cc8be1d525853403f6cfabcf0fc3bd0ca398ece559388102a7fc55e9f3aa9b33

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

תוכנת תיירות.msi
Size

2.6MB
MD5

c381c2cb8fdd6acf1636280b9424f573
SHA1

7918e2c9c6f2847078bb736968f8f21b7e70a0af
SHA256

ff2ae62ba88e7068fa142bbe67d7b9398e8ae737a43cf36ace1fcf809776c909
SHA512

2740b78b04d88981db065138f1962dcee5b867c5aa6216cca4a3ad2773194c5956270664875575c3a31c014f64d4135ffa762a79ebbe5cddd0696d1edb7bd119
SSDEEP

49152:k51VAM5R2KAHlcp8qFmmzDza2Rqr+kMdPTEe/pjO8xn+ch/TlOFNOnUI:kPCMr2NMRmk/XeM9TEeRvx+ch/TlAr

Score

6^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2128	msiexec.exe
5	2128	msiexec.exe
7	2128	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AgentPackageAgentInformation.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt	AgentPackageAgentInformation.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6386.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A6B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BD4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7662c9.ipi	msiexec.exe
File created	C:\Windows\Installer\f7662c8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6386.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6386.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f7662c8.msi	msiexec.exe
File created	C:\Windows\Installer\f7662c9.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6386.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6386.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\f7662cb.msi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1364	AteraAgent.exe
2904	AteraAgent.exe
2868	AgentPackageAgentInformation.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2580	sc.exe

Loads dropped DLL 9 IoCs

pid	Process
1272	MsiExec.exe
336	rundll32.exe
336	rundll32.exe
336	rundll32.exe
336	rundll32.exe
336	rundll32.exe
1272	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2392	TaskKill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AgentPackageAgentInformation.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\SourceList\PackageName = "תוכנת תיירות.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\PackageCode = "8461E24D8232BC14CB270C3BD27759E8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\Version = "17301510"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\882A5F5CFF587524FA965D19E026865B	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\882A5F5CFF587524FA965D19E026865B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\882A5F5CFF587524FA965D19E026865B\INSTALLFOLDER_files_Feature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\882A5F5CFF587524FA965D19E026865B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2476	msiexec.exe
2476	msiexec.exe
2904	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2128	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeSecurityPrivilege	2476	msiexec.exe
Token: SeCreateTokenPrivilege	2128	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2128	msiexec.exe
Token: SeLockMemoryPrivilege	2128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2128	msiexec.exe
Token: SeMachineAccountPrivilege	2128	msiexec.exe
Token: SeTcbPrivilege	2128	msiexec.exe
Token: SeSecurityPrivilege	2128	msiexec.exe
Token: SeTakeOwnershipPrivilege	2128	msiexec.exe
Token: SeLoadDriverPrivilege	2128	msiexec.exe
Token: SeSystemProfilePrivilege	2128	msiexec.exe
Token: SeSystemtimePrivilege	2128	msiexec.exe
Token: SeProfSingleProcessPrivilege	2128	msiexec.exe
Token: SeIncBasePriorityPrivilege	2128	msiexec.exe
Token: SeCreatePagefilePrivilege	2128	msiexec.exe
Token: SeCreatePermanentPrivilege	2128	msiexec.exe
Token: SeBackupPrivilege	2128	msiexec.exe
Token: SeRestorePrivilege	2128	msiexec.exe
Token: SeShutdownPrivilege	2128	msiexec.exe
Token: SeDebugPrivilege	2128	msiexec.exe
Token: SeAuditPrivilege	2128	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2128	msiexec.exe
Token: SeChangeNotifyPrivilege	2128	msiexec.exe
Token: SeRemoteShutdownPrivilege	2128	msiexec.exe
Token: SeUndockPrivilege	2128	msiexec.exe
Token: SeSyncAgentPrivilege	2128	msiexec.exe
Token: SeEnableDelegationPrivilege	2128	msiexec.exe
Token: SeManageVolumePrivilege	2128	msiexec.exe
Token: SeImpersonatePrivilege	2128	msiexec.exe
Token: SeCreateGlobalPrivilege	2128	msiexec.exe
Token: SeBackupPrivilege	2612	vssvc.exe
Token: SeRestorePrivilege	2612	vssvc.exe
Token: SeAuditPrivilege	2612	vssvc.exe
Token: SeBackupPrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2796	DrvInst.exe
Token: SeRestorePrivilege	2796	DrvInst.exe
Token: SeRestorePrivilege	2796	DrvInst.exe
Token: SeRestorePrivilege	2796	DrvInst.exe
Token: SeRestorePrivilege	2796	DrvInst.exe
Token: SeRestorePrivilege	2796	DrvInst.exe
Token: SeRestorePrivilege	2796	DrvInst.exe
Token: SeLoadDriverPrivilege	2796	DrvInst.exe
Token: SeLoadDriverPrivilege	2796	DrvInst.exe
Token: SeLoadDriverPrivilege	2796	DrvInst.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeRestorePrivilege	2476	msiexec.exe
Token: SeTakeOwnershipPrivilege	2476	msiexec.exe
Token: SeDebugPrivilege	2392	TaskKill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2128	msiexec.exe
2128	msiexec.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1272	2476	msiexec.exe	32
PID 2476 wrote to memory of 1272	2476	msiexec.exe	32
PID 2476 wrote to memory of 1272	2476	msiexec.exe	32
PID 2476 wrote to memory of 1272	2476	msiexec.exe	32
PID 2476 wrote to memory of 1272	2476	msiexec.exe	32
PID 2476 wrote to memory of 1272	2476	msiexec.exe	32
PID 2476 wrote to memory of 1272	2476	msiexec.exe	32
PID 1272 wrote to memory of 336	1272	MsiExec.exe	33
PID 1272 wrote to memory of 336	1272	MsiExec.exe	33
PID 1272 wrote to memory of 336	1272	MsiExec.exe	33
PID 1272 wrote to memory of 336	1272	MsiExec.exe	33
PID 1272 wrote to memory of 336	1272	MsiExec.exe	33
PID 1272 wrote to memory of 336	1272	MsiExec.exe	33
PID 1272 wrote to memory of 336	1272	MsiExec.exe	33
PID 2476 wrote to memory of 2632	2476	msiexec.exe	35
PID 2476 wrote to memory of 2632	2476	msiexec.exe	35
PID 2476 wrote to memory of 2632	2476	msiexec.exe	35
PID 2476 wrote to memory of 2632	2476	msiexec.exe	35
PID 2476 wrote to memory of 2632	2476	msiexec.exe	35
PID 2476 wrote to memory of 2632	2476	msiexec.exe	35
PID 2476 wrote to memory of 2632	2476	msiexec.exe	35
PID 2632 wrote to memory of 1864	2632	MsiExec.exe	36
PID 2632 wrote to memory of 1864	2632	MsiExec.exe	36
PID 2632 wrote to memory of 1864	2632	MsiExec.exe	36
PID 2632 wrote to memory of 1864	2632	MsiExec.exe	36
PID 1864 wrote to memory of 572	1864	NET.exe	38
PID 1864 wrote to memory of 572	1864	NET.exe	38
PID 1864 wrote to memory of 572	1864	NET.exe	38
PID 1864 wrote to memory of 572	1864	NET.exe	38
PID 2632 wrote to memory of 2392	2632	MsiExec.exe	39
PID 2632 wrote to memory of 2392	2632	MsiExec.exe	39
PID 2632 wrote to memory of 2392	2632	MsiExec.exe	39
PID 2632 wrote to memory of 2392	2632	MsiExec.exe	39
PID 2476 wrote to memory of 1364	2476	msiexec.exe	41
PID 2476 wrote to memory of 1364	2476	msiexec.exe	41
PID 2476 wrote to memory of 1364	2476	msiexec.exe	41
PID 2904 wrote to memory of 2580	2904	AteraAgent.exe	43
PID 2904 wrote to memory of 2580	2904	AteraAgent.exe	43
PID 2904 wrote to memory of 2580	2904	AteraAgent.exe	43
PID 2904 wrote to memory of 2868	2904	AteraAgent.exe	47
PID 2904 wrote to memory of 2868	2904	AteraAgent.exe	47
PID 2904 wrote to memory of 2868	2904	AteraAgent.exe	47

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\תוכנת תיירות.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 995371D729DBB69FDCA3C9D11B86CE71
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6386.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259417120 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86F1221827D0543CD1A176A0A7438E96 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\syswow64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      PID:572
- - C:\Windows\syswow64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q3000008qXbDIAU"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1364

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A4" "0000000000000584"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:2580
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 942d9ac9-11a9-48e5-9b20-47b0d11ca803 "61bff3b0-edb2-47be-867d-540f99e541eb" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7662ca.rbs

Filesize
8KB

MD5
8e8291616dd7556e27456bf17b46ddbc

SHA1
3f43e45e3994559325562fc4f13c28be5b1212e4

SHA256
7a0103a6a8e3331b2b97b076200d954361610e479fa9b2a5e37c6960455ec484

SHA512
b561117f5e390ec8ba445fb29c7673612c43943e78404396c49749a2bfca70f1f8a0672c6f28cf72fc549af0286c1faff1294a4868c5b64ccadd17d23623f31e

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Filesize
140KB

MD5
2899046a979bf463b612b5a80defe438

SHA1
21feaa6f3fbb1afa7096c155d6b1908abf4ea3b9

SHA256
486b2c2b0ca934ab63a9cf9f4b660768ad34c8df85e6f070aec0b6a63f09b0d8

SHA512
8c60eb0d9e82326543f2fbcd08783e041a7f5598723666b1c9ea5df7808d0c4947e8e64c2dcd46331bc3dbc38c6ec8b85ed2fcc5b97eaf0465ea624167829368

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Filesize
1KB

MD5
b3bb71f9bb4de4236c26578a8fae2dcd

SHA1
1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

SHA256
e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

SHA512
fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

Filesize
209KB

MD5
a41c23558b3c07f8c749844bb553d545

SHA1
8473013cf5f2be8158c13f1056675d1cbd10586f

SHA256
a6193fc0a09ad7145fe38494bcf67fecbc10c07a5f3936e419895b018e85a766

SHA512
5930f14f3be4aed70a1ff93dbb75022c2d947a0a2344031992167d72192e0a51d207fc2255cb0ca1fb21b20b1277a528bbf739bbdf8676f7a0786efd132b436f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Filesize
693KB

MD5
64e122b28a1e548c1cca376e32cdd248

SHA1
4506de40b8422c9be58333f35325a86674ca650c

SHA256
0ee2dd095b1cc4c3cda44a237a188e16c8614c107ad9d37ad8a581473ad42215

SHA512
36fc7dd056303822b23f9173b43522dee23431a419bdbae43a850e87f37b936b34ed2ef5013997d6d8b59d74627d55b0cc622da751d3ed828c850c7982a0d8fa

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI

Filesize
12B

MD5
e1d717a53b79233000376e06e7e818fa

SHA1
e9f5a584cc49acaf36d4837802b9a3ea7b5144e8

SHA256
b670eba39ceb4441a7c9b00d2ad56c22c762a985ab3620fa2df94af6a05d3bc0

SHA512
759a6ecbc46bac091a9c712f69125ea739651b185d1ffb26f79bffaf0d5c79ec10f9cb42408e098a89f0408f434919500cf07314ac4eae0948e4aba7a099178f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Filesize
163KB

MD5
3723dec9f9f58e9548cf705a08272aa7

SHA1
0eb60973068ba24edd449bed2be05c64a17c46e7

SHA256
2906684ef97d39b4aba921be2728dc50458b66045c328adedc33fe483a7ca877

SHA512
469b8ca4a0dc6433c90c141320ddcdf77e6b529f660326b249fd4a9d8bc22281079fde6ab71e02b03656f13f5af6d1c4185ac62ce470786091794b33d1433530

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

Filesize
546B

MD5
158fb7d9323c6ce69d4fce11486a40a1

SHA1
29ab26f5728f6ba6f0e5636bf47149bd9851f532

SHA256
5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

SHA512
7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll

Filesize
94KB

MD5
3ca5eae6bc6b5b68e86d7e94da6680b4

SHA1
8b1506e53cd0cc830450cf864bc300b9b249899d

SHA256
d297eb8b6b451e47bdd5118a311c30220a392c2e1c606004d822b8db978f6855

SHA512
c7d19f1e66d50a0891284c9aedea9bbed9fa82c0aa119c6c6b1e3ef23167727db89c741a70d8673d29aa652b1f97c61f821e5609d16151749f05b83816cdd16d

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll

Filesize
687KB

MD5
74b54353c4e2834907dcf55d0c329050

SHA1
bdf81278635673ed3c3f7d9243c56338b18ba950

SHA256
a0fcf15c913a9871724f36fd280aa3654a1325c24c46da42704fb79c72860608

SHA512
6b4d54bd31310fb5c1936e64c5d1fc7213fa672db1ee18953b62491724c6c407632f9999d8edcab9f15a8b99479572e11e00194b2be3008ba238a5675cdc44f1

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt

Filesize
23KB

MD5
e1b4c80b0a1b04c073272892868fc3f5

SHA1
38d62369e7d8427fdbf74bf7a8c8c9ea864b247c

SHA256
46c9252e222d212171fc3ade3a1f45cb359ea75fe99193f6e88b469b82e38ae6

SHA512
b0a3456236a1d0417eb8431f7b68689e05492be9afc46c677a00626b118ac6acaa69a783c84a15c2db7366f347be21cfe80d9302de8c34a8726420fb314cb5fd

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Filesize
588KB

MD5
82b17dc9838e1e21e5c6f53d2867e94a

SHA1
a09bfe6582bff9193337cc7dbab79d0b6b723205

SHA256
8e7210c1cd0955aeb4cbbdce362d4c450e0bf1be47bdf263fbf2789a4d98fd00

SHA512
c1b259655e2514449366f2d150d020a1eabb0e67af29c5e26c3a00f1d84d805216016c306d48e37354de09d4a056dc071c0d0d0d36f8ec9775843e6ae2712430

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Filesize
168B

MD5
39d0829413495b02fa925ae231ba986f

SHA1
d65452465945396157db7c1d2f6059904cc4f2cf

SHA256
49c8f53c815d823c5fd4f01cca839615849bda299aab320acfa2a8fd4d990afe

SHA512
e80b52339d8e38e8ceb8c5fb65e51a7643424d83e4d98de6c156270a5bd46bd184971f0f36a0b5f5c192263efe0c4d30e47f1b8ab8736bc89dd842e39879175c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
656018322dd4a0a1d0d45d6e1afd9aa8

SHA1
50c52d392a825057aaa8cdf7487767983dc4049d

SHA256
59b0d523749dff91a8eb4424146519ec4421b3740c253dbb04c04500d1c39087

SHA512
876ccc4d2fc518b2e85270d455817f57abcc8adb7897aa1f219c751d996379062ac9a4c2284b0aa15ced977a638441447db5b2d97ec6a41b9b7c601535f95de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
727B

MD5
d3fb75bc3f62760e845038cb33832c47

SHA1
bdf0989f892f6343c7d812bf9dba133a2954945f

SHA256
e54911ea2be4223154f66d3006974901a875a51b6c6dd3338d770f5a87cf24e3

SHA512
1d287a5667ba214b223da29575041abd94c1acd4aa3d9ae88e81590d83bda2751e5631a5369474e51e8d6633be106a4f1899ce31fba8d3a1f96cd358c3216d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
df0fafa65c94099f93f04e3af9573a01

SHA1
566a75e7b0ac6b0ed2833a043d0a3a5567bbf75b

SHA256
4c3baccaef5b8ea5d78155a59c275a0ca1d8f461111b0ff2fe186d1733007333

SHA512
57af4e6573501282919a506349220611aee40d8208787952800b51f081a978b52943caae0c7ca8cb238ccfbb24a566a47166259c6ccd7745663037aa79eb4deb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
473b3fc07a8f0299a909a276d92b9042

SHA1
d96dad8113fd9b1b6714f6370323e0a925d04c40

SHA256
d164a9609826a15919a5ebeb53c318d03ddd52e0d99c74fc1e781458d35457d1

SHA512
034baba2173a5d2d775ac4e4c9c4bf51a61939121bcd374f2d42e6a7334700c7d3a97779cdb62f3cfb3f9d374b1b11a4570d67d23aaa42268bc5d062c410edf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
404B

MD5
1cdef6dc359f815b51cdb9ec3a3d01f3

SHA1
ef72e06f02a06954fcd4f43eadd9b5b039b34c68

SHA256
7f9437e61b53d7321789c953a39fa1259ccf847205ed42e9c0771f057b4df510

SHA512
033d17a8159adac15ded64b3001162da59e934977ed9542b030e6b06bea3f856dc7586fd20c143ebb9809d943cb435fa10e34f1281998c865487e13e7f5253e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
281cb2114e06158b3a4d0ae9e32a367d

SHA1
b8232628c858866e11c8fcc98aae3849926f12f2

SHA256
9a9a151ef5e6aa307753c5da38c63308faa1a22c338b48e90a078b4d63a02b42

SHA512
cff0d154c4730889307f9ff854f158aca1631bcb2b74143a8e175ee6184a56ef417f388a6b1ccadb4183f22694503512c9cbab2c05b55cc5a04b5d27e95f8b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
eaf87f75068adb7506a85b73be82ddfb

SHA1
7e457684974832391a56ffca25b83b8cb7d8431d

SHA256
8c41dfe209936af031b7597ffda1efcbfe5064e775e89a0788b12899b845a936

SHA512
e2bcd15714cdb5488f88dae4e073121267d05498a37dedf8100b60b1cb03c9bebf7eee29141d9dfeab14f93fc236d26d264e10424859443431c8dded018b0378

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6308.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Windows\Installer\MSI6386.tmp

Filesize
275KB

MD5
672e03b9d7a2d50f3e935909a198928b

SHA1
6cc8a45126243c6ad8a6336ef1789e6a8b5dd33f

SHA256
c4772f8a8761f052bd0336923539699ba2f358ac203beb197cda576146e05a0d

SHA512
bf5833ea48942319d560fb4dad62997fa5495e0d9c634361d919d3328364d0f4a999dfb56590d48227c3690d8a867b022f6d5fd01c46f27d2ad6421d88380372

Download Submit
C:\Windows\Installer\MSI6A6B.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\f7662c8.msi

Filesize
2.6MB

MD5
c381c2cb8fdd6acf1636280b9424f573

SHA1
7918e2c9c6f2847078bb736968f8f21b7e70a0af

SHA256
ff2ae62ba88e7068fa142bbe67d7b9398e8ae737a43cf36ace1fcf809776c909

SHA512
2740b78b04d88981db065138f1962dcee5b867c5aa6216cca4a3ad2773194c5956270664875575c3a31c014f64d4135ffa762a79ebbe5cddd0696d1edb7bd119

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8766c0ca15c8924c695cdfb94655d321

SHA1
c22642dafb901ff52bd0c512bd46cdc130ab9b15

SHA256
e3392b3b6b4cd4ee9d7745afd7925fda28e73ca72120144c135e9dd1293879a5

SHA512
235441e8579887912ae2ebc3616646babe9c1f545d83ab5ce558610eec99858643c969451c6022473740dc4d698cb21831aa755130e8715298414eae8fd71009

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f752bd978cd524e87465cfb1aad38de2

SHA1
44b07cfb9c9932c27e53976c84588d8e806544e3

SHA256
4dfcbc4f25a68bcd18839a98fbecc790d60470bb9e54dd9ffe575a6c1404e4ee

SHA512
06f21f32b2d5db5154acf71d717203ff2486cdb85ea8ddc15a590656cea3903644c559a0064b3fdf1144ca017375b3b603e579e1c3739c009650d79f2d4c1f18

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de0698560652028b3091b21cb52a1c99

SHA1
410418170aa5d9d887897256cb56ff1bb5298c56

SHA256
0740584ffe17fe21061e581d8ff70300499916cfb231f2bb60d4bf369cc76f4e

SHA512
9934c5db4bdbcfbba693d13330648b0ec5702e82377c32b8152840ee858893aaede7b303a62669faf5d6671ff1c2e58e906aecb5a741efbf187ee56ee4155871

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7eeb0a51f8db5260b0b37eab1e29bae

SHA1
cdc934452f3e0d12279b0cb233073ed6357aba97

SHA256
4c84e8fdef93353ca35564ab7bae105d64ebc334c9a507ee4c5f7c953362ee89

SHA512
90add512292744e25a4799fbe8de1c56d3553b9b0eac0b70e71c40c2ffcad7e842ceaf66c651d50ba370d84adc713efb7d6ed800eb1e98f6ed8bce6870a26d46

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cce931e456fdce6df002df1fe466c4b5

SHA1
4dc77075e7875d54259354a93cb4be10b0ae62b1

SHA256
432d0aa1fdab60fc82633385c44327a3dae6a18348f67611d4aa32e7b2255d2f

SHA512
fb586a4a2ef36ff3640d521667c7d71d22db0b968cd4dd58c3e3ecb483d42251077c952945803a859a55f853031c128a5efe1b45ef1878acbe5c2049858986f6

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df1cb6d9afc93a2c805c285a7fa5f8f5

SHA1
b18e8291443c7f31e5d7aaf97b96978afe910a3f

SHA256
b8151867f0af268cb8a313649bd91d721391ea248fa86c73ffc96eee855f33e2

SHA512
dac9525a79644c6360ca6165b5bb8b550a19b50b4a537646d42c417857f9c01ff569e02e59faa30e0fd8c57c77dc1096e91f833404c058dcf74639b3c56d1006

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1902d08be1ff0f093ebac0810a566b0e

SHA1
1cd7c0f38e2362fb583c79b20d8bb2c41b81854d

SHA256
3be16e87901c955a22462906b5a4ab5f3d2bb6321def31f795e38190b0b54c72

SHA512
bd569effa30e81208d6998020276dc242bfac8a2278f4303b4ba6696e9aacf3fc507af511f85cb5ecd252b04cba10cd995e03f613999d738b8d9b718814c8883

Download Submit
C:\Windows\Temp\Cab8749.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar87C9.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb00b4ea81c9afb95fd2a859820499b

SHA1
c47695bfe808f00cd24e291591f66fd0a605b98a

SHA256
163805701c1335aba752b9c5fcd32f7a166cf9867d90ff442f2ebb2a33b79be1

SHA512
d337e9d338f562e4030006c0c1da46ab3205075d5091c0651f366bb4930baaa142b3eee80dfc45bebe23e6b2aeef620ac8c6ecb885520dce7864ea18656580fd

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1abb3aed33401b7b1fac8d25c998aca9

SHA1
52a2e1b525e27bd0a61f7de7b4ac2790512efa68

SHA256
9d90909f2fb89ad4d24ba9b2cd77a277309f248b2f87338a65793d07ed111e0b

SHA512
0e50275fb6c9ce117756b91e70a2227f846b6cc2ec056a2fddf38055b51536583d8b13171ef0ee5c60411dcedc581fdd73e904431f2e118586f09b05e32f0ff1

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6d781d3d8810227ea368cb19cef3c80

SHA1
47d1eacddc1e4095bd114e648efdf3aa4d5997ab

SHA256
4f8cfd0b9f3adbd7482327adbd8c18069f68bb955d6ced43f793515450d83b52

SHA512
c04524f13c71ed20036304144ca07d89e4ee22ed7c215eb0ee0b620dd2aba0a319214c2167da8a23dd4fb10e916ee1d6e73c9be9440e5999aa1e67a719bdfe9e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
652e3743737284c0a39acd49989d9c72

SHA1
6e0f039e58227d1c52510e934f1025bb64fc3911

SHA256
ac21fcdfb40a841c192cc0b678b4ed32b692421d3dfc8830c445ef59610307a6

SHA512
615d224a63efca71d17069b0050befb56bd0e72f7734332a7c152c3a676c4fd107b6bf1129d3356ad0c9603396f2e06785d2fcc44304f7c52460d4b674f689e6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87b53833ec6178a366762de990b14aa1

SHA1
c4c34c3237704c4eb4307d063d70362172060f0e

SHA256
4ef74e5521fce6b39530697ef62dc9301188b0ba25a60bd138dee8e8a0baf17a

SHA512
a867d42ae0a29c98671d419b130dd8d069726e3983cd768ea42661fd31aac1ed20f09bbeb42ff504035b0fb4ff0e7d21c86d5905a04d5e33082877f4f4e11131

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a9bbafe5abf7c79aa4abe3cd7f1d90

SHA1
c09e698d7bb2738d3722f538b0421a4ad676f0e5

SHA256
5c0ca2d79ec5495e7188508d870c4e359cb9721b9ca4abe08435f61160cf4397

SHA512
7d60699a1a1e4370d1cd4f461370bb01a1bc38b38dda8b1404d68ca626d519aa87fe85137a1706a84687d85d2a1407a7bcfdc9ed162f6b8044431a1a4e7b7bc7

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
339817a445e7090c7154127d185983f8

SHA1
371483a009d4a2cac61384aba81ec55f254b93b7

SHA256
19edd1a5196f7de040fb610d877809b11661246c6892d570b61dc7e6117e4368

SHA512
88f8f9fc92377929b68a3143add15ba3ad5de608212e3cc07277f989ad309b4079346332548bd0b7225d43a556436cf0992cb322c92b780a2b59934bc64e0027

Download Submit
\Windows\Installer\MSI6386.tmp-\AlphaControlAgentInstallation.dll

Filesize
19KB

MD5
4db38e9e80632af71e1842422d4b1873

SHA1
84fe0d85c263168487b4125e70cd698920f44c53

SHA256
4924aad650fa0f88c6fc6ca77068d73f70f0d0866a98212b615290ffb0b04efa

SHA512
9ce1e75b11e43369fe2320cf52bef856170385a8e898a934c735cb92a8399e5e612a54b248579687c372dae58e47e05d9095116313aea9555cf2358944252d77

Download Submit
\Windows\Installer\MSI6386.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
memory/336-80-0x0000000000520000-0x000000000052C000-memory.dmp

Filesize
48KB

Download
memory/336-70-0x00000000738F0000-0x0000000073FDE000-memory.dmp

Filesize
6.9MB

Download
memory/336-75-0x00000000004D0000-0x00000000004FE000-memory.dmp

Filesize
184KB

Download
memory/336-76-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/336-89-0x00000000738F0000-0x0000000073FDE000-memory.dmp

Filesize
6.9MB

Download
memory/1364-166-0x000007FEF4E70000-0x000007FEF585C000-memory.dmp

Filesize
9.9MB

Download
memory/1364-118-0x0000000001110000-0x0000000001136000-memory.dmp

Filesize
152KB

Download
memory/1364-119-0x000007FEF4E70000-0x000007FEF585C000-memory.dmp

Filesize
9.9MB

Download
memory/1364-120-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/1364-132-0x0000000000D10000-0x0000000000DA8000-memory.dmp

Filesize
608KB

Download
memory/2868-1179-0x0000000000530000-0x000000000054C000-memory.dmp

Filesize
112KB

Download
memory/2868-1180-0x0000000019BA0000-0x0000000019C20000-memory.dmp

Filesize
512KB

Download
memory/2868-1177-0x0000000000AE0000-0x0000000000B90000-memory.dmp

Filesize
704KB

Download
memory/2868-1173-0x0000000000D30000-0x0000000000D5C000-memory.dmp

Filesize
176KB

Download
memory/2868-1174-0x000007FEF4E70000-0x000007FEF585C000-memory.dmp

Filesize
9.9MB

Download
memory/2868-1673-0x000007FEF4E70000-0x000007FEF585C000-memory.dmp

Filesize
9.9MB

Download
memory/2868-1674-0x000007FEF4E70000-0x000007FEF585C000-memory.dmp

Filesize
9.9MB

Download
memory/2904-931-0x000000001A2F0000-0x000000001A328000-memory.dmp

Filesize
224KB

Download
memory/2904-165-0x000007FEF4E70000-0x000007FEF585C000-memory.dmp

Filesize
9.9MB

Download
memory/2904-170-0x0000000000E70000-0x0000000000EF0000-memory.dmp

Filesize
512KB

Download
memory/2904-181-0x000000001A700000-0x000000001A7B2000-memory.dmp

Filesize
712KB

Download
memory/2904-950-0x0000000000E70000-0x0000000000EF0000-memory.dmp

Filesize
512KB

Download
memory/2904-927-0x000007FEF4E70000-0x000007FEF585C000-memory.dmp

Filesize
9.9MB

Download