678

                                                                  SHA256

                                                                  88b220f9f9bf25f856dda714aa1a1ae998720780cd3ec5b968154e03834fa965

                                                                  SHA512

                                                                  3a04a02982dbbbb9d54b6c5674f2f2c10e0cbce580e3974cd924cc9131cd94aece71c7b975c9abaae82f057c70243fb016d31339e8700c96bd55c434bb98105f

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                  Filesize

                                                                  397KB

                                                                  MD5

                                                                  810f893e58861909b134fa72e3bc90cd

                                                                  SHA1

                                                                  524977f32836634132d23997b23304574d8d156a

                                                                  SHA256

                                                                  b83b6c1f64b6700d7444586a6214858a1479c58571f5e7bf4f023166c9016733

                                                                  SHA512

                                                                  db463d34a37403a9248d463ae63989b40a0172d9543bda922dacb10a624eb603700628a67d9c86df2605c36d789902ec79228aa29f26c49be0195c54a9e4a191

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                  Filesize

                                                                  56KB

                                                                  MD5

                                                                  7e6b758bad729556a798800f29f09ec3

                                                                  SHA1

                                                                  f2c010975ae74ee7bd53a60c01d11e1c67877f91

                                                                  SHA256

                                                                  aa5ea3aeb59da9daf70ca1271101e9de7465ab89aa91bc895dd195e5fad0c45f

                                                                  SHA512

                                                                  5df31f2fe153ffb9869f68eda2611ca73c84122e083d23cf8a1c4c0a74cca727f4084f3bcfa2419ccef5439d7b4b0d635a22a7be6691b9435aa69412198adad0

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                  Filesize

                                                                  197KB

                                                                  MD5

                                                                  d0d21e16e57a1a73056eae228da1e287

                                                                  SHA1

                                                                  ab5a27b1d3d977a7f657d0acdf047067c625869f

                                                                  SHA256

                                                                  3db5809f23020f9988d5db0cf494f014a87b9dc1547cf804ae9d66667505a60c

                                                                  SHA512

                                                                  470bac3e691525ff6007293bac32198c0021a1411ba9d069f88f8603189b1617c2265fe6553c1f60ef788e69afcb8aa790714c59260b7c015a5be5b149222c48

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                  Filesize

                                                                  56KB

                                                                  MD5

                                                                  d0aa95693d78fd438552bd9df01fec78

                                                                  SHA1

                                                                  0e7173c1af5d5543d5a41aed690e59f3ae4bb0b9

                                                                  SHA256

                                                                  11201ece7c3ee4bbcde0b84a2bc7c251ef57fce5200b2a1ae437fc959c7ad8a7

                                                                  SHA512

                                                                  7b48864e72627bb51063ea49f6459eb6c05baa64066d8e6c85f2ff7b7de26b633ff973e2a830da63b6824eaea65690e3f6b29af8adbc0c24724016a8764f3b15

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                  Filesize

                                                                  809B

                                                                  MD5

                                                                  8b6737800745d3b99886d013b3392ac3

                                                                  SHA1

                                                                  bb94da3f294922d9e8d31879f2d145586a182e19

                                                                  SHA256

                                                                  86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                  SHA512

                                                                  654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  9d1528a2ce17522f6de064ae2c2b608e

                                                                  SHA1

                                                                  2f1ce8b589e57ab300bb93dde176689689f75114

                                                                  SHA256

                                                                  11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                  SHA512

                                                                  a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5864.update
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  14ffcf07375b3952bd3f2fe52bb63c14

                                                                  SHA1

                                                                  ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                  SHA256

                                                                  6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                  SHA512

                                                                  14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  524d2bb041b326e1e290c435f36e5bcd

                                                                  SHA1

                                                                  23e0d6fe944d37f3ff584c787af712ccfb3c4dc7

                                                                  SHA256

                                                                  f79b493e5fc70b5804f1345176ededbef94392e8b48ddb9e8b8f9afe2d688105

                                                                  SHA512

                                                                  dacdaae0fd0fdb76363274d22efb063120115676399854d795e904e79d3cb99060467ee135a8884c63c9803afea7751d3490c199ef1e0187ae85309f5dcdc8e7

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  a3c91a0dd30641b45d7c9ae3fa2eec9c

                                                                  SHA1

                                                                  56ba42304341dfce95af97cc6066252429ce18fb

                                                                  SHA256

                                                                  e24a4dec89054941ea7dce1050537b7cb3b4c9f195f2088dfd63df5d4e1b0423

                                                                  SHA512

                                                                  a4aca1756ee8472f9781d506e251a8e7b2bdabf55ab12e9fbfa220288d9b2bb8013071e9d608204a9b99547ad5d6c462d1175392a682c49d5fdd161837da291b

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                  Filesize

                                                                  2B

                                                                  MD5

                                                                  81051bcc2cf1bedf378224b0a93e2877

                                                                  SHA1

                                                                  ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                  SHA256

                                                                  7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                  SHA512

                                                                  1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                  Filesize

                                                                  54KB

                                                                  MD5

                                                                  77c613ffadf1f4b2f50d31eeec83af30

                                                                  SHA1

                                                                  76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                  SHA256

                                                                  2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                  SHA512

                                                                  29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                  Filesize

                                                                  333KB

                                                                  MD5

                                                                  745714d838c4d4f88c6e0db6a434f444

                                                                  SHA1

                                                                  90689ce709bf2464b678c7afa7b1e18f080d52bb

                                                                  SHA256

                                                                  e35302995dad1d5e4b7147d8763f7262500271cf01eac8edfa896b392ac7139f

                                                                  SHA512

                                                                  08cbfac0b604530108978c757ad8481c69ed62deac5520777bacee9751f3f260d2c3158609fd723819d8d6626c46b302fe7da7005efc09ab571871ac9d58a0ed

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                  Filesize

                                                                  70KB

                                                                  MD5

                                                                  e9b3a59f67febdd7f8fbe68d71c5d0ab

                                                                  SHA1

                                                                  22bd3ec3f8e0be2f317ade9d553acdb3ea11f52e

                                                                  SHA256

                                                                  bff4de54dacec104e1e63659857ca99d3e9658dcc09d6e1cbf54dc7b22629cbf

                                                                  SHA512

                                                                  00e95ea600777025a30e23c755522b869320ca445ac5bd74f123306457d0793efa338220cba9d064e5d25cc3dcf19d66e4e48d3a1c72d196eeb77fb61e4b0688

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                  Filesize

                                                                  50KB

                                                                  MD5

                                                                  5bb0687e2384644ea48f688d7e75377b

                                                                  SHA1

                                                                  44e4651a52517570894cfec764ec790263b88c4a

                                                                  SHA256

                                                                  963a4c7863beae55b1058f10f38b5f0d026496c28c78246230d992fd7b19b70a

                                                                  SHA512

                                                                  260b661f52287af95c5033b0a03ac2e182211d165cadb7c4a19e5a8ca765e76fc84b0daf298c3eccb4904504a204194a9bf2547fc91039c3ec2d41f9977ff650

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                  Filesize

                                                                  32KB

                                                                  MD5

                                                                  2ec1d28706b9713026e8c6814e231d7c

                                                                  SHA1

                                                                  7ef12a01182d28a5ebf049cc1cb80619cd1e391a

                                                                  SHA256

                                                                  c9514bf67df87ac6cc1002f3585d5b6f7d4093a7a794d524fa8c635f052733de

                                                                  SHA512

                                                                  9e23588dc6d721f42e309974c3f3089f845f10d1dee87fb26213ba3810ee3c272d758632cf1c9157f6862ba0e582afc49c1ee51540461f41840650f216f35aeb

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                  Filesize

                                                                  59KB

                                                                  MD5

                                                                  26c25e48b69eb8df7d6cea01fd66f3df

                                                                  SHA1

                                                                  d70e92a8b8d358c7a2e200b11e23703cf43d93e9

                                                                  SHA256

                                                                  f6da2cc4a4ca0a4cff92a2c9f61e546255bfe9d02eb1087a033b1a45e06fec87

                                                                  SHA512

                                                                  6414db6ba626fe4b39155052638a15707cf60836056560fceeb5a1ea8faee1bee830840900f1635ff5a0ce1d271f73062660bd0ec582815e0bc56f4997a45feb

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                  Filesize

                                                                  588KB

                                                                  MD5

                                                                  17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                  SHA1

                                                                  bc0316e11c119806907c058d62513eb8ce32288c

                                                                  SHA256

                                                                  13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                  SHA512

                                                                  f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                  Filesize

                                                                  208B

                                                                  MD5

                                                                  e2d58cb1af18e9a110bb48d563dc60cc

                                                                  SHA1

                                                                  a2f7fd3d5b25086e95f0a69e2dab5e4a8840ccf2

                                                                  SHA256

                                                                  00efdcfea4512467fa3913d7e6549f9cdfa5cdb4f4c3d9d2265136f0c34e2fa5

                                                                  SHA512

                                                                  4e37e04d5d5bf7076cd9827b01bf77c28dabcd8adbedfe46d0d56a7fb4245328953fb286ff0ff64eac0ecac78891519023864d53adbd2dcc84873cd9f817da41

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                  Filesize

                                                                  244B

                                                                  MD5

                                                                  a382f029ece3ba1495b2e331aeaa40f7

                                                                  SHA1

                                                                  26b4ce052c919ba026511ee51bb850070362088d

                                                                  SHA256

                                                                  9386609b1829ca9a1f6e4c92398a300802086a6e7b00ac06dffa6aa9006995f1

                                                                  SHA512

                                                                  b59ee8e0b8204cd4d033db8156457f5b5aa1fcae683068f65b58a0ecab0fd9bf8155c4d23184426373c6529ab4258796ebf98d17b6ef7d5702259407f8140e9c

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  1ef7574bc4d8b6034935d99ad884f15b

                                                                  SHA1

                                                                  110709ab33f893737f4b0567f9495ac60c37667c

                                                                  SHA256

                                                                  0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                  SHA512

                                                                  947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  f512536173e386121b3ebd22aac41a4e

                                                                  SHA1

                                                                  74ae133215345beaebb7a95f969f34a40dda922a

                                                                  SHA256

                                                                  a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                  SHA512

                                                                  1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                  Filesize

                                                                  76KB

                                                                  MD5

                                                                  b40fe65431b18a52e6452279b88954af

                                                                  SHA1

                                                                  c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                  SHA256

                                                                  800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                  SHA512

                                                                  e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                  Filesize

                                                                  80KB

                                                                  MD5

                                                                  3904d0698962e09da946046020cbcb17

                                                                  SHA1

                                                                  edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                  SHA256

                                                                  a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                  SHA512

                                                                  c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                  Filesize

                                                                  287B

                                                                  MD5

                                                                  fcad4da5d24f95ebf38031673ddbcdb8

                                                                  SHA1

                                                                  3f68c81b47e6b4aebd08100c97de739c98f57deb

                                                                  SHA256

                                                                  7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63

                                                                  SHA512

                                                                  1694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  362ce475f5d1e84641bad999c16727a0

                                                                  SHA1

                                                                  6b613c73acb58d259c6379bd820cca6f785cc812

                                                                  SHA256

                                                                  1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                  SHA512

                                                                  7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability.zip
                                                                  Filesize

                                                                  1.3MB

                                                                  MD5

                                                                  40df7f2a02cdfa70ae76d70d21473428

                                                                  SHA1

                                                                  4baddbc082fdb197c77bc1c232be2881a82a7ec8

                                                                  SHA256

                                                                  f037309cf6b0174ba282106da31c141e3912486c69c438a53afe7ff589743dc2

                                                                  SHA512

                                                                  2522483e9d1b9fc20f14ffab3dcb2a9e5735a260e08e7196a05319076ad9b4d7a9fe94b28c52559022f003d2fe55ec5e4abcecb1b11f4000e804dae5b1c0126f

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                  Filesize

                                                                  1.8MB

                                                                  MD5

                                                                  5ed9543e9f5826ead203316ef0a8863d

                                                                  SHA1

                                                                  8235c0e7568ec42d6851c198adc76f006883eb4b

                                                                  SHA256

                                                                  33583a8e2dcf039382e80bfa855944407bcba71976ec41c52810cb8358f42043

                                                                  SHA512

                                                                  5b4318ddc6953f31531ee8163463259da5546f1018c0fe671280337751f1c57398a5fd28583afba85e93d70167494b8997c23fee121e67bf2f6fb4ca076e9d9f

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  9a9b1fd85b5f1dcd568a521399a0d057

                                                                  SHA1

                                                                  34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                  SHA256

                                                                  88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                  SHA512

                                                                  7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                  Filesize

                                                                  383KB

                                                                  MD5

                                                                  f6f297c704f4f4c13d50f971daea3b56

                                                                  SHA1

                                                                  118581c847ea863ff8bca0a38b5469577ac6b227

                                                                  SHA256

                                                                  a92e1c423c30b6bb4c73f8807890b6020e12cad4143ebf6548d6562cd04f0b4b

                                                                  SHA512

                                                                  b312447f381d48b68308b68cd841a4274897fe4e4bd5ea3fcdfd598a6926db1ad43443bf7c0b103fdf06e1b511f5ea1b2e8018abc62a39b9b7f2d4be17a7c848

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                  Filesize

                                                                  321KB

                                                                  MD5

                                                                  d3901e62166e9c42864fe3062cb4d8d5

                                                                  SHA1

                                                                  c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                  SHA256

                                                                  dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                  SHA512

                                                                  ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                  Filesize

                                                                  814KB

                                                                  MD5

                                                                  9b1f97a41bfb95f148868b49460d9d04

                                                                  SHA1

                                                                  768031d5e877e347a249dfdeab7c725df941324b

                                                                  SHA256

                                                                  09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                  SHA512

                                                                  9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                  Filesize

                                                                  1.2MB

                                                                  MD5

                                                                  e74d2a16da1ddb7f9c54f72b8a25897c

                                                                  SHA1

                                                                  32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                  SHA256

                                                                  a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                  SHA512

                                                                  52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                  Filesize

                                                                  12B

                                                                  MD5

                                                                  a6bd887ee94e12d3c42a5d47b4c73826

                                                                  SHA1

                                                                  6b30541a5b528ff8a8befdb5cab0b9dccf4b2491

                                                                  SHA256

                                                                  643d32f1b400e5cdc5b76067eac006167c07b321d5abd06b30f1a45e9fe2253c

                                                                  SHA512

                                                                  ec86b4beda8995c13f550ce0f1c60b7bf384f706d37c516a12c6e6d6e0040bc11f72e9af09117d78b46bb799e9e41f4f6b2e78b84c2cf087ac76a1eb94986171

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  06d3bf4478b8d5a64cd37e519c4177b8

                                                                  SHA1

                                                                  5dcdb5b8b8ed717c79d0834110bc5905b06449db

                                                                  SHA256

                                                                  4fed69883bdb771b850903dcc303ce45b19be12f00e6efa0ec26dc9e9f801c89

                                                                  SHA512

                                                                  6b28630425dd8540019d24b8f07009a08b26c4a435d60f59f0c6be2a1873657f16f47e1336cf73aeb8a418ad9e4c253c647b60ef71d62fda8d83447ec5b5abf0

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  c6ff35a9de0089bdf09898e9187b9c06

                                                                  SHA1

                                                                  05c8321bc1c3a31cc3b6dfc2fdc97fc21965d9a8

                                                                  SHA256

                                                                  92477d8c630690368fa97792af8b016c98026360fb87976ce4c49ab9af899b6a

                                                                  SHA512

                                                                  ddc013a1f8739d1a32b24ecea09113277baa91fe8e167a7b60df36bc45f5fb63aa9d1d864aaf65f24702bc74beaf36bcfbf0e33c5b5b0dc25d8fe839db00cc7d

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                  Filesize

                                                                  2.8MB

                                                                  MD5

                                                                  ab8d85c093d6f0180bf09ec0f466b78b

                                                                  SHA1

                                                                  1daf355d14d45b1e411f96fa394a98a84c09e53e

                                                                  SHA256

                                                                  d1e08c8dbf3bfc34e3fdfc390d2e7f5b871f95376e7dda93e3dd0051d580db40

                                                                  SHA512

                                                                  2882292301e1fb85b410570ece6cf05f3e89968a02450dba192a1f97282f1c08ed30819e3d36c524fba3baeb6a2c22a10a762c8313e8823c07554b4b975cc00e

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.ini
                                                                  Filesize

                                                                  12B

                                                                  MD5

                                                                  9a5e9a329e4e73e0c499371205a810db

                                                                  SHA1

                                                                  5b6d85657d4acd89867283fbe372e9e85c30686f

                                                                  SHA256

                                                                  d109087c4ca318cad74b7560c32594d37181885adbdc9348ba1dd35d47b35b92

                                                                  SHA512

                                                                  02bd5261b9e795ed5a07badd65a6cf71d18751452fb44bdd424dfcc6c50ba7441e0066b125e731018fd6f1a8a002ac4e6961c7eff21c36fbda58c8015a100c43

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                  Filesize

                                                                  2.9MB

                                                                  MD5

                                                                  f39fbf03ca870084bde8bfd5e6e1ec39

                                                                  SHA1

                                                                  00febae56b76f76166fa64a0c0dc746b9feb61e4

                                                                  SHA256

                                                                  1c2761c31cf551a7b3034618fd0018d1a304bbcb97383d2bb13c47aeb8b23c60

                                                                  SHA512

                                                                  4c974603fb33e3711dc7f28e4580fef2a197ee1abfcc2c2384e4053c939847fa94b5d27a44ca6ad1fc8799dd80c2cc975c87e55e15902786e4b1e8dbe362bf7a

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  6c6f85e896655a6eb726482f04c49086

                                                                  SHA1

                                                                  2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                  SHA256

                                                                  e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                  SHA512

                                                                  b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.ini
                                                                  Filesize

                                                                  11B

                                                                  MD5

                                                                  5eda46a55c61b07029e7202f8cf1781c

                                                                  SHA1

                                                                  862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                  SHA256

                                                                  12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                  SHA512

                                                                  4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                  Filesize

                                                                  541B

                                                                  MD5

                                                                  d0efb0a6d260dbe5d8c91d94b77d7acd

                                                                  SHA1

                                                                  e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                                  SHA256

                                                                  7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                                  SHA512

                                                                  a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                  Filesize

                                                                  12B

                                                                  MD5

                                                                  880d31390a25de6a9cd34463b46c75e6

                                                                  SHA1

                                                                  837af65938c9606b5de3c6f2195fc3e855554cd7

                                                                  SHA256

                                                                  425adf50cf113d68bd6aa8dc1015db43422bbc1c977933d5f8c1ecaabf18eb2e

                                                                  SHA512

                                                                  8e9dd066ff73625a5a55d1ece5ba1e4fb248ab14a32880a3d4d86266176cb4f1c61f8301e1ff49839c283affe877b9fbcd3bc2b9763c08b0b63ba56023c2282b

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                  Filesize

                                                                  670KB

                                                                  MD5

                                                                  96e50bbca30d75af7b8b40acf8dda817

                                                                  SHA1

                                                                  4b1255280dff8de8b7be47def58f83f6ec39ded6

                                                                  SHA256

                                                                  a3ad00ccb61bc87d58eb7977f68130b78a0b95e74d61e6a4624ac114ccde5736

                                                                  SHA512

                                                                  0034c08cb878b703f272e3fd2734bb928ff1bdba85cf79a151519b019c83bd4d199c80af0aa30db28ef82f7ee68a9d59dcaede92f83bfe8787f6a5d4d5e9817c

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                  Filesize

                                                                  3.1MB

                                                                  MD5

                                                                  8e70af11d0ee2abe139b40d67e70b73c

                                                                  SHA1

                                                                  18582e88e16255d5d267904bdf0357ec9ff333e0

                                                                  SHA256

                                                                  5c687adaa48b83de220e8489e0ceb0093be1f94260750c8d94a1b8497781327e

                                                                  SHA512

                                                                  3a845ed4ab368b0dde7e98d77fb796e9070f6bb9472ea833e52b19eb5bd47260e0b288fd3c8d19235bd9ded6f7b11ea10985ad871c8f5c82751249301d3ee4a6

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                  Filesize

                                                                  572KB

                                                                  MD5

                                                                  7062f2490fde7624ceab2fac6a996b98

                                                                  SHA1

                                                                  63a355ebf702bd6fb4e10f4353e5dbaa036ff635

                                                                  SHA256

                                                                  dbf3e40e068c22a995bb917ef51153bf1d4dd06ab8a5bb5486ea017245edbf1c

                                                                  SHA512

                                                                  5674e823473887669a1d12ecea9f7569633fb885f570b3c7bd8fbb706b214c564a0aaf0bedebd0a61add76582316c7de9a2f5af5b4cd8d04f426d80987f2d7b3

                                                                  Download Submit

                                                                • C:\Program Files\dotnet\dotnet.exe
                                                                  Filesize

                                                                  143KB

                                                                  MD5

                                                                  71026b098f8fb39c88b003df746d9fa0

                                                                  SHA1

                                                                  013ca259f551ad6f33db53fff0e121e74408e20e

                                                                  SHA256

                                                                  11058e8c2cd05f30dcf1775644bf19d2913c9a6d674c12f91d1896d95d9cc5c2

                                                                  SHA512

                                                                  9830be3444225a4b2f9fa4aedbc8af4f45fdb2548f0b6a2eba2a2a407ea3c7d8fd78c0e37fac66cafbdfad781ae78b076d225fd5c836a451f57a54053ccef9ad

                                                                  Download Submit

                                                                • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\8afddf1dbf196d610c3f643a6ffdf3dd
                                                                  Filesize

                                                                  16KB

                                                                  MD5

                                                                  b2e89027a140a89b6e3eb4e504e93d96

                                                                  SHA1

                                                                  f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                  SHA256

                                                                  5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                  SHA512

                                                                  93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                  Download Submit

                                                                • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  a84db3b0f582d9ad724c977f70982560

                                                                  SHA1

                                                                  504a94c7a305e5905d6cc78652a8f338cbaa48a8

                                                                  SHA256

                                                                  bdafe849ec33bae4a8351ca447f973a6ffae66c75fbb02fdaddbe659e4220873

                                                                  SHA512

                                                                  9b0c203b80224e75e2a8320208eedfb8ce4f8077e1d08bcc2b9bfe4ce43125c2a5fddb24e218635c624fbd5d8cc451d007ce025f996d8a82215763258d85b2ae

                                                                  Download Submit

                                                                • C:\ProgramData\chocolatey\tools\7z.exe.manifest
                                                                  Filesize

                                                                  513B

                                                                  MD5

                                                                  8f89387331c12b55eaa26e5188d9e2ff

                                                                  SHA1

                                                                  537fdd4f1018ce8d08a3d151ad07b55d96e94dd2

                                                                  SHA256

                                                                  6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033

                                                                  SHA512

                                                                  04c10ae52f85d3a27d4b05b3d1427ddc2afaccfe94ed228f8f6ae4447fd2465d102f2dd95caf1b617f8c76cb4243716469d1da3dac3292854acd4a63ce0fd239

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                  Filesize

                                                                  727B

                                                                  MD5

                                                                  62f50b09757845b91a11afe304f912e7

                                                                  SHA1

                                                                  ca2093d46e2a9138ef71e5cb6d53d6ced356ec76

                                                                  SHA256

                                                                  9979dad90650f1a6d82d38cb84e4055e46b88f28bcc099b51cd5e2444cc280e9

                                                                  SHA512

                                                                  6b54ad0a12455914f3140a1f5341807cbd97470419109470eabab6cfa1083b703dfd19ea276caba534777bcc8265d80659e6d8db06bc03de57fb6fb3d9e68133

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                  Filesize

                                                                  404B

                                                                  MD5

                                                                  7fed08669ac47898ee7616d2b31a00cb

                                                                  SHA1

                                                                  2c74056f56d69e976322ed5e16b3e24aff125d8b

                                                                  SHA256

                                                                  05f12133d00cf3d7dd8cced5c1673450ee58b66c307d8290c81577ca6b3731b9

                                                                  SHA512

                                                                  b0b5eb9ab3ab3736971d61c576148adee1c6c918e4e5bc2e05b96781b37a78577cc25e6b084fd0859ea4a6566aeab7a68b091ff92b90fd29084fbd6c98895705

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                  Filesize

                                                                  651B

                                                                  MD5

                                                                  9bbfe11735bac43a2ed1be18d0655fe2

                                                                  SHA1

                                                                  61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                  SHA256

                                                                  549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                  SHA512

                                                                  a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSI2A94.tmp
                                                                  Filesize

                                                                  4.5MB

                                                                  MD5

                                                                  08211c29e0d617a579ffa2c41bde1317

                                                                  SHA1

                                                                  4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                                  SHA256

                                                                  3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                                  SHA512

                                                                  d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSI7A3E.tmp-\System.Management.dll
                                                                  Filesize

                                                                  60KB

                                                                  MD5

                                                                  878e361c41c05c0519bfc72c7d6e141c

                                                                  SHA1

                                                                  432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                  SHA256

                                                                  24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                  SHA512

                                                                  59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIC331.tmp
                                                                  Filesize

                                                                  509KB

                                                                  MD5

                                                                  88d29734f37bdcffd202eafcdd082f9d

                                                                  SHA1

                                                                  823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                  SHA256

                                                                  87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                  SHA512

                                                                  1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIC331.tmp-\AlphaControlAgentInstallation.dll
                                                                  Filesize

                                                                  25KB

                                                                  MD5

                                                                  aa1b9c5c685173fad2dabebeb3171f01

                                                                  SHA1

                                                                  ed756b1760e563ce888276ff248c734b7dd851fb

                                                                  SHA256

                                                                  e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                  SHA512

                                                                  d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIC331.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                  Filesize

                                                                  179KB

                                                                  MD5

                                                                  1a5caea6734fdd07caa514c3f3fb75da

                                                                  SHA1

                                                                  f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                  SHA256

                                                                  cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                  SHA512

                                                                  a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIC70A.tmp-\CustomAction.config
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  bc17e956cde8dd5425f2b2a68ed919f8

                                                                  SHA1

                                                                  5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                  SHA256

                                                                  e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                  SHA512

                                                                  02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIC70A.tmp-\Newtonsoft.Json.dll
                                                                  Filesize

                                                                  695KB

                                                                  MD5

                                                                  715a1fbee4665e99e859eda667fe8034

                                                                  SHA1

                                                                  e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                  SHA256

                                                                  c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                  SHA512

                                                                  bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSICBC9.tmp
                                                                  Filesize

                                                                  219KB

                                                                  MD5

                                                                  928f4b0fc68501395f93ad524a36148c

                                                                  SHA1

                                                                  084590b18957ca45b4a0d4576d1cc72966c3ea10

                                                                  SHA256

                                                                  2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae

                                                                  SHA512

                                                                  7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSICD18.tmp
                                                                  Filesize

                                                                  211KB

                                                                  MD5

                                                                  a3ae5d86ecf38db9427359ea37a5f646

                                                                  SHA1

                                                                  eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                  SHA256

                                                                  c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                  SHA512

                                                                  96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                  Download Submit

                                                                • C:\Windows\Installer\e57c294.msi
                                                                  Filesize

                                                                  2.9MB

                                                                  MD5

                                                                  eaf2eab89c1b5f8eccf2e62a5a4fb002

                                                                  SHA1

                                                                  24e2a1958e34f8db3378c8210ef5f0e5166a1537

                                                                  SHA256

                                                                  819ad25e1dfd53f40ca7d7d176c2a1abf14b16fd5325936c1390ab3001e26af9

                                                                  SHA512

                                                                  25e7a8b39e585867d71b8edc472b4240e051a5ef5e2c23ddcddc20dc556a8381adc783884c7e2183c778ca445379654bc59a0cf16e4029c2b4b479243d34494a

                                                                  Download Submit

                                                                • C:\Windows\Installer\e57c2b0.msi
                                                                  Filesize

                                                                  26.3MB

                                                                  MD5

                                                                  b9c6d23462adef092b8a5b7880531b03

                                                                  SHA1

                                                                  9e8c4f7f48d38fb54a93789a583852869c074f2d

                                                                  SHA256

                                                                  2e23da54aa1ff64de09021ab089c1be6d4a323bdf0d8f46f78b5c6a33df83109

                                                                  SHA512

                                                                  18623991c5690e516541eaf867f22b3a1a02317392178943143bedc7f7eda5e02e69665c3c4a5fa50ade516a191bbbf16fd71e60f3225f660fb10ebc25cd01a5

                                                                  Download Submit

                                                                • C:\Windows\Installer\e57c2b1.msi
                                                                  Filesize

                                                                  772KB

                                                                  MD5

                                                                  d73de5788ab129f16afdd990d8e6bfa9

                                                                  SHA1

                                                                  88cb87af50ea4999e2079d9269ce64c8eb1a584e

                                                                  SHA256

                                                                  4f9ac5a094e9b1b4f0285e6e69c2e914e42dcc184dfe6fe93894f8e03ca6c193

                                                                  SHA512

                                                                  bfc32f9a20e30045f5207446c6ab6e8ef49a3fd7a5a41491c2242e10fee8efd2f82f81c3ff3bf7681e5e660fde065a315a89d87e9f488c863421fe1d6381ba3b

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{146fa5bb-96b9-794c-96c8-60085bbadca8}\lci_iddcx.cat
                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  62458e58313475c9a3642a392363e359

                                                                  SHA1

                                                                  e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                  SHA256

                                                                  85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                  SHA512

                                                                  49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{146fa5bb-96b9-794c-96c8-60085bbadca8}\lci_iddcx.inf
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  1cec22ca85e1b5a8615774fca59a420b

                                                                  SHA1

                                                                  049a651751ef38321a1088af6a47c4380f9293fc

                                                                  SHA256

                                                                  60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                  SHA512

                                                                  0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{146fa5bb-96b9-794c-96c8-60085bbadca8}\x64\lci_iddcx.dll
                                                                  Filesize

                                                                  52KB

                                                                  MD5

                                                                  01e8bc64139d6b74467330b11331858d

                                                                  SHA1

                                                                  b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                  SHA256

                                                                  148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                  SHA512

                                                                  4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{e466658d-dbeb-b94c-ad23-5e3d4350ff32}\lci_proxywddm.cat
                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  8e16d54f986dbe98812fd5ec04d434e8

                                                                  SHA1

                                                                  8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                  SHA256

                                                                  7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                  SHA512

                                                                  e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{e466658d-dbeb-b94c-ad23-5e3d4350ff32}\lci_proxywddm.inf
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  0315a579f5afe989154cb7c6a6376b05

                                                                  SHA1

                                                                  e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                  SHA256

                                                                  d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                  SHA512

                                                                  c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{e466658d-dbeb-b94c-ad23-5e3d4350ff32}\x64\lci_proxyumd.dll
                                                                  Filesize

                                                                  179KB

                                                                  MD5

                                                                  4dc11547a5fc28ca8f6965fa21573481

                                                                  SHA1

                                                                  d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                  SHA256

                                                                  e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                  SHA512

                                                                  bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{e466658d-dbeb-b94c-ad23-5e3d4350ff32}\x64\lci_proxyumd32.dll
                                                                  Filesize

                                                                  135KB

                                                                  MD5

                                                                  67ae7b2c36c9c70086b9d41b4515b0a8

                                                                  SHA1

                                                                  ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                  SHA256

                                                                  79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                  SHA512

                                                                  4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{e466658d-dbeb-b94c-ad23-5e3d4350ff32}\x64\lci_proxywddm.sys
                                                                  Filesize

                                                                  119KB

                                                                  MD5

                                                                  b9b0e9b4d93b18b99ece31a819d71d00

                                                                  SHA1

                                                                  2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                  SHA256

                                                                  0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                  SHA512

                                                                  465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                  Download Submit

                                                                • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-05-14-21.dat
                                                                  Filesize

                                                                  602B

                                                                  MD5

                                                                  9250376c8cd3192af9c8c1c21d23d4b3

                                                                  SHA1

                                                                  f0f4326b4472a3189cb8dedce25040f79995c06a

                                                                  SHA256

                                                                  21a025cc83cd89508627b9a75d7d1b83010648b9c59368cf030fe13c9ee0a44f

                                                                  SHA512

                                                                  dda172a944a5fe3265b42eeea464f4a8af401f8e530795e011d395a6d42c14f0f916dbc9a9a682dc925524d053cae8424363d7fb952dce71ceb20cfd126916d2

                                                                  Download Submit

                                                                • C:\Windows\Temp\InstallUtil.log
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  9357003b93f3a261ac7fa0f03df384ec

                                                                  SHA1

                                                                  27e7db18bdc6b38f9a360d97f94e1f35317e845a

                                                                  SHA256

                                                                  26ef4fa2a0f2e4f14c68c0d3db0a1f9a12fcc0269123f7a24ae03f2b8feb7e82

                                                                  SHA512

                                                                  31b6a7a5a5c83a64671cb00afb9a09d4f87a368caba3da514316a4f926a992d427b81a02616b6d129690ba4897916c7adb01a0b33062bf334d21230dd867c476

                                                                  Download Submit

                                                                • C:\Windows\Temp\InstallUtil.log
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  c9ece66ff5c629953ad12ff195c4912c

                                                                  SHA1

                                                                  c4427e97783f8454d86f14cc673d9a0ddea53ed8

                                                                  SHA256

                                                                  54d64231a885b4d8c40faf0189effa7a95994236414b23c1ffe96636562b4add

                                                                  SHA512

                                                                  371aea84b98ac3e7855f3b912e4e4c0172ef2a0fbee77413e6d590d02387c851bbf44dd7927a4e9beda19cb72cc10a08e0d1979d2bf14dd49e46a70d6eec3053

                                                                  Download Submit

                                                                • C:\Windows\Temp\PreVer.log
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  afe9c4d0c40709213d370126028b2f2c

                                                                  SHA1

                                                                  dc3c08efe3c0869fa991a80b271be79dac457550

                                                                  SHA256

                                                                  8296493581d240a410326faff7d081ce0bcaa426bf8a8b2557c8b7367e0a3e7b

                                                                  SHA512

                                                                  096648f24ca0f28e8ca31e79538137ef6a4b0c023967affd9bbb00ef98663345baf781c1048530bebbb3112b81bcf565fcc684892acd9e1cf4dc0a1a91f4d0e0

                                                                  Download Submit

                                                                • C:\Windows\Temp\__PSScriptPolicyTest_ab0jkqik.hmu.ps1
                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                  Download Submit

                                                                • C:\Windows\Temp\unpack.log
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  4e63e0f1572785c0f19e7329c1b23862

                                                                  SHA1

                                                                  7b927669d8e5d0b59589f748ad744d9902ac05a3

                                                                  SHA256

                                                                  c78d1fb4fabb548e6c94b9712f5488a9fc3fb8b8cd75dad694182942fd27a0e5

                                                                  SHA512

                                                                  f0151e7fbdc014e45a2969a1944e758425111363b87dea7cbb6c9ca1008015b1dfe127dcd3c56c078d86a438b1759f302a97efdcdbe183321d022c98d836c109

                                                                  Download Submit

                                                                • C:\Windows\Temp\unpack.log
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  05f3a616afad1c23d4e983f62880d708

                                                                  SHA1

                                                                  95dd0b0d9cae876653f01daba809e040890698ee

                                                                  SHA256

                                                                  dacec723a95d590a5f3633515b72fe454d77d7c64810792ff9a5b3ebaa257316

                                                                  SHA512

                                                                  ba829d569036cc0f24b93549660b4dc6349e9c1221d9b8456bc39ff13bc983c669d4525d4bc686f882fbaff80e2c6e7b2fa54b3e3e46b89bfa8a810e088ed16c

                                                                  Download Submit

                                                                • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                  Filesize

                                                                  3.2MB

                                                                  MD5

                                                                  2c18826adf72365827f780b2a1d5ea75

                                                                  SHA1

                                                                  a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                                  SHA256

                                                                  ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                                  SHA512

                                                                  474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                                  Download Submit

                                                                • C:\Windows\Temp\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\ISRT.dll
                                                                  Filesize

                                                                  427KB

                                                                  MD5

                                                                  85315ad538fa5af8162f1cd2fce1c99d

                                                                  SHA1

                                                                  31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                  SHA256

                                                                  70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                  SHA512

                                                                  877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                  Download Submit

                                                                • C:\Windows\Temp\{13F699DE-2699-46E8-BDFE-4FAEB87E1D89}\_isres_0x0409.dll
                                                                  Filesize

                                                                  1.8MB

                                                                  MD5

                                                                  befe2ef369d12f83c72c5f2f7069dd87

                                                                  SHA1

                                                                  b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                  SHA256

                                                                  9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                  SHA512

                                                                  760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                  Download Submit

                                                                • C:\Windows\Temp\{300B01C4-BE77-4A15-BE10-CDB81D40A165}\.ba\bg.png
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  9eb0320dfbf2bd541e6a55c01ddc9f20

                                                                  SHA1

                                                                  eb282a66d29594346531b1ff886d455e1dcd6d99

                                                                  SHA256

                                                                  9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

                                                                  SHA512

                                                                  9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

                                                                  Download Submit

                                                                • C:\Windows\Temp\{300B01C4-BE77-4A15-BE10-CDB81D40A165}\.be\dotnet-runtime-8.0.11-win-x64.exe
                                                                  Filesize

                                                                  607KB

                                                                  MD5

                                                                  669de3ab32955e69decfe13a3c89891e

                                                                  SHA1

                                                                  ab2e90613c8b9261f022348ca11952a29f9b2c73

                                                                  SHA256

                                                                  2240e6318171b3cddcee6a801488f59145c1f54ca123068c2a73564535954677

                                                                  SHA512

                                                                  be5d737a7d25cc779736b60b1ea59982593f0598e207340219a13fd9572d140cfbcd112e3cf93e3be6085fe284a54d4458563e6f6e4e1cfe7c919685c9ee5442

                                                                  Download Submit

                                                                • C:\Windows\Temp\{9B395237-5D40-4CF3-A540-5201852DF325}\IsConfig.ini
                                                                  Filesize

                                                                  571B

                                                                  MD5

                                                                  d239b8964e37974225ad69d78a0a8275

                                                                  SHA1

                                                                  cf208e98a6f11d1807cd84ca61504ad783471679

                                                                  SHA256

                                                                  0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                                  SHA512

                                                                  88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                                  Download Submit

                                                                • C:\Windows\Temp\{9B395237-5D40-4CF3-A540-5201852DF325}\String1033.txt
                                                                  Filesize

                                                                  182KB

                                                                  MD5

                                                                  99bbffd900115fe8672c73fb1a48a604

                                                                  SHA1

                                                                  8f587395fa6b954affef337c70781ce00913950e

                                                                  SHA256

                                                                  57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                                  SHA512

                                                                  d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                                  Download Submit

                                                                • C:\Windows\Temp\{9B395237-5D40-4CF3-A540-5201852DF325}\_is1FA9.exe
                                                                  Filesize

                                                                  179KB

                                                                  MD5

                                                                  7a1c100df8065815dc34c05abc0c13de

                                                                  SHA1

                                                                  3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                  SHA256

                                                                  e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                  SHA512

                                                                  bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                  Download Submit

                                                                • C:\Windows\Temp\{9B395237-5D40-4CF3-A540-5201852DF325}\setup.inx
                                                                  Filesize

                                                                  345KB

                                                                  MD5

                                                                  0376dd5b7e37985ea50e693dc212094c

                                                                  SHA1

                                                                  02859394164c33924907b85ab0aaddc628c31bf1

                                                                  SHA256

                                                                  c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                  SHA512

                                                                  69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                  Download Submit

                                                                • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  Filesize

                                                                  727B

                                                                  MD5

                                                                  f11d59d55f077f02f2651680043ddaa2

                                                                  SHA1

                                                                  0146112dcbb3b26a6c6f24839f6b1276934eb35b

                                                                  SHA256

                                                                  a642d13d047785429ffb39d7bfc6e7dd0b92b1be61170e6ecc876671a02fb6e2

                                                                  SHA512

                                                                  313151140da21c56c26d5ec8a4a49e791d9654e15fb387b5f1374337a644c0e7deb0e3d9c45a9f02b3ee5b83b6cd1a03fa4bbda857d3ce5a332eaa06487be5b4

                                                                  Download Submit

                                                                • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                  Filesize

                                                                  404B

                                                                  MD5

                                                                  fa292192c1097de4e36056c65a6cc77e

                                                                  SHA1

                                                                  c8dbf5715f40bbb95aa0a7b6386e39419fccbbda

                                                                  SHA256

                                                                  a498e03cff0ae1677bc95613ccd98c32482cab2715434b42d79c0d7a12f87b73

                                                                  SHA512

                                                                  59b9ceb9bbd625cfae9092b0a25e377fb93fa250651f9ddb7331c7fe837758061d7f62f8ac6acc388062c3cfcd3d43808238d962b8f7091f0523bdf67a61ac4e

                                                                  Download Submit

                                                                • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  Filesize

                                                                  412B

                                                                  MD5

                                                                  72a9b21e88237eb788f2fdf9c1d5d36b

                                                                  SHA1

                                                                  2071439acd781b16ae8192e5dda896a7418d6f75

                                                                  SHA256

                                                                  99a450483069eca2f120b9711abbca30b2cd0d64f45a75c5f3f4176400461a13

                                                                  SHA512

                                                                  1091fe708622c59caebec3e5452cb488fd2e98d5725c8719631313804f70a1c3e7e7bc7350bf34ad55d6239d475e391283ba6423e7a2398e1e5d3c0b98550252

                                                                  Download Submit

                                                                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  9cad061ddf5ad182cfe7879190aeed71

                                                                  SHA1

                                                                  cfd292d16d937f95b642527464403b7e5ef6af96

                                                                  SHA256

                                                                  b2d273fa926ebf6946e69e8808ad332db42bc65f449748082e088aa732e408ca

                                                                  SHA512

                                                                  df517d66358f441a7c4c690cd90e214f18d490e3de767dd76164effaa179b1dd865a0056d68ce3ab6aee55917465c7f39146e7694b1ac475fcc95c280fb29e92

                                                                  Download Submit

                                                                • memory/536-29-0x00000000030B0000-0x00000000030DE000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/536-33-0x00000000030F0000-0x00000000030FC000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/832-4747-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/832-4746-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/832-1199-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/832-1740-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/832-2607-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/832-2608-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/832-1200-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/832-1736-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/908-362-0x0000029BC6090000-0x0000029BC6098000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/908-360-0x0000029BAD900000-0x0000029BAD908000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/908-356-0x0000029BAD270000-0x0000029BAD278000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/908-357-0x0000029BAD280000-0x0000029BAD28A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/908-354-0x0000029BC5FE0000-0x0000029BC602C000-memory.dmp

                                                                  Filesize

                                                                  304KB

                                                                  Download

                                                                • memory/908-353-0x0000029BAD250000-0x0000029BAD26C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/908-352-0x0000029BAD830000-0x0000029BAD87A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/908-351-0x0000029BACE30000-0x0000029BACE98000-memory.dmp

                                                                  Filesize

                                                                  416KB

                                                                  Download

                                                                • memory/908-358-0x0000029BC6280000-0x0000029BC635C000-memory.dmp

                                                                  Filesize

                                                                  880KB

                                                                  Download

                                                                • memory/908-359-0x0000029BC6360000-0x0000029BC6412000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/908-361-0x0000029BC6080000-0x0000029BC6088000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/908-355-0x0000029BC6030000-0x0000029BC6078000-memory.dmp

                                                                  Filesize

                                                                  288KB

                                                                  Download

                                                                • memory/908-363-0x0000029BC6420000-0x0000029BC6488000-memory.dmp

                                                                  Filesize

                                                                  416KB

                                                                  Download

                                                                • memory/908-364-0x0000029BC60D0000-0x0000029BC60FA000-memory.dmp

                                                                  Filesize

                                                                  168KB

                                                                  Download

                                                                • memory/908-365-0x0000029BC64D0000-0x0000029BC650A000-memory.dmp

                                                                  Filesize

                                                                  232KB

                                                                  Download

                                                                • memory/908-366-0x0000029BC60A0000-0x0000029BC60C6000-memory.dmp

                                                                  Filesize

                                                                  152KB

                                                                  Download

                                                                • memory/1068-4748-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1068-4749-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1068-1212-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1068-1201-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1292-501-0x000002A1E1A00000-0x000002A1E1A26000-memory.dmp

                                                                  Filesize

                                                                  152KB

                                                                  Download

                                                                • memory/1492-2366-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1492-2602-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1492-1186-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1492-1265-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1492-1187-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1492-1264-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1492-2365-0x0000000072240000-0x000000007235C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1492-2603-0x0000000071E70000-0x000000007223D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1860-1835-0x00000164EBC00000-0x00000164EBCB2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/1860-1836-0x00000164D3360000-0x00000164D337C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/1860-1845-0x00000164D33D0000-0x00000164D3418000-memory.dmp

                                                                  Filesize

                                                                  288KB

                                                                  Download

                                                                • memory/1860-1792-0x00000164D2A50000-0x00000164D2A8A000-memory.dmp

                                                                  Filesize

                                                                  232KB

                                                                  Download

                                                                • memory/2556-1780-0x000001C84E7E0000-0x000001C84E7F8000-memory.dmp

                                                                  Filesize

                                                                  96KB

                                                                  Download

                                                                • memory/2556-1782-0x000001C867570000-0x000001C867622000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/2556-1779-0x000001C84E400000-0x000001C84E40C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/2556-1796-0x000001C84E800000-0x000001C84E820000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2748-1783-0x000002A9FE530000-0x000002A9FE53A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/2748-1856-0x000002A998000000-0x000002A998528000-memory.dmp

                                                                  Filesize

                                                                  5.2MB

                                                                  Download

                                                                • memory/2748-1786-0x000002A9FED60000-0x000002A9FED7A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/2748-1795-0x000002A9FF760000-0x000002A9FF812000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/2788-297-0x00000228A8BA0000-0x00000228A8BBC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/2788-296-0x00000228C1330000-0x00000228C13E2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/2788-295-0x00000228A8220000-0x00000228A8236000-memory.dmp

                                                                  Filesize

                                                                  88KB

                                                                  Download

                                                                • memory/2864-66-0x00000000054E0000-0x0000000005592000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/2864-69-0x00000000053D0000-0x00000000053F2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2864-70-0x00000000055A0000-0x00000000058F4000-memory.dmp

                                                                  Filesize

                                                                  3.3MB

                                                                  Download

                                                                • memory/2984-100-0x0000000004A40000-0x0000000004AA6000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/3040-260-0x0000016443430000-0x0000016443472000-memory.dmp

                                                                  Filesize

                                                                  264KB

                                                                  Download

                                                                • memory/3040-263-0x000001645C5A0000-0x000001645C650000-memory.dmp

                                                                  Filesize

                                                                  704KB

                                                                  Download

                                                                • memory/3040-265-0x0000016443CB0000-0x0000016443CCC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/3456-1823-0x000001F5CB0C0000-0x000001F5CB10A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/3456-1864-0x000001F5E3B40000-0x000001F5E3BF0000-memory.dmp

                                                                  Filesize

                                                                  704KB

                                                                  Download

                                                                • memory/3456-1803-0x000001F5CA850000-0x000001F5CA85C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/3456-1827-0x000001F5CACE0000-0x000001F5CACFC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/3608-231-0x000001FD4BD20000-0x000001FD4BD58000-memory.dmp

                                                                  Filesize

                                                                  224KB

                                                                  Download

                                                                • memory/3608-191-0x000001FD4B760000-0x000001FD4B782000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/3608-185-0x000001FD4B820000-0x000001FD4B8D2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/3968-154-0x000002BB1F230000-0x000002BB1F242000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/3968-150-0x000002BB39530000-0x000002BB395C8000-memory.dmp

                                                                  Filesize

                                                                  608KB

                                                                  Download

                                                                • memory/3968-138-0x000002BB1EE40000-0x000002BB1EE68000-memory.dmp

                                                                  Filesize

                                                                  160KB

                                                                  Download

                                                                • memory/3968-155-0x000002BB1F2A0000-0x000002BB1F2DC000-memory.dmp

                                                                  Filesize

                                                                  240KB

                                                                  Download

                                                                • memory/4056-1412-0x000001C1633A0000-0x000001C1633C6000-memory.dmp

                                                                  Filesize

                                                                  152KB

                                                                  Download

                                                                • memory/4228-530-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4228-564-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4228-952-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4228-1133-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4228-1059-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4228-955-0x0000000003160000-0x0000000003327000-memory.dmp

                                                                  Filesize

                                                                  1.8MB

                                                                  Download

                                                                • memory/4228-533-0x0000000003120000-0x00000000032E7000-memory.dmp

                                                                  Filesize

                                                                  1.8MB

                                                                  Download

                                                                • memory/5184-1841-0x00000240D8810000-0x00000240D882C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/5184-1828-0x00000240D7FD0000-0x00000240D7FE2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/5184-1830-0x00000240D8840000-0x00000240D888A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/5184-1866-0x00000240F1320000-0x00000240F13D2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5320-1832-0x000001BED4380000-0x000001BED43CA000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/5320-1848-0x000001BEECEF0000-0x000001BEECFCC000-memory.dmp

                                                                  Filesize

                                                                  880KB

                                                                  Download

                                                                • memory/5320-1859-0x000001BEECE10000-0x000001BEECEC2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5320-1840-0x000001BED4320000-0x000001BED433C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/5320-1829-0x000001BED3AF0000-0x000001BED3B00000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/5396-1851-0x00000291062D0000-0x000002910631A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/5396-1858-0x000002911EB50000-0x000002911EB68000-memory.dmp

                                                                  Filesize

                                                                  96KB

                                                                  Download

                                                                • memory/5396-1847-0x0000029105A40000-0x0000029105A74000-memory.dmp

                                                                  Filesize

                                                                  208KB

                                                                  Download

                                                                • memory/5396-1857-0x00000291062A0000-0x00000291062BC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/5396-1862-0x000002911EBC0000-0x000002911EC0A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/5396-1861-0x00000291062C0000-0x00000291062CA000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/5536-1843-0x000002A6DCE40000-0x000002A6DCEF2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5536-1834-0x000002A6C4560000-0x000002A6C457C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/5536-1831-0x000002A6C3D00000-0x000002A6C3D12000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/5864-1842-0x00000163B25D0000-0x00000163B25E2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/5864-1865-0x00000163CB8E0000-0x00000163CB926000-memory.dmp

                                                                  Filesize

                                                                  280KB

                                                                  Download

                                                                • memory/5864-1863-0x00000163CBF40000-0x00000163CC59C000-memory.dmp

                                                                  Filesize

                                                                  6.4MB

                                                                  Download

                                                                • memory/5864-1855-0x00000163B2E40000-0x00000163B2E60000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/5864-1854-0x00000163CB720000-0x00000163CB7D2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5864-1844-0x00000163B2A60000-0x00000163B2A70000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/6052-1852-0x0000018CC8670000-0x0000018CC86D6000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/6052-1853-0x0000018CAFF40000-0x0000018CAFF54000-memory.dmp

                                                                  Filesize

                                                                  80KB

                                                                  Download

                                                                • memory/6052-1838-0x0000018CAFF00000-0x0000018CAFF20000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/6052-1833-0x0000018CAF5B0000-0x0000018CAF5C0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/6052-1846-0x0000018CC8730000-0x0000018CC87E2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download