Overview

overview

10

Static

static

10

RQ-9320.msi

windows7-x64

10

RQ-9320.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2025, 01:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RQ-9320.msi

  • Size

    2.9MB

  • MD5

    6e9a59d1ea18ce58e5fac465c188dfdc

  • SHA1

    0ebcc6b59014326c1e1e5cea57734026d5a692e4

  • SHA256

    ed6fdde07417d5285eb5283ef25349fb4808948c5e7131c7a67c1dc34af29b84

  • SHA512

    0cc8a8c2acd2fa19544087932db67090dca07c6bc20dde11af43f028324c7e71714b40157d9effeb3a18037a46d2a5d3025c2e93aad09fbd8bb010d18ffc9cf2

  • SSDEEP

    49152:G+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQG:G+lUlz9FKbsodq0YaH7ZPxMb8tT9

Score
10/10
ateraagentbootkitdiscoveryexecutionpersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RQ-9320.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3584
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2756
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 51E2DE7D5EC6CA9412DF6876551ED759
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI2B12.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240659484 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1920
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI2E01.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240660015 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3396
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3248.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240661062 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2464
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4018.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240664640 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:744
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D9DD44AD7DF7560FA90B2E987F90382D E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:596
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3140
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000QdujKIAR" /AgentId="f9eaf87f-9af8-4498-aab5-e5b98199ed07"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1484
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 86640809F40679633150339911FCFE90 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:2080
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C84230A4-84AC-44C9-9AD4-38E23E145D27}
        3⤵
        • Executes dropped EXE
        PID:4836
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D68ED97D-316E-4BD4-88ED-25CE6FC4E114}
        3⤵
        • Executes dropped EXE
        PID:3664
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CFD52159-9A5E-4007-8111-2589DC736B2D}
        3⤵
        • Executes dropped EXE
        PID:4516
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5A4DCD04-1837-4EA6-8E49-0FFA217D4A5D}
        3⤵
        • Executes dropped EXE
        PID:4564
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D250E20C-2C7A-4E45-8FFB-99F0C1339EE7}
        3⤵
        • Executes dropped EXE
        PID:636
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D0BB44BD-4C7E-48ED-8D1A-EAA207D678F6}
        3⤵
        • Executes dropped EXE
        PID:4676
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9B57C33-F287-4BED-B4CF-94A665242070}
        3⤵
        • Executes dropped EXE
        PID:2016
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{699BD56F-C402-4ECE-BCED-140EE6881186}
        3⤵
        • Executes dropped EXE
        PID:3720
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BAC88662-49D5-4D6E-9EA8-B2BEF508AE2B}
        3⤵
        • Executes dropped EXE
        PID:4132
      • C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe
        C:\Windows\TEMP\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_is7CEB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EFB33474-6584-4796-99E3-6EAED9D9A219}
        3⤵
        • Executes dropped EXE
        PID:4064
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3160
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1068
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3584
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1000
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4832
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4132
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1080
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          4⤵
            PID:4064
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4748
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1428
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:1000
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRFeatMini.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1780
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5132
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRManager.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5180
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5212
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAgent.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5268
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5308
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRChat.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5352
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5388
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAudioChat.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5432
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5460
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRVirtualDisplay.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5512
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF976446-2C74-4C6F-B6E6-7CA4C8D9095A}
            3⤵
            • Executes dropped EXE
            PID:5640
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1D901DFE-2A8A-43C9-BAE4-25B82948D7FB}
            3⤵
            • Executes dropped EXE
            PID:5676
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EEA7FD3A-0FD1-4E82-85DA-B31D3AFBDDC3}
            3⤵
            • Executes dropped EXE
            PID:5712
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{961412D3-9C28-4F84-BA36-EE84CB690FF6}
            3⤵
            • Executes dropped EXE
            PID:5760
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E9CDEEB6-ECE1-4A3B-B3AD-A08F54C1AD9F}
            3⤵
            • Executes dropped EXE
            PID:5812
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0E0345FD-92A9-4AA9-BDFA-45BAFED74C35}
            3⤵
            • Executes dropped EXE
            PID:5892
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F28AEA7D-DE1F-459E-A131-D0A085FD2B57}
            3⤵
            • Executes dropped EXE
            PID:5924
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C84245DA-59CE-4652-A9D4-620029244E49}
            3⤵
            • Executes dropped EXE
            PID:5964
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4AB0A83B-3923-4FEA-8381-C24E56089FE1}
            3⤵
            • Executes dropped EXE
            PID:5996
          • C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
            C:\Windows\TEMP\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A474AA2-4B32-4005-9295-30801D980269}
            3⤵
            • Executes dropped EXE
            PID:6032
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{782EA651-A91D-4DB7-8F59-D8ACBFEA4261}
            3⤵
            • Executes dropped EXE
            PID:5792
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C68A4ACA-1B8B-4356-A153-357A90C37912}
            3⤵
            • Executes dropped EXE
            PID:5828
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A7D8CAC-F2B4-4F0C-A6C5-1ABAE9771918}
            3⤵
            • Executes dropped EXE
            PID:5820
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A5348B65-7DF1-4694-8857-8122BC5D47A0}
            3⤵
            • Executes dropped EXE
            PID:5768
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DF5F9113-B9E2-4012-A866-462567C90262}
            3⤵
            • Executes dropped EXE
            PID:5960
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1FC444E7-A2B8-4E0D-9123-3AB4777F7CAB}
            3⤵
            • Executes dropped EXE
            PID:6056
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4B1B42C7-66D8-458F-A90D-7857E4BD1ADD}
            3⤵
            • Executes dropped EXE
            PID:6100
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A5AB9889-1A2B-4D65-8A15-CA3FD454D0D8}
            3⤵
            • Executes dropped EXE
            PID:6128
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1FAAE786-E138-473E-9095-C5DE1ED85C97}
            3⤵
            • Executes dropped EXE
            PID:5124
          • C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe
            C:\Windows\TEMP\{9D3B0A0C-5502-4C6C-92FB-D20B9B902498}\_is97E8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{49BD9E3A-5D1B-41C5-AED3-97BA40F00FDD}
            3⤵
            • Executes dropped EXE
            PID:4988
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5592
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3176
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5520
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:220
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                4⤵
                  PID:5648
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:5788
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{78D82C61-4B27-41ED-AD50-24B9052604B3}
                3⤵
                • Executes dropped EXE
                PID:5852
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB91F350-0BF8-4532-97EE-5BBF72799630}
                3⤵
                • Executes dropped EXE
                PID:5884
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3CC3AF70-6669-4CAC-9F80-6345621C07F9}
                3⤵
                • Executes dropped EXE
                PID:5864
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35649EF7-6B58-489E-A09B-BF61317F50C2}
                3⤵
                • Executes dropped EXE
                PID:6012
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D2E0CBD8-48FB-458F-AC51-0BC24D4E621D}
                3⤵
                • Executes dropped EXE
                PID:6000
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{14728A22-C546-4C53-AA63-A9B4A2A777F2}
                3⤵
                • Executes dropped EXE
                PID:2016
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{168366B7-0002-4C5A-B5F2-EDC86DDAA152}
                3⤵
                • Executes dropped EXE
                PID:2008
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D608F713-48D4-41F3-88A6-C2E04CFDB733}
                3⤵
                • Executes dropped EXE
                PID:3464
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB5EC1B6-083D-4E53-AA0E-7D73E061815B}
                3⤵
                • Executes dropped EXE
                PID:3192
              • C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe
                C:\Windows\TEMP\{85D2FB1E-22F6-4B24-827E-2A502DBE8134}\_isA74B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7899B8D5-9B00-4EFA-B25B-E17404DD4B27}
                3⤵
                • Executes dropped EXE
                PID:5900
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:5152
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4822CE2E-AAA5-45CC-A436-F4E18C3B06D3}
                3⤵
                • Executes dropped EXE
                PID:5432
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71CA6810-069D-459A-BCDE-930CFD1C1439}
                3⤵
                • Executes dropped EXE
                PID:5404
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16A19BF4-F3FA-4BBB-A25D-654527E080DF}
                3⤵
                • Executes dropped EXE
                PID:5524
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF3EB258-FBD2-4787-9A14-64CFD2F74217}
                3⤵
                • Executes dropped EXE
                PID:5468
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7F0F7472-9B61-4D5E-A52C-7D21A5FE72E3}
                3⤵
                • Executes dropped EXE
                PID:1596
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E7F2DCE7-BF8D-41B5-9977-62A6F34B126D}
                3⤵
                • Executes dropped EXE
                PID:5572
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD723673-68F5-431C-A2B9-F06866888D10}
                3⤵
                • Executes dropped EXE
                PID:5668
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{01F3D83D-08A9-474D-8B41-91B2AFAD62EB}
                3⤵
                • Executes dropped EXE
                PID:5692
              • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{77211FB5-A410-4C4F-9CCA-177A8D78E5A3}
                3⤵
                  PID:5616
                • C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe
                  C:\Windows\TEMP\{3009F0DD-5673-4B6A-8377-8030307E7F1A}\_isAA98.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E09ABF45-5B4D-4B99-9758-918CFEEB9E79}
                  3⤵
                    PID:5508
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5764
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding D2C0B2D40FF31E9925F348AD43B7BD2E E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1852
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIE80C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707656 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                    3⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2904
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIE974.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707953 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1372
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIEB0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717484 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                    3⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4572
                  • C:\Windows\SysWOW64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1596
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2620
                  • C:\Windows\SysWOW64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:4704
                  • C:\Windows\syswow64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2852
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:440
                  • C:\Windows\syswow64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:5440
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSI2C53.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725062 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:3396
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                  2⤵
                  • Drops file in System32 directory
                  PID:4228
                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="52db96a0-710d-4f61-94de-d69338d6207e"
                  2⤵
                  • Modifies data under HKEY_USERS
                  PID:960
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 3522BF93EEDEADB07A41942DBE3DC865 E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2908
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding A17BDEF296BD395B0A1D82827D02835F E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:5072
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding F100E9AF2997E0E7B17C59626D420D3A E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:5552
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:4688
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:552
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:1852
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "7f1a91e9-6bae-4b9e-a84d-d2927c976800" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QdujKIAR
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1484
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "59bc0869-9fc5-4193-9176-bf180e53ee91" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QdujKIAR
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2868
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "5a15aef4-97fe-41c2-8384-f1cccc521c8e" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000QdujKIAR
                  2⤵
                  • Executes dropped EXE
                  PID:8
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "f7a18c51-98ce-40ec-9a22-fb18c8cd096b" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000QdujKIAR
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2556
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                    3⤵
                    • Drops file in System32 directory
                    • Command and Scripting Interpreter: PowerShell
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3160
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4012
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:1368
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "46173078-3fa1-44ab-b30b-ead63e64e426" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOjMsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000QdujKIAR
                  2⤵
                  • Downloads MZ/PE file
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2976
                  • C:\Windows\TEMP\SplashtopStreamer.exe
                    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4016
                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4664
                      • C:\Windows\SysWOW64\msiexec.exe
                        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4440
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "b8934644-6c48-441d-be22-d06feeb8ae1c" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000QdujKIAR
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies data under HKEY_USERS
                  PID:4676
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2968
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:5088
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "2717b347-5c64-4dbb-8b6f-70c29e19ddb8" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000QdujKIAR
                  2⤵
                  • Modifies data under HKEY_USERS
                  PID:5684
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Modifies data under HKEY_USERS
                    PID:4740
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                      PID:5128
                      • C:\Windows\system32\cscript.exe
                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:5328
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "28a3af6d-dccd-4282-b986-32409b06efb3" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000QdujKIAR
                    2⤵
                      PID:5780
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=928e0853035f79ce406b3696ce9b2299&rmm_session_pwd_ttl=86400"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:6124
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "eaa4d290-864b-4cc4-abaa-d7d1236492f4" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000QdujKIAR
                      2⤵
                      • Drops file in System32 directory
                      PID:5460
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "ef698a38-201b-45a1-b25b-1170e8fa6068" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000QdujKIAR
                      2⤵
                      • Drops file in System32 directory
                      PID:5252
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "51522784-97a0-4c60-a179-53d86db74c47" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000QdujKIAR
                      2⤵
                      • Drops file in System32 directory
                      PID:6024
                      • C:\Windows\SYSTEM32\msiexec.exe
                        "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                        3⤵
                        • Modifies data under HKEY_USERS
                        PID:1828
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "eaf0e5c1-63f4-4fd8-88c3-c2bf00f3378a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000QdujKIAR
                      2⤵
                      • Downloads MZ/PE file
                      PID:2156
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                        3⤵
                        • System Time Discovery
                        PID:5712
                        • C:\Program Files\dotnet\dotnet.exe
                          dotnet --list-runtimes
                          4⤵
                          • System Time Discovery
                          PID:1356
                      • C:\Program Files\dotnet\dotnet.exe
                        "C:\Program Files\dotnet\dotnet" --list-runtimes
                        3⤵
                        • System Time Discovery
                        PID:416
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" /repair /quiet /norestart
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:6072
                        • C:\Windows\Temp\{A3A78AD5-B63A-419E-9350-9E4A213F5B8D}\.cr\8-0-11.exe
                          "C:\Windows\Temp\{A3A78AD5-B63A-419E-9350-9E4A213F5B8D}\.cr\8-0-11.exe" -burn.clean.room="C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732 /repair /quiet /norestart
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • System Time Discovery
                          PID:2448
                          • C:\Windows\Temp\{92448439-6790-4A03-A5BD-C5BB8276EE44}\.be\dotnet-runtime-8.0.11-win-x64.exe
                            "C:\Windows\Temp\{92448439-6790-4A03-A5BD-C5BB8276EE44}\.be\dotnet-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{41062EE0-A175-4832-853D-812501584C2C} {5BBDFF7E-AB38-474F-8E1F-F5F10C3BF958} 2448
                            5⤵
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • System Time Discovery
                            • Modifies registry class
                            PID:2400
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                        3⤵
                        • System Time Discovery
                        PID:5408
                        • C:\Program Files\dotnet\dotnet.exe
                          dotnet --list-runtimes
                          4⤵
                          • System Time Discovery
                          PID:4256
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                        3⤵
                        • System Time Discovery
                        PID:4852
                        • C:\Program Files\dotnet\dotnet.exe
                          dotnet --list-runtimes
                          4⤵
                          • System Time Discovery
                          PID:760
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "4def31a6-de9d-4b59-955b-492d3a2fdf0f" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000QdujKIAR
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Modifies registry class
                      PID:1056
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "978fb17b-31fc-441b-9813-0f270cd441a5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9wYWNrYWdlc3N0b3JlLmJsb2IuY29yZS53aW5kb3dzLm5ldC9pbnN0YWxsZXJzL0FueURlc2svV2luZG93cy9BZ2VudF9BbnlEZXNrX0N1c3RvbV9DbGllbnRfOS4wLjMubXNpIiwiRm9yY2VJbnN0YWxsIjpmYWxzZSwiVGFyZ2V0VmVyc2lvbiI6IjkuMC4zIn0=" 001Q300000QdujKIAR
                      2⤵
                        PID:2312
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "c8d7ccd9-8ad5-4ce9-81d3-e7011805fa3f" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QdujKIAR
                        2⤵
                        • Drops file in System32 directory
                        PID:3140
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "d24b1822-402a-4763-bff9-e17ae75f04b1" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000QdujKIAR
                        2⤵
                        • Drops file in System32 directory
                        PID:2012
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "9eec93db-8d86-47c0-bd58-8ca7b6e3c2f0" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000QdujKIAR
                        2⤵
                        • Drops file in System32 directory
                        PID:1624
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "44f04ed5-ffdd-4e2a-8748-de2e08d0e85a" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000QdujKIAR
                        2⤵
                          PID:4864
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "566e7c71-61c7-41eb-9991-c2823a6e29cc" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000QdujKIAR
                          2⤵
                            PID:5148
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "0da5f7e0-ff5c-4fb3-b67f-d759bb776656" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIyZ2V0LWluc3RhbGxlZC1zb2Z0d2FyZVx1MDAyMixcdTAwMjJDYWNoZVR0bEhvdXJzXHUwMDIyOjEyfSJ9" 001Q300000QdujKIAR
                            2⤵
                              PID:596
                          • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                            C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                            1⤵
                              PID:3664
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5244
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                2⤵
                                • Drops file in System32 directory
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5776
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                  -h
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5144
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2104
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                    4⤵
                                      PID:5568
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5192
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5004
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                      SRUtility.exe -r
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5404
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3352
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                      4⤵
                                        PID:1732
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ver
                                          5⤵
                                            PID:3648
                                          • C:\Windows\system32\sc.exe
                                            sc query ddmgr
                                            5⤵
                                            • Launches sc.exe
                                            PID:5256
                                          • C:\Windows\system32\sc.exe
                                            sc query lci_proxykmd
                                            5⤵
                                            • Launches sc.exe
                                            PID:1232
                                          • C:\Windows\system32\rundll32.exe
                                            rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                            5⤵
                                            • Checks SCSI registry key(s)
                                            • Modifies data under HKEY_USERS
                                            PID:5836
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    PID:2860
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                      2⤵
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:4668
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                      2⤵
                                      • Drops file in System32 directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:760
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000160"
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      PID:3364
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Drops file in Windows directory
                                      • Checks SCSI registry key(s)
                                      PID:1824
                                  • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                    1⤵
                                    • Drops file in Program Files directory
                                    • Modifies data under HKEY_USERS
                                    PID:824
                                    • C:\Windows\System32\sc.exe
                                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                      2⤵
                                      • Launches sc.exe
                                      PID:6140
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "a8491a18-c520-4395-82ea-c3b0e73dfed5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000QdujKIAR
                                      2⤵
                                        PID:2568
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "df915a06-2258-4f48-9985-56a212a925c3" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9wYWNrYWdlc3N0b3JlLmJsb2IuY29yZS53aW5kb3dzLm5ldC9pbnN0YWxsZXJzL0FueURlc2svV2luZG93cy9BZ2VudF9BbnlEZXNrX0N1c3RvbV9DbGllbnRfOS4wLjMubXNpIiwiRm9yY2VJbnN0YWxsIjpmYWxzZSwiVGFyZ2V0VmVyc2lvbiI6IjkuMC4zIn0=" 001Q300000QdujKIAR
                                        2⤵
                                          PID:5720
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "33e21315-f80a-4006-b5ac-974754c093eb" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QdujKIAR
                                          2⤵
                                            PID:4660
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "e9cd8c97-8244-4312-b91d-d55ac373360d" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000QdujKIAR
                                            2⤵
                                              PID:6104
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "2a373b55-af02-4759-8cb6-cd869829cdf4" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000QdujKIAR
                                              2⤵
                                                PID:1328
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "796eda09-1b7b-4009-a42d-b9c2f529c02c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIyZ2V0LWluc3RhbGxlZC1zb2Z0d2FyZVx1MDAyMixcdTAwMjJDYWNoZVR0bEhvdXJzXHUwMDIyOjEyfSJ9" 001Q300000QdujKIAR
                                                2⤵
                                                  PID:3676
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "6a24eac2-8ae6-41e9-b865-391b1e3062cc" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000QdujKIAR
                                                  2⤵
                                                    PID:2012
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                                                      3⤵
                                                      • Drops file in System32 directory
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Modifies data under HKEY_USERS
                                                      PID:2156
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                      3⤵
                                                        PID:1780
                                                        • C:\Windows\system32\cscript.exe
                                                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                          4⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:1748
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "6532af9a-7951-44b5-972f-3b7a52dfb383" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000QdujKIAR
                                                      2⤵
                                                        PID:5968
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "073bbff9-36cd-40fd-a4a8-7dace7ca2a39" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000QdujKIAR
                                                        2⤵
                                                          PID:2648
                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=928e0853035f79ce406b3696ce9b2299&rmm_session_pwd_ttl=86400"
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6116
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "b4602469-5538-4c8f-a9d7-07528dfd9d45" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000QdujKIAR
                                                          2⤵
                                                            PID:5572
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "bb57b8fd-6a1a-46cd-91c8-6607e74d74a7" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000QdujKIAR
                                                            2⤵
                                                              PID:2028
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                                3⤵
                                                                • System Time Discovery
                                                                PID:4528
                                                                • C:\Program Files\dotnet\dotnet.exe
                                                                  dotnet --list-runtimes
                                                                  4⤵
                                                                  • System Time Discovery
                                                                  PID:5660
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "11a75590-659c-4339-a969-463f848a97a6" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000QdujKIAR
                                                              2⤵
                                                              • Writes to the Master Boot Record (MBR)
                                                              PID:2668
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "2d4d6dfd-3b12-4abf-8951-de3f71bcf321" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000QdujKIAR
                                                              2⤵
                                                                PID:5072
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" f9eaf87f-9af8-4498-aab5-e5b98199ed07 "bbcac1c8-2675-48ca-b69d-4699687ae877" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000QdujKIAR
                                                                2⤵
                                                                • Modifies registry class
                                                                PID:6044
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\TicketingTray.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\TicketingTray.exe"
                                                                  3⤵
                                                                  • Checks computer location settings
                                                                  PID:5328
                                                                  • C:\Users\Admin\AppData\Local\Temp\TicketingAgentPackage\TicketingTray.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\TicketingAgentPackage\TicketingTray.exe"
                                                                    4⤵
                                                                      PID:4664
                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                        "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TicketingAgentPackage\chatsettings.bat"
                                                                        5⤵
                                                                          PID:1428
                                                                          • C:\Windows\system32\reg.exe
                                                                            REG ADD "HKCU\SOFTWARE\ATERA Networks\AlphaAgent" /v EnableChat /t REG_SZ /d "0" /f
                                                                            6⤵
                                                                              PID:4960
                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                                                                    1⤵
                                                                      PID:5720

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    1
                                                                    T1059

                                                                    PowerShell

                                                                    1
                                                                    T1059.001

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Privilege Escalation

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Defense Evasion

                                                                    Modify Registry

                                                                    2
                                                                    T1112

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Subvert Trust Controls

                                                                    1
                                                                    T1553

                                                                    Install Root Certificate

                                                                    1
                                                                    T1553.004

                                                                    System Binary Proxy Execution

                                                                    1
                                                                    T1218

                                                                    Msiexec

                                                                    1
                                                                    T1218.007

                                                                    Credential Access

                                                                    Discovery

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    5
                                                                    T1012

                                                                    System Information Discovery

                                                                    4
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Config.Msi\e582a67.rbs
                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      198e2a56d8812c69a875856720da8e92

                                                                      SHA1

                                                                      ed2f0c538a5b3659ec0b0fcc74a7a4eb9b693ccc

                                                                      SHA256

                                                                      5a9b80dcbb8cf12d0ddd999e6f2f2a3f31c1cee5a9c06b08cd21d52248adb580

                                                                      SHA512

                                                                      5999aa9d31a0af712e90915e4d6555fafe4ff71596cff9753cdbb37791d8d3d73bbc8ac5a1743033d4ca7fcc122692b4250d4ef9fe3a98d728750ed4887ffdbc

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a6c.rbs
                                                                      Filesize

                                                                      74KB

                                                                      MD5

                                                                      3eb4e0ab3175722fddd375c6ce5ae06a

                                                                      SHA1

                                                                      5d4a15a6dd5e6cf890fa469b55ff97ec526a8660

                                                                      SHA256

                                                                      c616df7016a5ea65b59d2639dbf6462fdb18a8870a2260bbb0b82e5637b682e0

                                                                      SHA512

                                                                      224bd7f7fddf3070d8b14ad6d3c08c3c8d24d6d24b908e9a57266bef0a6c03acf5fc81acde183f42f48c09192c4852ac681cc66b0274103049101627de8d6277

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a6e.rbs
                                                                      Filesize

                                                                      464B

                                                                      MD5

                                                                      1a343328921980a75bd6989dd8cde61a

                                                                      SHA1

                                                                      15fc90c610719d3ef628700ac6af41e0c2ea3b59

                                                                      SHA256

                                                                      c7be0c1bf5663291292fa7026bd24a9dcb95f025c91fad3caa879f1fce079288

                                                                      SHA512

                                                                      db8ca2fee6db74df9bce68ba598f19eceb38f476eff74aa023cbf6ba4c68705962b61b453ce846b6f522c213946f7c486f0101dec45d41746f1aa71a33bf3bac

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a74.rbs
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      40382086b2434804a1d59ae5bab7d843

                                                                      SHA1

                                                                      2f73ecfe8f79b166472995ec3e81817e9c2e7f5b

                                                                      SHA256

                                                                      d2327ddbd76fbe2c6ce2d9283afed0a53cf5ad1d5c4168cb49729289a5aff00f

                                                                      SHA512

                                                                      6e14055837fb6019fbfd3e4359c94df33dc4fdb7a21d84f6455281b47db17602a4c294ff45f1302955d35f60392ecfc7b8f72825232ba1423d9986a9c4bdec49

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a7c.rbs
                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      f86a60ae0535738058a71b6fc7e25523

                                                                      SHA1

                                                                      944dd7db0322313c5e4e082fb2d966661b58851e

                                                                      SHA256

                                                                      6e8ae929c9c2a2ba251c43e9a1c91549c10db04b12327a0682ef0699849e4e48

                                                                      SHA512

                                                                      61195df24151164198f25a9f25a55b58a4bdc901e7fdf5ff565b189ba9bc9a453dd277f854e29ead01e65419be2d518b9e0eae29a022f616cc63662a10943e8e

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a81.rbs
                                                                      Filesize

                                                                      48KB

                                                                      MD5

                                                                      bf96fbb7541ed60c08f9c73aeeb23b5e

                                                                      SHA1

                                                                      d181a8755686ce4213eb13131f86724cab0d24b9

                                                                      SHA256

                                                                      4e94cd0c220f67a40b8223a70a1316a12fb5cf0e7ccaa412bc5f033e7fbe2c7d

                                                                      SHA512

                                                                      92717d9dbbb33b428afd053244832cc86c518054aca1098f1edc2b907396e5d737813987c46922ec953d9e66f4ca167f7818fda733fd54e26f13d5d2f75aa461

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a86.rbs
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      7705a3b909c2678e5b4cf3eae60081e7

                                                                      SHA1

                                                                      f3efbb0abb5cb9b2d419eb53bbf7a68c28871bc1

                                                                      SHA256

                                                                      5de164c92cf8119601b2d3de73f5175be2f8eab2566d1c73023220ee0bf1aa01

                                                                      SHA512

                                                                      4e655a92defe113265c8d2a945c3c24c2e4e95c185d62ec4bfa448dde7aa5d0916f4e6ab3110899a36d4e6090f0477cf6991c129a5bf201c4f37d008650d34a5

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a8b.rbs
                                                                      Filesize

                                                                      11KB

                                                                      MD5

                                                                      83737e821436375b11b7f7a4043ec844

                                                                      SHA1

                                                                      90bac97deb9a6f25af59f263714f8c4cd8f0d1ca

                                                                      SHA256

                                                                      4639ea3c071d9e3af0b3f6a2b888bc887a4d66ece06726d54900a22f05ef8e37

                                                                      SHA512

                                                                      2fc6f803402645101a9ea888f27248785984d3f46db1ca72ce6b27c1b0f87bbe783007e8c9a6257b1bf1b61713f1d8fc9e22f0714720802dd2f6635ec5344f45

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a90.rbs
                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      ac2e8290ee04155e1a6c33228ee8d1ed

                                                                      SHA1

                                                                      714206f523ceb9b65d2c4bd15a2934adc5807ef7

                                                                      SHA256

                                                                      ef762768495293e4e16619d76acee33ce1b0cd57a7921ee5576ade509b73534b

                                                                      SHA512

                                                                      c5c71b3278b9787b49cb0fbe0ee5e71e4b9e2887385ae54b33fe06cdec9bdb10555a51950e21dcf4ecd58b893a044dcfb7538de307b7141b665fad4d9c6584d8

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a91.rbf
                                                                      Filesize

                                                                      143KB

                                                                      MD5

                                                                      33b4c87f18b4c49114d7a8980241657a

                                                                      SHA1

                                                                      254c67b915e45ad8584434a4af5e06ca730baa3b

                                                                      SHA256

                                                                      587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662

                                                                      SHA512

                                                                      42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

                                                                      Download Submit

                                                                    • C:\Config.Msi\e582a92.rbf
                                                                      Filesize

                                                                      3B

                                                                      MD5

                                                                      21438ef4b9ad4fc266b6129a2f60de29

                                                                      SHA1

                                                                      5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

                                                                      SHA256

                                                                      13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

                                                                      SHA512

                                                                      37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      3840b31c383fdf49bfd6740d945c9032

                                                                      SHA1

                                                                      a6f50164a69718bcef4664d7c47534f0d721866a

                                                                      SHA256

                                                                      1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                                      SHA512

                                                                      f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                      Filesize

                                                                      142KB

                                                                      MD5

                                                                      477293f80461713d51a98a24023d45e8

                                                                      SHA1

                                                                      e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                      SHA256

                                                                      a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                      SHA512

                                                                      23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      b3bb71f9bb4de4236c26578a8fae2dcd

                                                                      SHA1

                                                                      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                      SHA256

                                                                      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                      SHA512

                                                                      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                      Filesize

                                                                      210KB

                                                                      MD5

                                                                      c106df1b5b43af3b937ace19d92b42f3

                                                                      SHA1

                                                                      7670fc4b6369e3fb705200050618acaa5213637f

                                                                      SHA256

                                                                      2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                      SHA512

                                                                      616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      693KB

                                                                      MD5

                                                                      2c4d25b7fbd1adfd4471052fa482af72

                                                                      SHA1

                                                                      fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                      SHA256

                                                                      2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                      SHA512

                                                                      f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                      Filesize

                                                                      146KB

                                                                      MD5

                                                                      8d477b63bc5a56ae15314bda8dea7a3a

                                                                      SHA1

                                                                      3ca390584cd3e11172a014784e4c968e7cbb18f5

                                                                      SHA256

                                                                      9eec91cdd39cbb560ad5b1d063df67088f412da4b851ae41e71304fb8a444293

                                                                      SHA512

                                                                      44e3d91ad96b4cb919c06ccb91d3c3e31165b2412e1d78bfbaca0bee6f0c1a3253b3e3ddf19009cebf12c261a0392f6a0b7091cf8aba1d0cc4c1ed61c1b6dc42

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe
                                                                      Filesize

                                                                      145KB

                                                                      MD5

                                                                      0953b0a835501eede2761d0021d7f814

                                                                      SHA1

                                                                      14bf854aafb9594304cf2d66930a1efbd50e110b

                                                                      SHA256

                                                                      f87117e19652d814a8f4126696a16e83902ac733beee3b00b24eeb555a07df1b

                                                                      SHA512

                                                                      fe32059af2cd0c2dfc3dd8ec6b7a60d565efcbe61b24603245eb0618e0664212065d1b052d2f0d7d31f2c298fed75f5d22be38e88d6d85d0a8d5189a2820b387

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                      Filesize

                                                                      145KB

                                                                      MD5

                                                                      2b9beb2fdbc41afc48d68d32ef41dd08

                                                                      SHA1

                                                                      4a9ea4cf8e02e34ef2dd0ef849ffc0cd9ea6f91c

                                                                      SHA256

                                                                      977d48979e30a146417937d7e11b26334edec2abddfae1369a9c4348e34857b1

                                                                      SHA512

                                                                      3e3c3e39ff2df0d1ed769e6c5acba6f7c5d2737d3c426fb4f0e19f3cf6c604707155917584e454a3f208524ed46766b7a3d2d861fa7419f8258c3b6022238e10

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                      Filesize

                                                                      51KB

                                                                      MD5

                                                                      3180c705182447f4bcc7ce8e2820b25d

                                                                      SHA1

                                                                      ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                      SHA256

                                                                      5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                      SHA512

                                                                      228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                      Filesize

                                                                      12B

                                                                      MD5

                                                                      ce16cece86df7cad32c69f93446c22fc

                                                                      SHA1

                                                                      459712d7f9188d931f856238efb04ba21bacf9f4

                                                                      SHA256

                                                                      18c77a1cf7df7989d2cc49aa852193257c4c5099e68f29264ff175c30cb8f8cc

                                                                      SHA512

                                                                      9ad26fa338c2b26b688cfebab4e78293b5d9df4986eaaac78f0bc21c567d86e2c138b52fa34bcc3d7c50a1008137f47ade817002730354a58d7c9964f7e0a509

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                      Filesize

                                                                      248KB

                                                                      MD5

                                                                      593dc8f5dcb912d49e28c09237006f49

                                                                      SHA1

                                                                      7299076b571c97e3e1d43118b2acdb4cce80904a

                                                                      SHA256

                                                                      41d8e46de5dc0749e66b9b106a58337160b44d0a89200874ed8aa2b35227d3f7

                                                                      SHA512

                                                                      b05c6a689b4b14445504402f437c2f4ae57aa133b40af14c9480e85054ada9e8f5b3e8093b173f5c4a4b98beaf550e031b79485f6d140d840c2f6a32e3d4c534

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                      Filesize

                                                                      1021B

                                                                      MD5

                                                                      51a41966b950af62998eee5043f543b0

                                                                      SHA1

                                                                      d4ce80134834a1f10d50a6cac3ca3a3e80ff1dc2

                                                                      SHA256

                                                                      f1461b023e02fac832979ebf9bfa59ee7043885c90fc8ee6f8077f07a1cb7097

                                                                      SHA512

                                                                      9c4ba08451116f92036ce24075a641eb5973b740bb876cb8ec7229dae10308364404f175b8abd1f0d6eefa73b9123fa857bf2c3b39577d767831444f99435936

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                      Filesize

                                                                      109KB

                                                                      MD5

                                                                      1bedd7ee7e49661ab2a02919b42d0149

                                                                      SHA1

                                                                      36322c3507dc9a6fd36b94c2c792f8c65d59d1fa

                                                                      SHA256

                                                                      4eae27658da270705fcb8393b90ecacdda509000691b6230bbe89f1a84487ddc

                                                                      SHA512

                                                                      60c3320b474694645aa44d014e716ac710015d0641417c66244ebe11f14a314dc190f19edb51e4261838731c8c20eb7ecedcd8737122cb228b2a0fa4518edbab

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      693KB

                                                                      MD5

                                                                      54ac23524fd70469a07650619dc96308

                                                                      SHA1

                                                                      9de12b8d57ff687ae2680c45307dac9a47415fe6

                                                                      SHA256

                                                                      3632daba867842e65254f71adb82ff1f41212dcf19db53460d7095eaa539c6d9

                                                                      SHA512

                                                                      95565a34535d20056c6817af2cea50cda3c2a194fc56838bec730c62de96669bd037037dc8e4421181690795d1a838ce69ea8d904fdb47566e4b2140f7e4383e

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                      Filesize

                                                                      27KB

                                                                      MD5

                                                                      797c9554ec56fd72ebb3f6f6bef67fb5

                                                                      SHA1

                                                                      40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                      SHA256

                                                                      7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                      SHA512

                                                                      4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                      Filesize

                                                                      214KB

                                                                      MD5

                                                                      01807774f043028ec29982a62fa75941

                                                                      SHA1

                                                                      afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                      SHA256

                                                                      9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                      SHA512

                                                                      33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                      Filesize

                                                                      37KB

                                                                      MD5

                                                                      efb4712c8713cb05eb7fe7d87a83a55a

                                                                      SHA1

                                                                      c94d106bba77aecf88540807da89349b50ea5ae7

                                                                      SHA256

                                                                      30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                      SHA512

                                                                      3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                      Filesize

                                                                      3.5MB

                                                                      MD5

                                                                      723a7f489fb1861821fee5f5de0acba0

                                                                      SHA1

                                                                      ad76a8ec8cd52346c575894e08c458e1adf620b7

                                                                      SHA256

                                                                      0b1afe081f2e2aefdcf40cada67e79e287536999e99145748aeeb4f0010730f5

                                                                      SHA512

                                                                      b3ea87dd52d79b73b443154b71ea44da1ce86032bb4646d2a2813218e55113b3c1b854dc638229ecda370fa49863228dea1e86b6d455457095a9de865e25b0e1

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                      Filesize

                                                                      396KB

                                                                      MD5

                                                                      b5929e2ca0e402a373b633bb78d0414a

                                                                      SHA1

                                                                      38146d4f3ddca1b1e854bf638b7722356e5e2195

                                                                      SHA256

                                                                      d7b43a4807e1841b94353656fcfd45b69f7550adf137c56aefb85104883fb821

                                                                      SHA512

                                                                      65e02019656d61238b8fc784496eb6ccf238a5f6eff9b101893641cb45d9c63058cf67abb2bc75007e9e2726458115eb8e9ad9a4cf34a86435ea637dc78c3ea6

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                      Filesize

                                                                      205KB

                                                                      MD5

                                                                      df56f2b155823b6acab45139c3a48367

                                                                      SHA1

                                                                      05fc8e4a0eae77e259a85db1f34c10ae978416cf

                                                                      SHA256

                                                                      abe2f4422997c38308ceb941b6ab33bc5978c22d2e95ff0c1ae18f203bbc090e

                                                                      SHA512

                                                                      76878818e23da0bb4293183e739b738a68ca2c39ac102b00de108123f36c210e37f0554235c3723ae4a54a3404e69b4b6d4ad82427895d31b21a898f82513734

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                      Filesize

                                                                      54KB

                                                                      MD5

                                                                      77c613ffadf1f4b2f50d31eeec83af30

                                                                      SHA1

                                                                      76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                      SHA256

                                                                      2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                      SHA512

                                                                      29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                      Filesize

                                                                      333KB

                                                                      MD5

                                                                      745714d838c4d4f88c6e0db6a434f444

                                                                      SHA1

                                                                      90689ce709bf2464b678c7afa7b1e18f080d52bb

                                                                      SHA256

                                                                      e35302995dad1d5e4b7147d8763f7262500271cf01eac8edfa896b392ac7139f

                                                                      SHA512

                                                                      08cbfac0b604530108978c757ad8481c69ed62deac5520777bacee9751f3f260d2c3158609fd723819d8d6626c46b302fe7da7005efc09ab571871ac9d58a0ed

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                      Filesize

                                                                      70KB

                                                                      MD5

                                                                      e9b3a59f67febdd7f8fbe68d71c5d0ab

                                                                      SHA1

                                                                      22bd3ec3f8e0be2f317ade9d553acdb3ea11f52e

                                                                      SHA256

                                                                      bff4de54dacec104e1e63659857ca99d3e9658dcc09d6e1cbf54dc7b22629cbf

                                                                      SHA512

                                                                      00e95ea600777025a30e23c755522b869320ca445ac5bd74f123306457d0793efa338220cba9d064e5d25cc3dcf19d66e4e48d3a1c72d196eeb77fb61e4b0688

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                      Filesize

                                                                      50KB

                                                                      MD5

                                                                      5bb0687e2384644ea48f688d7e75377b

                                                                      SHA1

                                                                      44e4651a52517570894cfec764ec790263b88c4a

                                                                      SHA256

                                                                      963a4c7863beae55b1058f10f38b5f0d026496c28c78246230d992fd7b19b70a

                                                                      SHA512

                                                                      260b661f52287af95c5033b0a03ac2e182211d165cadb7c4a19e5a8ca765e76fc84b0daf298c3eccb4904504a204194a9bf2547fc91039c3ec2d41f9977ff650

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                      Filesize

                                                                      32KB

                                                                      MD5

                                                                      653e24836cca87a61fdc0443842d02f9

                                                                      SHA1

                                                                      d3419ee871b4f18a2cf690208a4ac9917aa133eb

                                                                      SHA256

                                                                      e3dff2e33ebf10fd7364e01401894f8ed1216c3d10e85483f0d16004812da19c

                                                                      SHA512

                                                                      a76dd7572b2a12256039c6fd537d440146d3c3c0a02d91af9378239c5380bf907528018b4cb02031352ee025deb83f333e950f1517b1c17b49739e0186dfdc62

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                      Filesize

                                                                      60KB

                                                                      MD5

                                                                      99c72ae773f0e16818bc628e6c30272a

                                                                      SHA1

                                                                      901b18faa2eeb35946746bcf80a3ed7a67f6daab

                                                                      SHA256

                                                                      9159d0f626aebaca406d0ff9abfe19d6153f3d6eefbc1f831a48c17f4aea7a81

                                                                      SHA512

                                                                      f05b5884ab3f8b2c0960c2ccbb982555948d293fd37bd29df1157d40c138f1eed6fc94ac5a7d7a4fd098755e9d242d4da992d073ddffcc8f0c543e538b322633

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                      Filesize

                                                                      588KB

                                                                      MD5

                                                                      17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                      SHA1

                                                                      bc0316e11c119806907c058d62513eb8ce32288c

                                                                      SHA256

                                                                      13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                      SHA512

                                                                      f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                      Filesize

                                                                      225B

                                                                      MD5

                                                                      f4429eef2e9821772ee8b9fb6a39019c

                                                                      SHA1

                                                                      e2e9eabb1885c5bea0e79dbb30088662a9436d8d

                                                                      SHA256

                                                                      ecec9bfa37d679693c3d6c1acf20b3940a232b18110931a7e8ebb41fba713cf9

                                                                      SHA512

                                                                      2b80d33f84a3c966a376247f967b9bdf4a09f34e0e3d38377dee20ae4121e567d0c18c6d9ebe53d2f3fb48c1126e1fc035f2d6b0ce68d81011053ac85e65dbfe

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      1ef7574bc4d8b6034935d99ad884f15b

                                                                      SHA1

                                                                      110709ab33f893737f4b0567f9495ac60c37667c

                                                                      SHA256

                                                                      0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                      SHA512

                                                                      947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      f512536173e386121b3ebd22aac41a4e

                                                                      SHA1

                                                                      74ae133215345beaebb7a95f969f34a40dda922a

                                                                      SHA256

                                                                      a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                      SHA512

                                                                      1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                      Filesize

                                                                      76KB

                                                                      MD5

                                                                      b40fe65431b18a52e6452279b88954af

                                                                      SHA1

                                                                      c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                      SHA256

                                                                      800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                      SHA512

                                                                      e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                      Filesize

                                                                      80KB

                                                                      MD5

                                                                      3904d0698962e09da946046020cbcb17

                                                                      SHA1

                                                                      edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                      SHA256

                                                                      a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                      SHA512

                                                                      c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                                      Filesize

                                                                      96KB

                                                                      MD5

                                                                      6a6ee920934b898e85a818ed933ca4d3

                                                                      SHA1

                                                                      612e3b2ce41b575f53fb22a362684c9608c41f59

                                                                      SHA256

                                                                      f9de070b4227fec9104b80d3f8ce80fc735c426c3e75c8bf3981c97442c8cc4a

                                                                      SHA512

                                                                      ca253672cc983fa9e477763ba8fe3b73a9687ec9530d1645dc2ed075ef7599f3dce4eb9a82a1fae48f0d75d70618e04a4c3600cff2151c38bb2012e720fd2b0f

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      362ce475f5d1e84641bad999c16727a0

                                                                      SHA1

                                                                      6b613c73acb58d259c6379bd820cca6f785cc812

                                                                      SHA256

                                                                      1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                      SHA512

                                                                      7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability.zip
                                                                      Filesize

                                                                      1.3MB

                                                                      MD5

                                                                      40df7f2a02cdfa70ae76d70d21473428

                                                                      SHA1

                                                                      4baddbc082fdb197c77bc1c232be2881a82a7ec8

                                                                      SHA256

                                                                      f037309cf6b0174ba282106da31c141e3912486c69c438a53afe7ff589743dc2

                                                                      SHA512

                                                                      2522483e9d1b9fc20f14ffab3dcb2a9e5735a260e08e7196a05319076ad9b4d7a9fe94b28c52559022f003d2fe55ec5e4abcecb1b11f4000e804dae5b1c0126f

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.runtimeconfig.json
                                                                      Filesize

                                                                      375B

                                                                      MD5

                                                                      e8d9109bd15637b1fbf349f9c7ff776f

                                                                      SHA1

                                                                      19762daa20afc8085ba6417a7215f1fe2d619f60

                                                                      SHA256

                                                                      c4a84cdd787cb31aaa46e8282f7d288f0641fdaa4252ac78979340131c8b9110

                                                                      SHA512

                                                                      5cc792c0cdf32c4c893eebc6651aabed7428d2f467b58d3b58ad21dfce9dd4ee0924257b4699297f6d41069f27829ce8b8a711642f3208981761b48382d68b74

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Software.zip
                                                                      Filesize

                                                                      1.6MB

                                                                      MD5

                                                                      68a52d3ec57a7fedf808624beca83db3

                                                                      SHA1

                                                                      d5a43e0e0baf2a3e4e8da2d7e1c797fb01167b6a

                                                                      SHA256

                                                                      de34a5193566b7dcb3365c283dbe3e2644e2fe65fb3915f20e0a9a60424f8d62

                                                                      SHA512

                                                                      34bc3b475062219e1ef67c7fd56acf6dcc9f28262ccc4e49701a592a6d228bc5fc61ac25908e798b96b3d16f591c4800dcaeb334508fe70137f2d75577328a29

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                      Filesize

                                                                      1.8MB

                                                                      MD5

                                                                      5ed9543e9f5826ead203316ef0a8863d

                                                                      SHA1

                                                                      8235c0e7568ec42d6851c198adc76f006883eb4b

                                                                      SHA256

                                                                      33583a8e2dcf039382e80bfa855944407bcba71976ec41c52810cb8358f42043

                                                                      SHA512

                                                                      5b4318ddc6953f31531ee8163463259da5546f1018c0fe671280337751f1c57398a5fd28583afba85e93d70167494b8997c23fee121e67bf2f6fb4ca076e9d9f

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                      Filesize

                                                                      1.1MB

                                                                      MD5

                                                                      9a9b1fd85b5f1dcd568a521399a0d057

                                                                      SHA1

                                                                      34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                      SHA256

                                                                      88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                      SHA512

                                                                      7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                      Filesize

                                                                      673KB

                                                                      MD5

                                                                      ce72720f5649bfc55095d9cc36eb56fd

                                                                      SHA1

                                                                      2b72aacda8ca0acc03b0947619c1206eed2f08ba

                                                                      SHA256

                                                                      2b661759f5069a9ac97431f8a4c01ce2d396ee6f57c2fa5f36d39da14f77c081

                                                                      SHA512

                                                                      d450a87cecbda2791046738f499fa26cf1deab644405f0f1505abc14197f9bb41738c3fa64ac0f5123c0768daaaa365c17a71767862e9b57cf2e7a7d78723f0d

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                      Filesize

                                                                      321KB

                                                                      MD5

                                                                      d3901e62166e9c42864fe3062cb4d8d5

                                                                      SHA1

                                                                      c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                      SHA256

                                                                      dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                      SHA512

                                                                      ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                      Filesize

                                                                      814KB

                                                                      MD5

                                                                      9b1f97a41bfb95f148868b49460d9d04

                                                                      SHA1

                                                                      768031d5e877e347a249dfdeab7c725df941324b

                                                                      SHA256

                                                                      09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                      SHA512

                                                                      9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                      Filesize

                                                                      1.2MB

                                                                      MD5

                                                                      e74d2a16da1ddb7f9c54f72b8a25897c

                                                                      SHA1

                                                                      32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                      SHA256

                                                                      a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                      SHA512

                                                                      52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                                      Filesize

                                                                      11B

                                                                      MD5

                                                                      5eda46a55c61b07029e7202f8cf1781c

                                                                      SHA1

                                                                      862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                      SHA256

                                                                      12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                      SHA512

                                                                      4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                      Filesize

                                                                      48KB

                                                                      MD5

                                                                      35050a7620f0f3a40abd57c560725741

                                                                      SHA1

                                                                      a80cdff3d7445fde2f2ec3303b72763d40a7f795

                                                                      SHA256

                                                                      ead2025585127ea0c07f6154edc0bc65f9b339714b199b3e62238b48869730ef

                                                                      SHA512

                                                                      e0bf7d1a3a26553f26bb1aa1d747cd9025de513ee9e948b024450dceb9f2f53c7bd46c041aa77fe13dc502ae13ce80ee5bf238989c146f7cdf8b82abc6992ee3

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                      Filesize

                                                                      48KB

                                                                      MD5

                                                                      71eed3e35ba641b5ea5f9a261b0e67f1

                                                                      SHA1

                                                                      718e8f11023c4bf0803cbc64304c6c5b62bd63e6

                                                                      SHA256

                                                                      810095c243ac711307c38875f852112711d8d015b164388ecf41c7a370de256f

                                                                      SHA512

                                                                      bdb8175e1886981280edcc5cdb727612870a2dd456a9948338c9415c5a1f451994132aa527c85b0e68ffd9929f2f3c21c3e9857d618b8dca8dbb46fa5751b846

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                      Filesize

                                                                      2.8MB

                                                                      MD5

                                                                      f6c4a6114f919d27bec0f97104c40eb9

                                                                      SHA1

                                                                      07f41a3879693e2df43010b95227fda85d8b47ce

                                                                      SHA256

                                                                      46944f150ce3a6e1860420d4a188228512f4f320e69f120915c50e40f31f9fa4

                                                                      SHA512

                                                                      2d9aa036d946362de68dd12add53aab369b60d98ecf7ba928b1553d19d46158d192104da217c4e18d3f7a12a51d0fb5fc4b7677320bfc89f5eabbe803661f252

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                      Filesize

                                                                      1.1MB

                                                                      MD5

                                                                      6c6f85e896655a6eb726482f04c49086

                                                                      SHA1

                                                                      2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                      SHA256

                                                                      e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                      SHA512

                                                                      b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                      Filesize

                                                                      541B

                                                                      MD5

                                                                      d0efb0a6d260dbe5d8c91d94b77d7acd

                                                                      SHA1

                                                                      e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                                      SHA256

                                                                      7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                                      SHA512

                                                                      a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                      Filesize

                                                                      12B

                                                                      MD5

                                                                      880d31390a25de6a9cd34463b46c75e6

                                                                      SHA1

                                                                      837af65938c9606b5de3c6f2195fc3e855554cd7

                                                                      SHA256

                                                                      425adf50cf113d68bd6aa8dc1015db43422bbc1c977933d5f8c1ecaabf18eb2e

                                                                      SHA512

                                                                      8e9dd066ff73625a5a55d1ece5ba1e4fb248ab14a32880a3d4d86266176cb4f1c61f8301e1ff49839c283affe877b9fbcd3bc2b9763c08b0b63ba56023c2282b

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                      Filesize

                                                                      670KB

                                                                      MD5

                                                                      96e50bbca30d75af7b8b40acf8dda817

                                                                      SHA1

                                                                      4b1255280dff8de8b7be47def58f83f6ec39ded6

                                                                      SHA256

                                                                      a3ad00ccb61bc87d58eb7977f68130b78a0b95e74d61e6a4624ac114ccde5736

                                                                      SHA512

                                                                      0034c08cb878b703f272e3fd2734bb928ff1bdba85cf79a151519b019c83bd4d199c80af0aa30db28ef82f7ee68a9d59dcaede92f83bfe8787f6a5d4d5e9817c

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                      Filesize

                                                                      3.1MB

                                                                      MD5

                                                                      8521aaed55b11624c6ecfbf96f9c7075

                                                                      SHA1

                                                                      49e5dd2c3c7bced8f133aa84c903b3770a70ee37

                                                                      SHA256

                                                                      e946b42b249411a89660252ea65e760a6b3c22ac95f4122a405bce04d511820e

                                                                      SHA512

                                                                      080fc4392d5f2eb9bb88ca853347d2bac51a936c38df7cef7eedbd206dac0d51c262ed13095eaca62251730197d5353b7abee5c57f6421308aaabd9ac69622b8

                                                                      Download Submit

                                                                    • C:\Program Files\dotnet\dotnet.exe
                                                                      Filesize

                                                                      143KB

                                                                      MD5

                                                                      71026b098f8fb39c88b003df746d9fa0

                                                                      SHA1

                                                                      013ca259f551ad6f33db53fff0e121e74408e20e

                                                                      SHA256

                                                                      11058e8c2cd05f30dcf1775644bf19d2913c9a6d674c12f91d1896d95d9cc5c2

                                                                      SHA512

                                                                      9830be3444225a4b2f9fa4aedbc8af4f45fdb2548f0b6a2eba2a2a407ea3c7d8fd78c0e37fac66cafbdfad781ae78b076d225fd5c836a451f57a54053ccef9ad

                                                                      Download Submit

                                                                    • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\77e9afd750b8b104aaf3ca8794581017
                                                                      Filesize

                                                                      16KB

                                                                      MD5

                                                                      b2e89027a140a89b6e3eb4e504e93d96

                                                                      SHA1

                                                                      f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                      SHA256

                                                                      5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                      SHA512

                                                                      93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                      Filesize

                                                                      471B

                                                                      MD5

                                                                      7df7014a9992905589eae50656e4072a

                                                                      SHA1

                                                                      458b4c27f89e63545436f8cff7d5e8139e1b777b

                                                                      SHA256

                                                                      3e449a2b4017fb21b178cd4d9aa6ae1ac33c580f49f4e95fd926a174ee1656fa

                                                                      SHA512

                                                                      bf2a63fff79b395ad9ffa667fafc518aa98595b72aad692c9d9ad15be5301c939a296a0d8593b8cadfe38f0357fcf5b363fb6a3507452d8de432d661dce266a2

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC
                                                                      Filesize

                                                                      727B

                                                                      MD5

                                                                      735be46b20c3d183ea83ebf1b01c8027

                                                                      SHA1

                                                                      b2ba8d8f47257ce29f2eb3dbe93ddce097d22af4

                                                                      SHA256

                                                                      0bf2fbc4a3b13c7393a411e06cdda2b371c0672eb71e680e4f2216f4020e3876

                                                                      SHA512

                                                                      fbbab316db13998c06b0b0367cb4368e25c724e8359cf9aba32e4668414cdfebda2ec44c35ee34c3cf381f3d106ac75787b6853c3afcbc4a1826fad5ca3f3fd4

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      727B

                                                                      MD5

                                                                      b1a358ec280cd1beafd117a66039d213

                                                                      SHA1

                                                                      2035cd8fbebaf3b648797b0b36f4b578244ad41e

                                                                      SHA256

                                                                      13e0ffcab6d9cb7b51246f3662fa736ce276daac245374c62dbd60aab3248d06

                                                                      SHA512

                                                                      8a25bbfd0cbeb5fccb43f309ead695a05750b910533d55a7c4c087154df17baba7da13bfa366d8cef0aba0cc51408dcaad85360d0f8d7c61c417e26bc4a404e3

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                      Filesize

                                                                      400B

                                                                      MD5

                                                                      0afd53ed229838758d9f0a3c35f5120c

                                                                      SHA1

                                                                      30861f0ff8cfff577c3b8018b78ee30aeec50fd6

                                                                      SHA256

                                                                      38ec491ac9cb7db008ec22c94cbf4626d01462790106f2deccca2b703524d457

                                                                      SHA512

                                                                      7d97c59e9870c78a3bfcaf24d3978311e8302b403b5638148a69a954f81bbc8bdc87f2ce29eddda80181ffb34211f8f475d5ef07b97d14f169702b7599da5542

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      c27fd1ecb061199127d7ff1f0ea8c340

                                                                      SHA1

                                                                      a0fe125b6cf4be85571c6b436994cf15074cec34

                                                                      SHA256

                                                                      56a0ff9ee70762af9898e712a99ed544d88789c9da3e623afce301b578bf05ad

                                                                      SHA512

                                                                      0426bb0ae63db74881c4830714162160e7168b6678a86748087177bbe67721cc168284cd39ad6ea615119a263b0b0e22b3d4b452233bd6a3a1b374c80e1ecebe

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      21c8b830995c7470ca07c84370bd15d2

                                                                      SHA1

                                                                      0dfea62d5ae33d4963e41cb148c72b7578bc4c86

                                                                      SHA256

                                                                      41297452ed975cfb6302df48379f5870fb2f111581a40b5bcba0d6a74a3dd4d1

                                                                      SHA512

                                                                      49cf39107852d7805990c3481d7ecb8e3910f5fe281cfa0d317ff5929c828762558ef7146e0e3678cf5f34060ae2a701f42433c17c690ad8f10ead79c859a77d

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                      Filesize

                                                                      651B

                                                                      MD5

                                                                      9bbfe11735bac43a2ed1be18d0655fe2

                                                                      SHA1

                                                                      61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                      SHA256

                                                                      549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                      SHA512

                                                                      a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Temp\TicketingAgentPackage\TicketingTray.exe
                                                                      Filesize

                                                                      342KB

                                                                      MD5

                                                                      8ed3937bf24d799ae46b4c9de666e741

                                                                      SHA1

                                                                      062589c20d200a9999860c5c189d3a00fca414cb

                                                                      SHA256

                                                                      c235b31987322e6215125401c7273fc123195800370cb68a8f62c4a5ec4f35d9

                                                                      SHA512

                                                                      18a61e1a5844209d5b6664c8002e59432b22bb7eb88f96a75fb1a9250593125b6c86cae46d550cb02467d1ea6438b677367c622386d8702c373f1f62745acd04

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI2B12.tmp
                                                                      Filesize

                                                                      509KB

                                                                      MD5

                                                                      88d29734f37bdcffd202eafcdd082f9d

                                                                      SHA1

                                                                      823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                      SHA256

                                                                      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                      SHA512

                                                                      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI2B12.tmp-\AlphaControlAgentInstallation.dll
                                                                      Filesize

                                                                      25KB

                                                                      MD5

                                                                      aa1b9c5c685173fad2dabebeb3171f01

                                                                      SHA1

                                                                      ed756b1760e563ce888276ff248c734b7dd851fb

                                                                      SHA256

                                                                      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                      SHA512

                                                                      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI2B12.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      1a5caea6734fdd07caa514c3f3fb75da

                                                                      SHA1

                                                                      f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                      SHA256

                                                                      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                      SHA512

                                                                      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI2E01.tmp-\CustomAction.config
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      bc17e956cde8dd5425f2b2a68ed919f8

                                                                      SHA1

                                                                      5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                      SHA256

                                                                      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                      SHA512

                                                                      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI2E01.tmp-\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      695KB

                                                                      MD5

                                                                      715a1fbee4665e99e859eda667fe8034

                                                                      SHA1

                                                                      e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                      SHA256

                                                                      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                      SHA512

                                                                      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI349C.tmp
                                                                      Filesize

                                                                      211KB

                                                                      MD5

                                                                      a3ae5d86ecf38db9427359ea37a5f646

                                                                      SHA1

                                                                      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                      SHA256

                                                                      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                      SHA512

                                                                      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI75C4.tmp
                                                                      Filesize

                                                                      219KB

                                                                      MD5

                                                                      928f4b0fc68501395f93ad524a36148c

                                                                      SHA1

                                                                      084590b18957ca45b4a0d4576d1cc72966c3ea10

                                                                      SHA256

                                                                      2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae

                                                                      SHA512

                                                                      7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI97A6.tmp
                                                                      Filesize

                                                                      4.5MB

                                                                      MD5

                                                                      08211c29e0d617a579ffa2c41bde1317

                                                                      SHA1

                                                                      4991dae22d8cdc6ca172ad1846010e3d9e35c301

                                                                      SHA256

                                                                      3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621

                                                                      SHA512

                                                                      d6ae36a09745fdd6d0d508b18eb9f3499a06a7eeafa0834bb47a7004f4b7d54f15fec0d0a45b7e6347a85c8091ca52fe4c679f6f23c3668efe75a660a8ce917f

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSIE80C.tmp-\System.Management.dll
                                                                      Filesize

                                                                      60KB

                                                                      MD5

                                                                      878e361c41c05c0519bfc72c7d6e141c

                                                                      SHA1

                                                                      432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                      SHA256

                                                                      24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                      SHA512

                                                                      59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                      Download Submit

                                                                    • C:\Windows\Installer\e582a66.msi
                                                                      Filesize

                                                                      2.9MB

                                                                      MD5

                                                                      6e9a59d1ea18ce58e5fac465c188dfdc

                                                                      SHA1

                                                                      0ebcc6b59014326c1e1e5cea57734026d5a692e4

                                                                      SHA256

                                                                      ed6fdde07417d5285eb5283ef25349fb4808948c5e7131c7a67c1dc34af29b84

                                                                      SHA512

                                                                      0cc8a8c2acd2fa19544087932db67090dca07c6bc20dde11af43f028324c7e71714b40157d9effeb3a18037a46d2a5d3025c2e93aad09fbd8bb010d18ffc9cf2

                                                                      Download Submit

                                                                    • C:\Windows\Installer\e582a82.msi
                                                                      Filesize

                                                                      26.3MB

                                                                      MD5

                                                                      b9c6d23462adef092b8a5b7880531b03

                                                                      SHA1

                                                                      9e8c4f7f48d38fb54a93789a583852869c074f2d

                                                                      SHA256

                                                                      2e23da54aa1ff64de09021ab089c1be6d4a323bdf0d8f46f78b5c6a33df83109

                                                                      SHA512

                                                                      18623991c5690e516541eaf867f22b3a1a02317392178943143bedc7f7eda5e02e69665c3c4a5fa50ade516a191bbbf16fd71e60f3225f660fb10ebc25cd01a5

                                                                      Download Submit

                                                                    • C:\Windows\Installer\e582a83.msi
                                                                      Filesize

                                                                      772KB

                                                                      MD5

                                                                      d73de5788ab129f16afdd990d8e6bfa9

                                                                      SHA1

                                                                      88cb87af50ea4999e2079d9269ce64c8eb1a584e

                                                                      SHA256

                                                                      4f9ac5a094e9b1b4f0285e6e69c2e914e42dcc184dfe6fe93894f8e03ca6c193

                                                                      SHA512

                                                                      bfc32f9a20e30045f5207446c6ab6e8ef49a3fd7a5a41491c2242e10fee8efd2f82f81c3ff3bf7681e5e660fde065a315a89d87e9f488c863421fe1d6381ba3b

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{387a8921-fda1-f948-bd82-b1ef40c3ce73}\lci_proxywddm.cat
                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      8e16d54f986dbe98812fd5ec04d434e8

                                                                      SHA1

                                                                      8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                      SHA256

                                                                      7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                      SHA512

                                                                      e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{387a8921-fda1-f948-bd82-b1ef40c3ce73}\lci_proxywddm.inf
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      0315a579f5afe989154cb7c6a6376b05

                                                                      SHA1

                                                                      e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                      SHA256

                                                                      d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                      SHA512

                                                                      c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{387a8921-fda1-f948-bd82-b1ef40c3ce73}\x64\lci_proxyumd.dll
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      4dc11547a5fc28ca8f6965fa21573481

                                                                      SHA1

                                                                      d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                      SHA256

                                                                      e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                      SHA512

                                                                      bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{387a8921-fda1-f948-bd82-b1ef40c3ce73}\x64\lci_proxyumd32.dll
                                                                      Filesize

                                                                      135KB

                                                                      MD5

                                                                      67ae7b2c36c9c70086b9d41b4515b0a8

                                                                      SHA1

                                                                      ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                      SHA256

                                                                      79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                      SHA512

                                                                      4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{387a8921-fda1-f948-bd82-b1ef40c3ce73}\x64\lci_proxywddm.sys
                                                                      Filesize

                                                                      119KB

                                                                      MD5

                                                                      b9b0e9b4d93b18b99ece31a819d71d00

                                                                      SHA1

                                                                      2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                      SHA256

                                                                      0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                      SHA512

                                                                      465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{f1b2c76c-3b7c-c648-8d55-a759ccf706ad}\lci_iddcx.cat
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      62458e58313475c9a3642a392363e359

                                                                      SHA1

                                                                      e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                      SHA256

                                                                      85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                      SHA512

                                                                      49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{f1b2c76c-3b7c-c648-8d55-a759ccf706ad}\lci_iddcx.inf
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      1cec22ca85e1b5a8615774fca59a420b

                                                                      SHA1

                                                                      049a651751ef38321a1088af6a47c4380f9293fc

                                                                      SHA256

                                                                      60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                      SHA512

                                                                      0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{f1b2c76c-3b7c-c648-8d55-a759ccf706ad}\x64\lci_iddcx.dll
                                                                      Filesize

                                                                      52KB

                                                                      MD5

                                                                      01e8bc64139d6b74467330b11331858d

                                                                      SHA1

                                                                      b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                      SHA256

                                                                      148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                      SHA512

                                                                      4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                      Download Submit

                                                                    • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-01-49-52.dat
                                                                      Filesize

                                                                      602B

                                                                      MD5

                                                                      40a24aedc8a693d0980fc04114fd1adf

                                                                      SHA1

                                                                      bb9bce2ac473daf5bb3288317e12d57d2e3f4e12

                                                                      SHA256

                                                                      4a8b108078877fc316b3f111c00e85ca9d222770c1aa29a4b97713803f4c0e2a

                                                                      SHA512

                                                                      b57c5f053f299bb9c69991736e03481bee64bf763fc817b91089ee98092b6d616ebe91a91453417ed210a7e4e3ba8aa65d7805179c603243ecc63332674e1757

                                                                      Download Submit

                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      4b82b7d75dd59d6f253d52e518eb1b6a

                                                                      SHA1

                                                                      f3a6373107d4cd2ca1268d590d7d478204e5d251

                                                                      SHA256

                                                                      1deec148b63e5ae4f7041e25d2be4d83c2b1192030250be815e18719fb9e8e61

                                                                      SHA512

                                                                      5939dac8eb4cd8be9f0b9ba5ec44f21610de7526fcf6f1b450be3cd65226c778b4038a537f026654963e49267296e6eefc4d43ae11cf403ccf2097501558b258

                                                                      Download Submit

                                                                    • C:\Windows\Temp\__PSScriptPolicyTest_vix5rvbp.tc1.ps1
                                                                      Filesize

                                                                      60B

                                                                      MD5

                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                      SHA1

                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                      SHA256

                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                      SHA512

                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack.log
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      bff51598990989ab94809bc07f66029d

                                                                      SHA1

                                                                      780eab58bcf6d4040e27da6d09752d47ad1bfcd1

                                                                      SHA256

                                                                      57dab414257e7402e5c986830b1407ae37fca77be3b3b9de337ac9cd85ba3716

                                                                      SHA512

                                                                      06956949526543dc08b439c979e819441808aa33508882f857a19f517a72d7564f644a4cde6052d3e5d278024037d9ac7d38fb20d9d47a46856865165c7ff36c

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                      Filesize

                                                                      3.2MB

                                                                      MD5

                                                                      2c18826adf72365827f780b2a1d5ea75

                                                                      SHA1

                                                                      a85b5eae6eba4af001d03996f48d97f7791e36eb

                                                                      SHA256

                                                                      ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be

                                                                      SHA512

                                                                      474fce1ec243b9f63ea3d427eb1117ad2ebc5a122f64853c5015193e6727ffc8083c5938117b66e572da3739fd0a86cd5bc118f374c690fa7a5fe9f0c071c167

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{63173554-8DE4-4A15-804A-64D147CE2603}\IsConfig.ini
                                                                      Filesize

                                                                      571B

                                                                      MD5

                                                                      d239b8964e37974225ad69d78a0a8275

                                                                      SHA1

                                                                      cf208e98a6f11d1807cd84ca61504ad783471679

                                                                      SHA256

                                                                      0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73

                                                                      SHA512

                                                                      88eb06ae80070203cb7303a790ba0e8a63c503740ca6e7d70002a1071c89b640f9b43f376ddc3c9d6ee29bae0881f736fa71e677591416980b0a526b27ee41e8

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{63173554-8DE4-4A15-804A-64D147CE2603}\String1033.txt
                                                                      Filesize

                                                                      182KB

                                                                      MD5

                                                                      99bbffd900115fe8672c73fb1a48a604

                                                                      SHA1

                                                                      8f587395fa6b954affef337c70781ce00913950e

                                                                      SHA256

                                                                      57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc

                                                                      SHA512

                                                                      d578b1931a8daa1ef0f0238639a0c1509255480b5dbd464c639b4031832e2e7537f003c646d7bd65b75e721a7ad584254b4dfa7efc41cf6c8fbd6b72d679eeff

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{63173554-8DE4-4A15-804A-64D147CE2603}\_is86B0.exe
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      7a1c100df8065815dc34c05abc0c13de

                                                                      SHA1

                                                                      3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                      SHA256

                                                                      e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                      SHA512

                                                                      bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{63173554-8DE4-4A15-804A-64D147CE2603}\setup.inx
                                                                      Filesize

                                                                      345KB

                                                                      MD5

                                                                      0376dd5b7e37985ea50e693dc212094c

                                                                      SHA1

                                                                      02859394164c33924907b85ab0aaddc628c31bf1

                                                                      SHA256

                                                                      c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                      SHA512

                                                                      69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{92448439-6790-4A03-A5BD-C5BB8276EE44}\.ba\bg.png
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      9eb0320dfbf2bd541e6a55c01ddc9f20

                                                                      SHA1

                                                                      eb282a66d29594346531b1ff886d455e1dcd6d99

                                                                      SHA256

                                                                      9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

                                                                      SHA512

                                                                      9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{92448439-6790-4A03-A5BD-C5BB8276EE44}\.be\dotnet-runtime-8.0.11-win-x64.exe
                                                                      Filesize

                                                                      607KB

                                                                      MD5

                                                                      669de3ab32955e69decfe13a3c89891e

                                                                      SHA1

                                                                      ab2e90613c8b9261f022348ca11952a29f9b2c73

                                                                      SHA256

                                                                      2240e6318171b3cddcee6a801488f59145c1f54ca123068c2a73564535954677

                                                                      SHA512

                                                                      be5d737a7d25cc779736b60b1ea59982593f0598e207340219a13fd9572d140cfbcd112e3cf93e3be6085fe284a54d4458563e6f6e4e1cfe7c919685c9ee5442

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\ISRT.dll
                                                                      Filesize

                                                                      427KB

                                                                      MD5

                                                                      85315ad538fa5af8162f1cd2fce1c99d

                                                                      SHA1

                                                                      31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                      SHA256

                                                                      70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                      SHA512

                                                                      877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{95696503-F11E-4554-94CE-F0BF6A21BCD9}\_isres_0x0409.dll
                                                                      Filesize

                                                                      1.8MB

                                                                      MD5

                                                                      befe2ef369d12f83c72c5f2f7069dd87

                                                                      SHA1

                                                                      b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                      SHA256

                                                                      9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                      SHA512

                                                                      760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                      Download Submit

                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      91f663dfbed40f1715907190fa2bab08

                                                                      SHA1

                                                                      64b89b9b7a38162f179924608e5a2e630ccf31be

                                                                      SHA256

                                                                      eebb1a7b916c496b37bf08da155c9681b9b06d3bf148167d1ac8a82326cfbe17

                                                                      SHA512

                                                                      674830a3b9f059edfe45aa5f0cf4736a71a380187a2b5eec83aff7d46f8c49b62076c17207098a9704d8e4ae5fc352e68aa4a02df097a137d6bfd35b8b9c55d2

                                                                      Download Submit

                                                                    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                      Filesize

                                                                      24.1MB

                                                                      MD5

                                                                      b92dee471e94fde9db892a543b8f66f7

                                                                      SHA1

                                                                      1cfb1737c6efd40d2f4bee1ed251e77c5ced9925

                                                                      SHA256

                                                                      0604062a1f36f3c65f7f09e3e4444a946cd632ebf0d14ffbf6c5564b4aad3194

                                                                      SHA512

                                                                      72cdfc09a06faeefaf87f2af94c7d84ba8f8038df7ed67959acce27afc057b79dcba521a6a6ec98cd6a4b48f0aebc45616cab0da312cc7420aaa9ebef99bcdf3

                                                                      Download Submit

                                                                    • \??\Volume{241e48af-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b4221bdd-97ab-4684-bd74-69b2b6aa9483}_OnDiskSnapshotProp
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      b9b41c91f05b4fb72c79d6781207de30

                                                                      SHA1

                                                                      1d0d9ae41131f6cc8d56bafe046d9080dcc49b88

                                                                      SHA256

                                                                      63297953b92547bc41a39b1edb9d4df70ae4e848e89af04ad21293b5ebe0381e

                                                                      SHA512

                                                                      6d62d7ac2165eab8f40c31bb4d77ac35d90ae27c75798b7dd5bc4825a09c08b8128d7725c60cfc049432dbce52579d394afed0701c66c197daa316385a6e2661

                                                                      Download Submit

                                                                    • memory/552-198-0x000001DA9FA80000-0x000001DA9FAA2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/552-243-0x000001DAA0050000-0x000001DAA0088000-memory.dmp

                                                                      Filesize

                                                                      224KB

                                                                      Download

                                                                    • memory/552-194-0x000001DA9FB10000-0x000001DA9FBC2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/1056-1699-0x0000015606F30000-0x0000015606F3C000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/1056-1721-0x0000015607790000-0x00000156077A8000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                      Download

                                                                    • memory/1056-1760-0x00000156200E0000-0x0000015620192000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/1056-1862-0x00000156077B0000-0x00000156077D0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1484-150-0x000001C0EE430000-0x000001C0EE458000-memory.dmp

                                                                      Filesize

                                                                      160KB

                                                                      Download

                                                                    • memory/1484-162-0x000001C0F00B0000-0x000001C0F0148000-memory.dmp

                                                                      Filesize

                                                                      608KB

                                                                      Download

                                                                    • memory/1484-167-0x000001C0F0150000-0x000001C0F018C000-memory.dmp

                                                                      Filesize

                                                                      240KB

                                                                      Download

                                                                    • memory/1484-166-0x000001C0EE810000-0x000001C0EE822000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/1624-1891-0x0000020127810000-0x000002012785A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/1624-1878-0x000002010E6B0000-0x000002010E6E8000-memory.dmp

                                                                      Filesize

                                                                      224KB

                                                                      Download

                                                                    • memory/1624-1880-0x000002010EF80000-0x000002010EFCA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/1624-1888-0x000002010EAB0000-0x000002010EABA000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/1624-1887-0x000002010EF50000-0x000002010EF68000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                      Download

                                                                    • memory/1624-1950-0x0000020127A70000-0x0000020127B4C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/1624-1882-0x000002010EF30000-0x000002010EF4C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/1920-45-0x0000000004F70000-0x0000000004F7C000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/1920-41-0x0000000004F30000-0x0000000004F5E000-memory.dmp

                                                                      Filesize

                                                                      184KB

                                                                      Download

                                                                    • memory/2012-1896-0x00000249C71D0000-0x00000249C721A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/2012-1892-0x00000249C6930000-0x00000249C693C000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/2012-1963-0x00000249DFC60000-0x00000249DFD10000-memory.dmp

                                                                      Filesize

                                                                      704KB

                                                                      Download

                                                                    • memory/2012-1898-0x00000249C6D00000-0x00000249C6D1C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/2080-1088-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2080-523-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2080-1052-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2080-526-0x00000000038C0000-0x0000000003A87000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                      Download

                                                                    • memory/2080-945-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2080-1125-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2080-948-0x0000000003900000-0x0000000003AC7000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                      Download

                                                                    • memory/2080-557-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2104-1210-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/2104-1483-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/2104-1195-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2104-1885-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/2156-1900-0x0000025DCB680000-0x0000025DCB732000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2156-1698-0x0000025DB2350000-0x0000025DB2362000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/2156-1722-0x0000025DB2C00000-0x0000025DB2C4A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/2156-1902-0x0000025DCB820000-0x0000025DCB8FC000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/2156-1724-0x0000025DB2710000-0x0000025DB272C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/2156-3486-0x0000026E712C0000-0x0000026E7140E000-memory.dmp

                                                                      Filesize

                                                                      1.3MB

                                                                      Download

                                                                    • memory/2312-1928-0x00000197FC740000-0x00000197FC748000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/2312-1861-0x00000197FCF70000-0x00000197FCFBA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/2312-1895-0x00000197FD250000-0x00000197FD32C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/2312-1845-0x00000197FBEC0000-0x00000197FBED0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/2312-1901-0x00000197FD330000-0x00000197FD3E2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2312-1881-0x00000197FC700000-0x00000197FC71C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/2464-112-0x0000000004790000-0x00000000047F6000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                      Download

                                                                    • memory/2868-297-0x000001A7FDE40000-0x000001A7FDE82000-memory.dmp

                                                                      Filesize

                                                                      264KB

                                                                      Download

                                                                    • memory/2868-300-0x000001A7FEF90000-0x000001A7FF042000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2868-302-0x000001A7FE6E0000-0x000001A7FE700000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2976-326-0x000001A99C3E0000-0x000001A99C3FC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/2976-325-0x000001A9B4D20000-0x000001A9B4DD2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2976-324-0x000001A99BB90000-0x000001A99BBA6000-memory.dmp

                                                                      Filesize

                                                                      88KB

                                                                      Download

                                                                    • memory/3140-1925-0x000002BEEDAB0000-0x000002BEEDFD8000-memory.dmp

                                                                      Filesize

                                                                      5.2MB

                                                                      Download

                                                                    • memory/3140-1790-0x000002BEEC690000-0x000002BEEC6AA000-memory.dmp

                                                                      Filesize

                                                                      104KB

                                                                      Download

                                                                    • memory/3140-1786-0x000002BEEC200000-0x000002BEEC20A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/3140-1801-0x000002BEED3B0000-0x000002BEED462000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/3160-342-0x00000284E8CD0000-0x00000284E8E1E000-memory.dmp

                                                                      Filesize

                                                                      1.3MB

                                                                      Download

                                                                    • memory/3396-78-0x0000000004960000-0x0000000004A12000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/3396-82-0x0000000004A20000-0x0000000004D74000-memory.dmp

                                                                      Filesize

                                                                      3.3MB

                                                                      Download

                                                                    • memory/3396-81-0x00000000048A0000-0x00000000048C2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/4676-384-0x00000195D4FE0000-0x00000195D4FFC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/4676-387-0x00000195D4FD0000-0x00000195D4FD8000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/4676-382-0x00000195D4740000-0x00000195D47A6000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                      Download

                                                                    • memory/4676-398-0x00000195EDAC0000-0x00000195EDAE6000-memory.dmp

                                                                      Filesize

                                                                      152KB

                                                                      Download

                                                                    • memory/4676-385-0x00000195ED8C0000-0x00000195ED90C000-memory.dmp

                                                                      Filesize

                                                                      304KB

                                                                      Download

                                                                    • memory/4676-386-0x00000195ED910000-0x00000195ED958000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                      Download

                                                                    • memory/4676-388-0x00000195D5000000-0x00000195D500A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/4676-383-0x00000195D5010000-0x00000195D505A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/4676-389-0x00000195EDB50000-0x00000195EDC2C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/4676-390-0x00000195EDC30000-0x00000195EDCE2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/4676-392-0x00000195EDAA0000-0x00000195EDAA8000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/4676-391-0x00000195EDA90000-0x00000195EDA98000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/4676-393-0x00000195EDAB0000-0x00000195EDAB8000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/4676-394-0x00000195EDCF0000-0x00000195EDD58000-memory.dmp

                                                                      Filesize

                                                                      416KB

                                                                      Download

                                                                    • memory/4676-396-0x00000195EDAF0000-0x00000195EDB1A000-memory.dmp

                                                                      Filesize

                                                                      168KB

                                                                      Download

                                                                    • memory/4676-397-0x00000195EE9C0000-0x00000195EE9FA000-memory.dmp

                                                                      Filesize

                                                                      232KB

                                                                      Download

                                                                    • memory/4740-2011-0x00000276F5170000-0x00000276F52BE000-memory.dmp

                                                                      Filesize

                                                                      1.3MB

                                                                      Download

                                                                    • memory/5144-2377-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5144-1922-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5144-1211-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5144-1212-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5144-1886-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5144-2378-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5144-2789-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5144-2790-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5252-1579-0x0000018580D20000-0x0000018580D30000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/5252-1595-0x0000018581550000-0x0000018581570000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/5252-1723-0x0000018599F10000-0x0000018599FC2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5252-1725-0x0000018599E50000-0x0000018599EB6000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                      Download

                                                                    • memory/5252-1807-0x0000018581590000-0x00000185815A4000-memory.dmp

                                                                      Filesize

                                                                      80KB

                                                                      Download

                                                                    • memory/5460-1889-0x0000021972040000-0x00000219720F2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5460-1492-0x0000021958EA0000-0x0000021958EDA000-memory.dmp

                                                                      Filesize

                                                                      232KB

                                                                      Download

                                                                    • memory/5460-1897-0x0000021972100000-0x0000021972148000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                      Download

                                                                    • memory/5460-1890-0x0000021971FA0000-0x0000021971FBC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5776-3544-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5776-1262-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5776-1884-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5776-1883-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5776-3543-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5776-1179-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5776-1178-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5776-1263-0x0000000072980000-0x0000000072D4D000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/6024-1618-0x000001F9D4540000-0x000001F9D45F2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/6024-1903-0x000001F9D44E0000-0x000001F9D4534000-memory.dmp

                                                                      Filesize

                                                                      336KB

                                                                      Download

                                                                    • memory/6024-1586-0x000001F9BB410000-0x000001F9BB422000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/6024-1589-0x000001F9BBC50000-0x000001F9BBC6C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/6124-1964-0x0000000072D50000-0x0000000072E6C000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download