Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 02:12
Behavioral task
behavioral1
Sample
8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6.msi
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6.msi
Resource
win10v2004-20241007-en
General
-
Target
8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6.msi
-
Size
2.9MB
-
MD5
a232621b778a64163b77169820ad579e
-
SHA1
252a8e0aa905aa1880161ab53aaeb54e345991a8
-
SHA256
8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6
-
SHA512
b6df966ed6f9d2e98e09300a01c6bc0e1c8641de3f4f28f462debe619560f002720fdfd5ae4247106e6deda1f67161f8f87c8f6db1ea45d73fa1a6b7a870b929
-
SSDEEP
49152:J+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:J+lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023c98-239.dat family_ateraagent -
Blocklisted process makes network request 7 IoCs
flow pid Process 4 1000 msiexec.exe 8 1000 msiexec.exe 37 2992 rundll32.exe 41 4544 rundll32.exe 85 4656 MsiExec.exe 140 4024 rundll32.exe 158 5832 rundll32.exe -
Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\UMDF\lci_iddcx.dll DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETE5B8.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETE5B8.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\lci_proxywddm.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\UMDF\SETE606.tmp DrvInst.exe File created C:\Windows\System32\drivers\UMDF\SETE606.tmp DrvInst.exe -
Downloads MZ/PE file
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 AgentPackageMonitoring.exe File opened for modification \??\PhysicalDrive0 AgentPackageMonitoring.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_90864756631514CEFBD0C1134238624E MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\x64\SETE26C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\x64\lci_iddcx.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lci_iddcx.inf_amd64_b68cf383a51d03e9\lci_iddcx.cat DrvInst.exe File opened for modification C:\Windows\System32\SETE5B9.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 AteraAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MsiExec.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageHeartbeat.exe.log AgentPackageHeartbeat.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64\SETE4AF.tmp DrvInst.exe File opened for modification C:\Windows\System32\lci_proxyumd.dll DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 AteraAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_9C79DA33A1711362E9D071D2706BB651 SRManager.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageSystemTools.exe.log AgentPackageSystemTools.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log rundll32.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lci_proxywddm.inf_amd64_a909cab09ba387b1\x64\lci_proxywddm.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\lci_proxywddm.inf_amd64_a909cab09ba387b1\lci_proxywddm.PNF rundll32.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64\lci_proxywddm.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\lci_proxywddm.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lci_proxywddm.inf_amd64_a909cab09ba387b1\lci_proxywddm.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\SETE5B9.tmp DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageUpgradeAgent.exe.log AgentPackageUpgradeAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_9C79DA33A1711362E9D071D2706BB651 SRManager.exe File created C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\SETE26D.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_90864756631514CEFBD0C1134238624E MsiExec.exe File created C:\Windows\system32\SRC4D24.tmp MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\x64 DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lci_proxywddm.inf_amd64_a909cab09ba387b1\lci_proxywddm.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB SRManager.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageMarketplace.exe.log AgentPackageMarketplace.exe File created C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\SETE4C1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64 DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 MsiExec.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageProgramManagement.exe.log AgentPackageProgramManagement.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\SETE4C1.tmp DrvInst.exe File opened for modification C:\Windows\SysWow64\SETE5BA.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64\SETE4B0.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MsiExec.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageInternalPoller.exe.log AgentPackageInternalPoller.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\lci_iddcx.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1 AteraAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageSTRemote.exe.log AgentPackageSTRemote.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageOsUpdates.exe.log AgentPackageOsUpdates.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\lci_iddcx.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64\SETE4AF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lci_proxywddm.inf_amd64_a909cab09ba387b1\x64\lci_proxyumd.dll DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 AteraAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageRuntimeInstaller.exe.log AgentPackageRuntimeInstaller.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File created C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\SETE26E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\lci_proxywddm.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\lci_proxywddm.inf_amd64_a909cab09ba387b1\x64\lci_proxyumd32.dll DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 MsiExec.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
resource yara_rule behavioral2/memory/2864-1173-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/2864-1175-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/2864-1174-0x0000000072B50000-0x0000000072C6C000-memory.dmp upx behavioral2/memory/5164-1191-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/5164-1192-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/5804-1194-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/5804-1196-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/5804-1195-0x0000000072B50000-0x0000000072C6C000-memory.dmp upx behavioral2/memory/2864-1255-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/2864-1256-0x0000000072B50000-0x0000000072C6C000-memory.dmp upx behavioral2/memory/2864-1257-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/5164-1274-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/5164-1273-0x0000000072B50000-0x0000000072C6C000-memory.dmp upx behavioral2/memory/5164-1272-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/5804-1680-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/2864-1810-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/2864-1809-0x0000000072B50000-0x0000000072C6C000-memory.dmp upx behavioral2/memory/2864-1808-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/5804-1826-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/2864-2180-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx behavioral2/memory/2864-2182-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/2864-2181-0x0000000072B50000-0x0000000072C6C000-memory.dmp upx behavioral2/memory/5164-2335-0x0000000072B50000-0x0000000072C6C000-memory.dmp upx behavioral2/memory/5164-2336-0x0000000072780000-0x0000000072B44000-memory.dmp upx behavioral2/memory/5164-2334-0x0000000072C70000-0x0000000072D6D000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dll AteraAgent.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Wacom\x86\SRWacomCtrl32.dll msiexec.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\Atera.AgentPackages.Exceptions.dll AteraAgent.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\avutil-55.dll msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\stdpms.inf msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\xdsmpl.gpd msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Threading.Overlapped.dll AteraAgent.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\legacy.dll msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Monitor\uninstall_driver64.bat msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cuninst.exe AgentPackageProgramManagement.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\System.Buffers.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\System.Memory.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\Microsoft.ApplicationInsights.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Linq.dll AteraAgent.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\win10\32bits\stvad.sys msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll msiexec.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.Logging.Configuration.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Collections.Concurrent.dll AteraAgent.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppBS.exe msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\x64\lci_proxyumd.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\Interop.WUApiLib.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\NLog.config AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.Logging.Configuration.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.ini AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.FileProviders.Physical.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini AteraAgent.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\utils\DIFxCmd.exe msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVSpk\32bits\stvspk.sys msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Net.Http.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Net.WebSockets.Client.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Security.Cryptography.Algorithms.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Security.Principal.dll AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\helpers\functions\Install-ChocolateyShortcut.ps1 AgentPackageProgramManagement.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\helpers\functions\Install-Vsix.ps1 AgentPackageProgramManagement.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe.config AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Diagnostics.FileVersionInfo.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\StructureMap.dll AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\NLog.dll AteraAgent.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRDxgiCaptor.dll msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\Mirror\utils\DIFxCmd.exe msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\uninstall_driver.bat msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\xdwscRGB.icc msiexec.exe File created C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STPrinter\win10\64bits\xdbook.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Globalization.Extensions.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Serilog.Extensions.Hosting.dll AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\clist.exe.ignore AgentPackageProgramManagement.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.Logging.Debug.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Diagnostics.StackTrace.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\OpenHardwareMonitorLib.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.Linq.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.Options.ConfigurationExtensions.dll AteraAgent.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\dynamicfieldscaching.cch AgentPackageAgentInformation.exe File created C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe.config AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\System.ObjectModel.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.ini AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe AteraAgent.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e57db9b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9950.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\MSI9950.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDC37.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE8FA.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File created C:\Windows\Installer\e57db9d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF479.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2D3D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3AFC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9865.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI9950.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA078.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA144.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB693.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEAB2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF479.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF479.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2DAC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9950.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI9BF1.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIBB1B.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log rundll32.exe File opened for modification C:\Windows\Installer\MSIDEA9.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIDEA9.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIF479.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5EC5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9865.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI9865.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIDEA9.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE8FA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF479.tmp-\Newtonsoft.Json.dll rundll32.exe File created C:\Windows\Installer\SourceHash{B7C5EA94-B96A-41F5-BE95-25D78B486678} msiexec.exe File opened for modification C:\Windows\Installer\MSI9BF1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6A3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBB1B.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIDEA9.tmp msiexec.exe File created C:\Windows\Installer\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\e57dba2.msi msiexec.exe File opened for modification C:\Windows\Installer\e57dba4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9865.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI9950.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5A7E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI631B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9BF1.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA193.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIDC37.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{E732A0D7-A2F2-4657-AC41-B19742648E45} msiexec.exe File opened for modification C:\Windows\Installer\MSI9BF1.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File created C:\Windows\Installer\SourceHash{6B2921FF-79C1-4EBF-81B4-C606D4E5BEF4} msiexec.exe File opened for modification C:\Windows\Installer\MSIDC37.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB6D3.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIBB1B.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE8FA.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF479.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI9865.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI9BF1.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI9BF1.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA067.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB732.tmp msiexec.exe -
Executes dropped EXE 64 IoCs
pid Process 2936 AteraAgent.exe 5068 AteraAgent.exe 2936 AgentPackageAgentInformation.exe 3640 AgentPackageAgentInformation.exe 60 AgentPackageAgentInformation.exe 1996 AteraAgent.exe 1332 AgentPackageAgentInformation.exe 3472 AgentPackageSTRemote.exe 2876 AgentPackageMonitoring.exe 1892 SplashtopStreamer.exe 528 PreVerCheck.exe 4448 _is2F58.exe 2044 _is2F58.exe 3348 _is2F58.exe 4504 _is2F58.exe 1332 _is2F58.exe 2292 _is2F58.exe 4504 _is2F58.exe 4800 _is2F58.exe 2284 _is2F58.exe 1540 _is2F58.exe 5968 _is3B30.exe 6004 _is3B30.exe 6036 _is3B30.exe 6068 _is3B30.exe 6100 _is3B30.exe 2752 _is3B30.exe 5172 _is3B30.exe 5224 _is3B30.exe 5188 _is3B30.exe 5304 _is3B30.exe 5576 AgentPackageMonitoring.exe 5252 _is488F.exe 5276 _is488F.exe 5240 _is488F.exe 2864 _is488F.exe 5328 _is488F.exe 2284 _is488F.exe 5400 _is488F.exe 5928 _is488F.exe 5420 _is488F.exe 5536 _is488F.exe 5752 SetupUtil.exe 5832 SetupUtil.exe 5956 SetupUtil.exe 5300 SRSelfSignCertUtil.exe 2864 _is5AF0.exe 5344 _is5AF0.exe 5396 _is5AF0.exe 388 _is5AF0.exe 5412 _is5AF0.exe 5496 _is5AF0.exe 5624 _is5AF0.exe 6132 _is5AF0.exe 5316 _is5AF0.exe 5800 _is5AF0.exe 5828 SRService.exe 5952 _is5F66.exe 6036 _is5F66.exe 6012 _is5F66.exe 6096 _is5F66.exe 2148 _is5F66.exe 5680 _is5F66.exe 2468 _is5F66.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2864 sc.exe 3628 sc.exe 2132 sc.exe 5068 sc.exe 4192 sc.exe -
Loads dropped DLL 64 IoCs
pid Process 5008 MsiExec.exe 4368 rundll32.exe 4368 rundll32.exe 4368 rundll32.exe 4368 rundll32.exe 4368 rundll32.exe 5008 MsiExec.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 5008 MsiExec.exe 2748 rundll32.exe 2748 rundll32.exe 2748 rundll32.exe 2748 rundll32.exe 2748 rundll32.exe 5008 MsiExec.exe 4876 MsiExec.exe 4876 MsiExec.exe 5008 MsiExec.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 5576 AgentPackageMonitoring.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 4656 MsiExec.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 5164 SRServer.exe 5164 SRServer.exe 5804 SRAgent.exe 5164 SRServer.exe 5164 SRServer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1000 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 60 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PreVerCheck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRAppPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRFeature.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRVirtualDisplay.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRSelfSignCertUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRServer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SplashtopStreamer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5264 cmd.exe 6524 dotnet.exe 1544 cmd.exe 424 dotnet.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe -
Kills process with taskkill 13 IoCs
pid Process 5760 taskkill.exe 4044 TaskKill.exe 5124 taskkill.exe 5204 taskkill.exe 5280 taskkill.exe 5440 taskkill.exe 5604 taskkill.exe 5684 taskkill.exe 5840 taskkill.exe 5356 taskkill.exe 5524 taskkill.exe 5300 TaskKill.exe 4644 TaskKill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root cscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections AgentPackageProgramManagement.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher cscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections AgentPackageMonitoring.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA SRManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SRVirtualDisplay.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs cscript.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SetupUtil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs cscript.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed SRManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust SRManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell\open\command\ = "\"C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe\" \"%1\"" AgentPackageTicketing.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\PackageCode = "F2E9E119D83B20D41A84E594CFD99834" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer\shell\open\command\ = "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRUtility.exe -a %1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\Version = "50790402" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer\DefaultIcon\ = "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRServer" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer\shell\open MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ait AgentPackageTicketing.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList\Net\1 = "C:\\Windows\\TEMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer\ = "URL:st-streamer Protocol" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ait\DefaultIcon\ = "C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe,1" AgentPackageTicketing.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\PackageCode = "4B43BFF14B20EEE4CA4A4249A1E8ED5E" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\SourceList\PackageName = "setup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\SourceList\Net\1 = "C:\\Windows\\TEMP\\unpack\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ait\DefaultIcon AgentPackageTicketing.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList\PackageName = "ateraAgentSetup64_1_8_7_2.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\49AE5C7BA69B5F14EB59527DB8846687\Server msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FF1292B61C97FBE4184B6C604D5EEB4F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\InprocServer32\ = "SRCredentialProvider" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\ProductName = "AteraAgent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\49AE5C7BA69B5F14EB59527DB8846687 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\ = "SRCredentialProvider" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FF1292B61C97FBE4184B6C604D5EEB4F\INSTALLFOLDER_files_Feature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\ProductIcon = "C:\\Windows\\Installer\\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer\shell MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\Version = "17301511" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\st-streamer\URL Protocol MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell\open AgentPackageTicketing.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C580F100A850B084DA6592048B753CD8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E1814E-5601-41c8-9971-10C319EF61CC}\ = "SRCredentialProvider" SRService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ait\ = "URL:ait Protocol" AgentPackageTicketing.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF1292B61C97FBE4184B6C604D5EEB4F\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49AE5C7BA69B5F14EB59527DB8846687\ProductName = "Splashtop Streamer" msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AteraAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AteraAgent.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1532 msiexec.exe 1532 msiexec.exe 5068 AteraAgent.exe 5068 AteraAgent.exe 5068 AteraAgent.exe 3472 AgentPackageSTRemote.exe 3472 AgentPackageSTRemote.exe 5068 AteraAgent.exe 5068 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 1996 AteraAgent.exe 5956 SetupUtil.exe 5956 SetupUtil.exe 5956 SetupUtil.exe 5956 SetupUtil.exe 5300 SRSelfSignCertUtil.exe 5300 SRSelfSignCertUtil.exe 5240 SRService.exe 5240 SRService.exe 2864 SRManager.exe 2864 SRManager.exe 5240 SRService.exe 5240 SRService.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe 2864 SRManager.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid 4 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1000 msiexec.exe Token: SeIncreaseQuotaPrivilege 1000 msiexec.exe Token: SeSecurityPrivilege 1532 msiexec.exe Token: SeCreateTokenPrivilege 1000 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1000 msiexec.exe Token: SeLockMemoryPrivilege 1000 msiexec.exe Token: SeIncreaseQuotaPrivilege 1000 msiexec.exe Token: SeMachineAccountPrivilege 1000 msiexec.exe Token: SeTcbPrivilege 1000 msiexec.exe Token: SeSecurityPrivilege 1000 msiexec.exe Token: SeTakeOwnershipPrivilege 1000 msiexec.exe Token: SeLoadDriverPrivilege 1000 msiexec.exe Token: SeSystemProfilePrivilege 1000 msiexec.exe Token: SeSystemtimePrivilege 1000 msiexec.exe Token: SeProfSingleProcessPrivilege 1000 msiexec.exe Token: SeIncBasePriorityPrivilege 1000 msiexec.exe Token: SeCreatePagefilePrivilege 1000 msiexec.exe Token: SeCreatePermanentPrivilege 1000 msiexec.exe Token: SeBackupPrivilege 1000 msiexec.exe Token: SeRestorePrivilege 1000 msiexec.exe Token: SeShutdownPrivilege 1000 msiexec.exe Token: SeDebugPrivilege 1000 msiexec.exe Token: SeAuditPrivilege 1000 msiexec.exe Token: SeSystemEnvironmentPrivilege 1000 msiexec.exe Token: SeChangeNotifyPrivilege 1000 msiexec.exe Token: SeRemoteShutdownPrivilege 1000 msiexec.exe Token: SeUndockPrivilege 1000 msiexec.exe Token: SeSyncAgentPrivilege 1000 msiexec.exe Token: SeEnableDelegationPrivilege 1000 msiexec.exe Token: SeManageVolumePrivilege 1000 msiexec.exe Token: SeImpersonatePrivilege 1000 msiexec.exe Token: SeCreateGlobalPrivilege 1000 msiexec.exe Token: SeBackupPrivilege 540 vssvc.exe Token: SeRestorePrivilege 540 vssvc.exe Token: SeAuditPrivilege 540 vssvc.exe Token: SeBackupPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeBackupPrivilege 4504 srtasks.exe Token: SeRestorePrivilege 4504 srtasks.exe Token: SeSecurityPrivilege 4504 srtasks.exe Token: SeTakeOwnershipPrivilege 4504 srtasks.exe Token: SeBackupPrivilege 4504 srtasks.exe Token: SeRestorePrivilege 4504 srtasks.exe Token: SeSecurityPrivilege 4504 srtasks.exe Token: SeTakeOwnershipPrivilege 4504 srtasks.exe Token: SeDebugPrivilege 2992 rundll32.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeDebugPrivilege 4044 TaskKill.exe Token: SeRestorePrivilege 1532 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1000 msiexec.exe 1000 msiexec.exe 5164 SRServer.exe 5164 SRServer.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1892 SplashtopStreamer.exe 5164 SRServer.exe 5164 SRServer.exe 5288 SRAppPB.exe 5288 SRAppPB.exe 5956 SRVirtualDisplay.exe 5956 SRVirtualDisplay.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 4504 1532 msiexec.exe 99 PID 1532 wrote to memory of 4504 1532 msiexec.exe 99 PID 1532 wrote to memory of 5008 1532 msiexec.exe 101 PID 1532 wrote to memory of 5008 1532 msiexec.exe 101 PID 1532 wrote to memory of 5008 1532 msiexec.exe 101 PID 5008 wrote to memory of 4368 5008 MsiExec.exe 102 PID 5008 wrote to memory of 4368 5008 MsiExec.exe 102 PID 5008 wrote to memory of 4368 5008 MsiExec.exe 102 PID 5008 wrote to memory of 2992 5008 MsiExec.exe 103 PID 5008 wrote to memory of 2992 5008 MsiExec.exe 103 PID 5008 wrote to memory of 2992 5008 MsiExec.exe 103 PID 5008 wrote to memory of 2748 5008 MsiExec.exe 104 PID 5008 wrote to memory of 2748 5008 MsiExec.exe 104 PID 5008 wrote to memory of 2748 5008 MsiExec.exe 104 PID 1532 wrote to memory of 4876 1532 msiexec.exe 105 PID 1532 wrote to memory of 4876 1532 msiexec.exe 105 PID 1532 wrote to memory of 4876 1532 msiexec.exe 105 PID 4876 wrote to memory of 4328 4876 MsiExec.exe 106 PID 4876 wrote to memory of 4328 4876 MsiExec.exe 106 PID 4876 wrote to memory of 4328 4876 MsiExec.exe 106 PID 4328 wrote to memory of 864 4328 NET.exe 108 PID 4328 wrote to memory of 864 4328 NET.exe 108 PID 4328 wrote to memory of 864 4328 NET.exe 108 PID 4876 wrote to memory of 4044 4876 MsiExec.exe 109 PID 4876 wrote to memory of 4044 4876 MsiExec.exe 109 PID 4876 wrote to memory of 4044 4876 MsiExec.exe 109 PID 1532 wrote to memory of 2936 1532 msiexec.exe 111 PID 1532 wrote to memory of 2936 1532 msiexec.exe 111 PID 5008 wrote to memory of 4544 5008 MsiExec.exe 113 PID 5008 wrote to memory of 4544 5008 MsiExec.exe 113 PID 5008 wrote to memory of 4544 5008 MsiExec.exe 113 PID 5068 wrote to memory of 2864 5068 AteraAgent.exe 114 PID 5068 wrote to memory of 2864 5068 AteraAgent.exe 114 PID 5068 wrote to memory of 2936 5068 AteraAgent.exe 116 PID 5068 wrote to memory of 2936 5068 AteraAgent.exe 116 PID 5068 wrote to memory of 3640 5068 AteraAgent.exe 118 PID 5068 wrote to memory of 3640 5068 AteraAgent.exe 118 PID 5068 wrote to memory of 60 5068 AteraAgent.exe 120 PID 5068 wrote to memory of 60 5068 AteraAgent.exe 120 PID 5068 wrote to memory of 1332 5068 AteraAgent.exe 123 PID 5068 wrote to memory of 1332 5068 AteraAgent.exe 123 PID 1996 wrote to memory of 3628 1996 AteraAgent.exe 125 PID 1996 wrote to memory of 3628 1996 AteraAgent.exe 125 PID 5068 wrote to memory of 3472 5068 AteraAgent.exe 127 PID 5068 wrote to memory of 3472 5068 AteraAgent.exe 127 PID 1332 wrote to memory of 2272 1332 AgentPackageAgentInformation.exe 129 PID 1332 wrote to memory of 2272 1332 AgentPackageAgentInformation.exe 129 PID 2272 wrote to memory of 920 2272 cmd.exe 131 PID 2272 wrote to memory of 920 2272 cmd.exe 131 PID 5068 wrote to memory of 2876 5068 AteraAgent.exe 132 PID 5068 wrote to memory of 2876 5068 AteraAgent.exe 132 PID 3472 wrote to memory of 1892 3472 AgentPackageSTRemote.exe 136 PID 3472 wrote to memory of 1892 3472 AgentPackageSTRemote.exe 136 PID 3472 wrote to memory of 1892 3472 AgentPackageSTRemote.exe 136 PID 1892 wrote to memory of 528 1892 SplashtopStreamer.exe 139 PID 1892 wrote to memory of 528 1892 SplashtopStreamer.exe 139 PID 1892 wrote to memory of 528 1892 SplashtopStreamer.exe 139 PID 528 wrote to memory of 4472 528 PreVerCheck.exe 140 PID 528 wrote to memory of 4472 528 PreVerCheck.exe 140 PID 528 wrote to memory of 4472 528 PreVerCheck.exe 140 PID 1532 wrote to memory of 4656 1532 msiexec.exe 141 PID 1532 wrote to memory of 4656 1532 msiexec.exe 141 PID 1532 wrote to memory of 4656 1532 msiexec.exe 141 PID 4656 wrote to memory of 4448 4656 MsiExec.exe 142 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1000
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0C0DA1B3A1EA6096B31F3E89B7C97E212⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIDC37.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639265 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4368
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIDEA9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639750 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE8FA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642343 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF479.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240645265 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4544
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 92712CC659C4CDD36905502B5686DBD6 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:864
-
-
-
C:\Windows\SysWOW64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000MmQV4IAN" /AgentId="b59940ab-7c7f-4a2d-a0ef-51707f450e8f"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2936
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A60971705CFCC59A54E31D15917C06E2 E Global\MSI00002⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7732E143-F6E1-4F53-9D46-8F35A36B6407}3⤵
- Executes dropped EXE
PID:4448
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C3DEBA4-7F2E-4B9F-BFF1-E29394A8BD0F}3⤵
- Executes dropped EXE
PID:2044
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3AF47CA-26BD-4DCA-87B6-D0C751B97EF0}3⤵
- Executes dropped EXE
PID:3348
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC5AD2EA-3BB0-456C-9F25-156C1FD0750F}3⤵
- Executes dropped EXE
PID:4504
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CB0E057-9994-4895-B165-86981D1DDF27}3⤵
- Executes dropped EXE
PID:1332
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D55493DD-1436-492C-87DF-7AC9614A1D77}3⤵
- Executes dropped EXE
PID:2292
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ED797A08-4D4D-42BC-8143-A174E0992117}3⤵
- Executes dropped EXE
PID:4504
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0ADE5C05-1633-4F60-AB36-B3B2CB1E3F1D}3⤵
- Executes dropped EXE
PID:4800
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17C4BCF3-51E6-487F-AFE9-03F3867FE8C9}3⤵
- Executes dropped EXE
PID:2284
-
-
C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exeC:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55B24994-5342-43D2-AEFE-E62143880CD6}3⤵
- Executes dropped EXE
PID:1540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:4504 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRServer.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5152 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRApp.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRAppPB.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRFeature.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRFeatMini.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5480 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRManager.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5556 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRAgent.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRChat.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5712 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRAudioChat.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"3⤵
- System Location Discovery: System Language Discovery
PID:5788 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRVirtualDisplay.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5840
-
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{967D4154-EC8C-43C3-A662-112D663A07E5}3⤵
- Executes dropped EXE
PID:5968
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{603E4597-9143-4BEC-BC26-86AED03A6939}3⤵
- Executes dropped EXE
PID:6004
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C197545B-D727-4EF5-B3D7-EDD3C41D3BDB}3⤵
- Executes dropped EXE
PID:6036
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{796292B4-EFDE-4316-9170-FEA32F994B6C}3⤵
- Executes dropped EXE
PID:6068
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{22280328-BBB8-4EE3-830F-56D148171D41}3⤵
- Executes dropped EXE
PID:6100
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{360A96F8-FD3B-426D-9D03-F5D2D785CF9A}3⤵
- Executes dropped EXE
PID:2752
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F3DFD57-F6DC-41FF-B7B2-16B303E38FC8}3⤵
- Executes dropped EXE
PID:5172
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4883F462-18B8-4F35-A394-1425735DEEC4}3⤵
- Executes dropped EXE
PID:5224
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16B3DBA0-0057-4AB6-8712-CE87D549DB68}3⤵
- Executes dropped EXE
PID:5188
-
-
C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exeC:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2DF27E29-8975-4AB2-88CA-3391A584221C}3⤵
- Executes dropped EXE
PID:5304
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6316F633-C934-49B8-9C85-F3DC7C93580D}3⤵
- Executes dropped EXE
PID:5252
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8E293AEF-FD5B-4199-BDB5-E0CC5AABD56A}3⤵
- Executes dropped EXE
PID:5276
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{979C624E-D8E0-4C33-9A23-CC37C692A459}3⤵
- Executes dropped EXE
PID:5240
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{11B2A3DA-2762-4AE2-894F-F402D0226BD4}3⤵
- Executes dropped EXE
PID:2864
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{005B88F7-8466-4157-B903-90F888BFF89B}3⤵
- Executes dropped EXE
PID:5328
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D85D5927-7723-4CB7-AC3E-0AF1787CCBEE}3⤵
- Executes dropped EXE
PID:2284
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3F86B016-561B-4F1F-AC93-287E8BC3B64A}3⤵
- Executes dropped EXE
PID:5400
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D23EB0E1-C211-4933-83F6-74AD035DC951}3⤵
- Executes dropped EXE
PID:5928
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E7B2104B-0A1C-4A65-8735-CDD90CCEFD9F}3⤵
- Executes dropped EXE
PID:5420
-
-
C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exeC:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0AED86FD-B30C-4FBF-AA72-95A82D6A1B99}3⤵
- Executes dropped EXE
PID:5536
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5752
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5832
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5956 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"4⤵PID:5972
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"4⤵PID:5724
-
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5300
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A483AB8F-7DFD-43C2-A3FF-F30A6B1AA9E8}3⤵
- Executes dropped EXE
PID:2864
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD413FC2-45AA-4174-BDCB-D9D789EC56B3}3⤵
- Executes dropped EXE
PID:5344
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{73F6A352-4220-4A3B-8720-2AC461DE1D64}3⤵
- Executes dropped EXE
PID:5396
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{57A79368-3344-411C-B4CA-3C63D96DA73A}3⤵
- Executes dropped EXE
PID:388
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3656A32-D5CE-409E-B73B-E98C7DA6FC42}3⤵
- Executes dropped EXE
PID:5412
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BE4924DC-C81A-4671-BC74-F55855C0E9FF}3⤵
- Executes dropped EXE
PID:5496
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F93DD71C-EB61-488F-956F-114A081C7206}3⤵
- Executes dropped EXE
PID:5624
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E81A92AE-8332-452E-B35B-56AFB3B851F8}3⤵
- Executes dropped EXE
PID:6132
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0D201645-9F61-4967-BEF8-BAE65BE2390E}3⤵
- Executes dropped EXE
PID:5316
-
-
C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exeC:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4BA7E7C4-117B-4C24-9ECF-2CBB2C7AAB54}3⤵
- Executes dropped EXE
PID:5800
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5828
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{642A8A30-3EB2-4F85-B7C6-70C1911B73A6}3⤵
- Executes dropped EXE
PID:5952
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9A6B440C-2BFC-4DC7-8E56-5A6A8B96A9A4}3⤵
- Executes dropped EXE
PID:6036
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{99B9642C-ADCB-43AA-8DC7-D1D5A7765F97}3⤵
- Executes dropped EXE
PID:6012
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A76AEDC2-78A7-4C70-A59A-BB86A415CB31}3⤵
- Executes dropped EXE
PID:6096
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A8EAD25-3986-4B1B-BAF5-663FFC43C428}3⤵
- Executes dropped EXE
PID:2148
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{246368D4-9898-4E33-ACEC-6C822A9834C3}3⤵
- Executes dropped EXE
PID:5680
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E76187E-52BC-42E0-8141-AD284E47B3F7}3⤵
- Executes dropped EXE
PID:2468
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1B832F4-98A2-465D-B9A1-1BE36E0A8AF1}3⤵PID:5964
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9E07CEB-ECAD-44DE-A615-897FE1E92A09}3⤵PID:5200
-
-
C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exeC:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3BFBA443-4B62-4B3F-B626-659C31C69A5D}3⤵PID:60
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r3⤵
- System Location Discovery: System Language Discovery
PID:2752
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8754439995CAA62C06DF5FA96C8D587F E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:1480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9865.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687296 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5932
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9950.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687437 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4024
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9BF1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688109 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:684
-
-
C:\Windows\SysWOW64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
PID:5176 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:4644
-
-
-
C:\Windows\SysWOW64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5300 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5932
-
-
-
C:\Windows\syswow64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
PID:3632 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:4556
-
-
-
C:\Windows\syswow64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4644
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIBB1B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240696062 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5832
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u2⤵
- Drops file in System32 directory
PID:1004
-
-
C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="8cee7aec-2b26-4548-a755-f1c6e5af29c8"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1336
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:540
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:2864
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "70f6f91a-bc3d-44c0-82b3-f23d4436c977" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MmQV4IAN2⤵
- Executes dropped EXE
PID:2936
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "ba9ec5d0-3b39-4595-b723-e4a78d0f3031" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MmQV4IAN2⤵
- Executes dropped EXE
PID:3640
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "3a6c5f26-26d2-44dd-8077-9833ad6b1848" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000MmQV4IAN2⤵
- Executes dropped EXE
PID:60
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "400256c1-c0c8-486b-916d-1ea829241a00" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000MmQV4IAN2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus3⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\system32\cscript.execscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus4⤵
- Modifies data under HKEY_USERS
PID:920
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "fd0d2fc5-8ba3-461f-a57a-b800ad270bc8" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\TEMP\SplashtopStreamer.exe"C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\Temp\unpack\PreVerCheck.exe"C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\msiexec.exemsiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"5⤵
- System Location Discovery: System Language Discovery
PID:4472
-
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1477cbef-278f-4dc2-b8b1-feb6a927f90e" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MmQV4IAN2⤵
- Executes dropped EXE
PID:2876
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:3628
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1477cbef-278f-4dc2-b8b1-feb6a927f90e" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MmQV4IAN2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5576
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "2161e564-24fd-4105-88f5-7270b485898f" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MmQV4IAN2⤵PID:5468
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus3⤵PID:2288
-
C:\Windows\system32\cscript.execscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus4⤵
- Modifies data under HKEY_USERS
PID:5312
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "f1ca437a-bc84-43de-b548-0287318e6813" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MmQV4IAN2⤵
- Writes to the Master Boot Record (MBR)
PID:876
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1c158d52-a6aa-424f-837e-01fc6227847a" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
PID:6040
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "ab8957cc-a0e0-4d37-b73e-cff56e0f07bd" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MmQV4IAN2⤵
- Modifies registry class
PID:2240
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "b513d1fe-b8a1-4f6e-b463-4dc4e28359a5" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
PID:5160
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "306bd0ac-c428-47a1-b74b-b3f3b2064b3b" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
PID:1316 -
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart3⤵PID:1420
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "11e99985-4ede-4faf-8590-756c37ffcc96" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
PID:5048
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "ce8138af-602a-4b41-8246-c57f9be53ee2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MmQV4IAN2⤵PID:5496
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1d0c9a67-d4e6-4c73-935c-7448069d9df5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MmQV4IAN2⤵PID:6048
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "a3121720-780e-4d6e-8d4a-e1b1f4e0c64d" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MmQV4IAN2⤵PID:2812
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=67ca63118740b01874ccd117bf2f008a&rmm_session_pwd_ttl=86400"3⤵
- System Location Discovery: System Language Discovery
PID:5488
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1d09fb61-b105-4884-bbb4-9a2c7f24526f" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
PID:5792
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "7e6445b2-1f34-429f-910e-11896d9d1f2f" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
PID:5464
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "69b1bf06-b996-409d-af08-e67c07d1d7f2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
PID:4384 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /3⤵
- System Time Discovery
PID:1544 -
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes4⤵
- System Time Discovery
PID:424
-
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "a7013313-8b36-4257-98a1-48c80b1367ae" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MmQV4IAN2⤵
- Drops file in System32 directory
PID:5252
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5240 -
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"2⤵
- Drops file in System32 directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2864 -
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe-h3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5164
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5804 -
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v4⤵PID:4148
-
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5288
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5924 -
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exeSRUtility.exe -r4⤵
- System Location Discovery: System Language Discovery
PID:6112
-
-
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey4⤵PID:5432
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵PID:2060
-
-
C:\Windows\system32\sc.exesc query ddmgr5⤵
- Launches sc.exe
PID:5068
-
-
C:\Windows\system32\sc.exesc query lci_proxykmd5⤵
- Launches sc.exe
PID:4192
-
-
C:\Windows\system32\rundll32.exerundll32 x64\my_setup.dll do_install_lci_proxywddm5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:852
-
-
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5004 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:2132
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "88b402e7-59cb-4f10-aaaf-01748ea11830" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MmQV4IAN2⤵PID:4252
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus3⤵PID:5296
-
C:\Windows\system32\cscript.execscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus4⤵
- Modifies data under HKEY_USERS
PID:6172
-
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "f54a3c21-cd42-4356-9018-de4d25037e60" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MmQV4IAN2⤵PID:5388
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "84d87fa8-b979-463b-9eac-292daa06899a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MmQV4IAN2⤵PID:5632
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "cea94c6c-e403-4665-b1e4-c1b363f8c3f0" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MmQV4IAN2⤵PID:5612
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "b4c029d4-b0c0-4457-bff2-85f6d30ca72c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MmQV4IAN2⤵PID:4948
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "5cd88882-4ddb-496f-9d41-3ded8c05abae" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MmQV4IAN2⤵PID:3104
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "cb6647fa-11ee-49f7-ac4c-427adb6a6ccc" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MmQV4IAN2⤵PID:6040
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=67ca63118740b01874ccd117bf2f008a&rmm_session_pwd_ttl=86400"3⤵
- System Location Discovery: System Language Discovery
PID:6892
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "0a6a74f9-3466-402f-a4ba-a3b7329d677e" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MmQV4IAN2⤵PID:3292
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "272c4a61-4a74-43dc-a732-48598a6685ab" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MmQV4IAN2⤵PID:6580
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "7615d1a8-b4a2-4c6a-a86d-7d56708214dd" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MmQV4IAN2⤵PID:6632
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /3⤵
- System Time Discovery
PID:5264 -
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes4⤵
- System Time Discovery
PID:6524
-
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "92193504-96c3-45ad-87ce-340be7a62eaa" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MmQV4IAN2⤵
- Modifies data under HKEY_USERS
PID:6752
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "27eac3ad-143c-4971-b511-1485e7ff02f2" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MmQV4IAN2⤵
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:6812
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "815ef568-f4e2-4389-a9cc-23908ec81e31" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MmQV4IAN2⤵PID:6384
-
C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe"C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "b59940ab-7c7f-4a2d-a0ef-51707f450e8f" "815ef568-f4e2-4389-a9cc-23908ec81e31" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000MmQV4IAN"3⤵PID:4304
-
-
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "f54a3c21-cd42-4356-9018-de4d25037e60" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MmQV4IAN2⤵PID:5952
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5428 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5792
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000015C" "WinSta0\Default" "0000000000000174" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4676
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000170"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5152
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3616
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5937a8cff7cd80fe59824c5f8f4b3be0d
SHA131c91a37fba05ff504b92f39d5688e7912149b55
SHA25601c5906c5b2867faa24c377783f21c758cbf11c835f5aac4c2f5633961d62d92
SHA512985c438cf81a62ec2c772a741f6dfc7fb8b957accc24c88865829b76f3cf1d5e344cacdb8b68f37a496671fac49207c8de8e36b14139812f6d9ee6f9aabadfa7
-
Filesize
74KB
MD53201baf0fc8374f4192aba116999d40b
SHA139208ee328da9821fd9b4f5a616b29f62d3e0135
SHA25640f751ae56c94a78ad9220905b644726f18b11dd9d30e20b958824e9ad96c069
SHA512d7a111e7b8c55c587e0ecc30ff97c1d821caaabce97b4db62c4cd41c61f615ff475feb4564c4ae0391c77ef77778c57c2fad46370c1cc38c93aa1321c872c0ce
-
Filesize
464B
MD5ab27c3399573c0f14feddd5c13c5ec15
SHA1fb505486974ba667490101dff4ccb2cea6a4ee25
SHA2569e42d273e03bda876ec8a8af3c27468db647d97a6c7cc297041e2a6a9f62f903
SHA512d0ab96a86c7277522e05ae436f68d0126ce97e835255bd3c5a0438479e6e7ef83e55815c2abf52dc367aab2029ece0f37b3ab3a803a5589aa5efbc32bf76d6c5
-
Filesize
9KB
MD5ac7fbfbb444e6f70c742c7b9a280cd03
SHA10d460e1b8cf9a88b62e83c59a6c5e2dd25b4adaa
SHA2566b243f06390f29e963de8671a6240e8e4c3fbe0b49601b09bdf2b42c9c0c52a9
SHA512874d9aa2ad6ba7b6f3247e1ed3207eb38487daabbe8d312e25c8cdcf71605cefe2fc81025246540d5dc2089540cf1646aafd8230e0a145a8dcdfb95839d3f967
-
Filesize
8KB
MD5de5b2229d0520e58bb5caa42ec642dba
SHA12bfbafe94d59fd41c9736289475f9e3f376c5a68
SHA25682417e10f8362f153334504f92f321d6beb9c678ed0d1c8119863d87ede74209
SHA51298e2e091cc55b2fc7e3b41920267a583f30fe9e37be0b1ec8123e4abed2ed9b3496582b9767937eae67548a8ca1d922ff3eae297dca05899907478ab7486729f
-
Filesize
753B
MD58298451e4dee214334dd2e22b8996bdc
SHA1bc429029cc6b42c59c417773ea5df8ae54dbb971
SHA2566fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25
SHA512cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba
-
Filesize
1KB
MD5337079222a6f6c6edf58f3f981ff20ae
SHA11f705fc0faa84c69e1fe936b34783b301323e255
SHA256ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5
SHA512ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
210KB
MD5c106df1b5b43af3b937ace19d92b42f3
SHA17670fc4b6369e3fb705200050618acaa5213637f
SHA2562b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
SHA512616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
Filesize156KB
MD50b7534a49a757d7525f7fc966d6caf5f
SHA12548a8d4bfe81d194a42a6df1761ab910deccbca
SHA256312755b522a3cb212a2d5e0df2888699c35de233a2dc198c37475e2bf414b0a1
SHA5124d3105e7669093df8364543571d839d0fd573153eed27d82860984797fb30853c3f5fb7707bf97442d4ab71783012fbbb3d9ab1a2d6acbea335f06b756fd4796
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
Filesize51KB
MD53180c705182447f4bcc7ce8e2820b25d
SHA1ad6486557819a33d3f29b18d92b43b11707aae6e
SHA2565b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22
SHA512228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
Filesize12B
MD5dc63026e80d2bb04f71e41916f807e33
SHA16cda386d2c365f94ea3de41e2390fd916622eb51
SHA2563b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85
SHA51261da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
Filesize173KB
MD531def444e6135301ea3c38a985341837
SHA1f135be75c721af2d5291cb463cbc22a32467084a
SHA25636704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571
SHA512bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
Filesize546B
MD5158fb7d9323c6ce69d4fce11486a40a1
SHA129ab26f5728f6ba6f0e5636bf47149bd9851f532
SHA2565e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
SHA5127eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
Filesize688KB
MD5ba66874c510645c1fb5fe74f85b32e98
SHA1e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c
SHA25612d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9
SHA51244e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
Filesize27KB
MD5797c9554ec56fd72ebb3f6f6bef67fb5
SHA140af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb
SHA2567138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49
SHA5124f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
Filesize214KB
MD501807774f043028ec29982a62fa75941
SHA1afc25cf6a7a90f908c0a77f2519744f75b3140d4
SHA2569d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e
SHA51233bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
Filesize37KB
MD5efb4712c8713cb05eb7fe7d87a83a55a
SHA1c94d106bba77aecf88540807da89349b50ea5ae7
SHA25630271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75
SHA5123594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8
-
Filesize
3.4MB
MD5e010d1f614b1a830482d3df4ba056f24
SHA15873e22b8c51a808c06a3bbf425fcf02b2a80328
SHA25698a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b
SHA512727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
Filesize389KB
MD55e3252e0248b484e76fcdbf8b42a645d
SHA111ae92fd16ac87f6ab755911e85e263253c16516
SHA25601f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e
SHA512540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699
-
Filesize
48KB
MD5ed926a42049bf2b31dde86412c31cda7
SHA15dd69f50cd7f41f42d07c76c2ae3ba03f65c1fab
SHA2564fdba92165b4b4301ce5e59f061aa0796e418913981d5cd0685ce67af528bc04
SHA512bc7bf6318b166c2c0851510c743c654898a41a96074397c0b70db7982903962151c28719ff619d32d4ee7f4eaa25a2daf3ce93af09af8de40b67cbdf90bed42b
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
Filesize195KB
MD584cb0cf784734c3ee8c151bc54f77b6e
SHA16f300359be48f38ca18ea54d744566635fd13e6f
SHA256adacab8ac34991a5b4908aafb21a9d0eef3a24b4a44ac6b48a1ac745623eb2a9
SHA5120c628ebab1720a02b2d2dee52c805f17b986f3c46a8c91bac6c67d7a7faf155dcb1c0a46e208d5b1b7d913f26e81b037e2b9e83d25e65c86cbca249b26866e34
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
Filesize55KB
MD5fe9412e42084a3d34a774ef639a21e58
SHA1f5ba2c838358c7a644761488030d16603d08bab0
SHA256b59840da02f870dc5d6d8dfd83e0c5f56c77610f75acfa6dbcede92877fb6447
SHA512b493966084906a75aca175445fbe1f1917922cf7d3c0487d14d3ba48d790250810fd4a35db6de5cb4d23f834341c3fde03d4792efbc73a9a81a3bfbbc8bf7fda
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
Filesize9KB
MD59d1528a2ce17522f6de064ae2c2b608e
SHA12f1ce8b589e57ab300bb93dde176689689f75114
SHA25611c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311
SHA512a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5464.update
Filesize9KB
MD514ffcf07375b3952bd3f2fe52bb63c14
SHA1ab2eadde4c614eb8f1f2cae09d989c5746796166
SHA2566ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed
SHA51214a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
Filesize8KB
MD5f7d366320b5a4045cc13667dfe5e45ab
SHA1c4d0df0a074a2f53b34960c6a3b4b86a74da9118
SHA256e7d5db99cf0ecd0a922dd2ae04e2f9fc1f77817eaa078d74a0d2d82f7a429f64
SHA512cbe832edd71a592020cf7d42b6c0247bd6c6225c92f7762dc2460f04927e5e0124975110efe5f8dfb7f996e93f8b263f2834d65cdc8ab7b683251f9474965904
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
Filesize2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
Filesize54KB
MD577c613ffadf1f4b2f50d31eeec83af30
SHA176a6bfd488e73630632cc7bd0c9f51d5d0b71b4c
SHA2562a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf
SHA51229c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3
-
Filesize
334KB
MD5b3e14504a48bed32c53ec7aab2cb2c8f
SHA10bc0d486a5ed1c4cdf2390229883ed3473926882
SHA256adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b
SHA512e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
Filesize72KB
MD5749c51599fbf82422791e0df1c1e841c
SHA1bba9a471e9300bcd4ebe3359d3f73b53067b781d
SHA256c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6
SHA512f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
Filesize50KB
MD5875fd285089ab5431c460c5d245b934c
SHA1c6a3532f4f68f1a7eb052cf78af795edff455d0c
SHA25630ed5771981efa69ad082e003d9ae90552a9c6d3233707f7ed5f152a1469c9de
SHA512a989fdbbbf74f831bf2dd9a167cb9a274bd8720cfb7aa6bd724bd628080c61e1f869759377825f60283a4e608d1ed31c0e63e484eef9899d5ba0023006b01177
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
Filesize32KB
MD50758b7576e5ec85ed4cbdbc32400024e
SHA1c9ba0d8078212a93a674182a33de792e25fa8a7e
SHA25681c5eebe833cab7b1eec71aefdc06e4d7c187802219f923fc38e98bd5bfeb801
SHA5124cb73d191b645449b91576679c4d544a46a1ff7fa5374f9eab947204d857827ab95c94973c37b8b01368e877f62617489f075fdedf64514d2b881e63f447b7b1
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
Filesize54KB
MD5d11b2139d29e79d795054c3866898b7f
SHA1020581c77ed4bc01c3f3912f304a46c12ca443e6
SHA25611cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566
SHA512de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
215B
MD599d1a707f71da7da64e762fef3a840bd
SHA1b06be509ba314e48abffb3a972a550afd67d7b54
SHA2560aaf98e8b5659705c2bb99b7455b709aa686d1528ed42804d7a9a0a96a463113
SHA512e867f1862feaf2ef4aabf893ada44c0bfc503e0032bf2d089c09fad5dc4524cebede463763a29154c0a998e382cd5c79395cd3d93fa78bcbf717829e02206cb6
-
Filesize
9KB
MD51ef7574bc4d8b6034935d99ad884f15b
SHA1110709ab33f893737f4b0567f9495ac60c37667c
SHA2560814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
SHA512947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73
-
Filesize
10KB
MD5f512536173e386121b3ebd22aac41a4e
SHA174ae133215345beaebb7a95f969f34a40dda922a
SHA256a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
SHA5121efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9
-
Filesize
76KB
MD5b40fe65431b18a52e6452279b88954af
SHA1c25de80f00014e129ff290bf84ddf25a23fdfc30
SHA256800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
SHA512e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d
-
Filesize
80KB
MD53904d0698962e09da946046020cbcb17
SHA1edae098e7e8452ca6c125cf6362dda3f4d78f0ae
SHA256a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
SHA512c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea
-
Filesize
88KB
MD5e3c7bc6c5f870598cd94ae4f0902c086
SHA15c115ec83911cec034ebaf937c98d1b48ab19467
SHA256b8a2acaf7ec828a8c3bf1dd73a3f2ed4091be42e2f178f508731383d077f91c9
SHA512dbbc1933ff4f47f5a094ee6e4003201ecc85bdef5b9a6a5103af998b8893d37c19db52ac0f3213b72ec4ffdc84cfb18eb4b0a2e446df56ad8ca674026b78a718
-
Filesize
433B
MD5cf5f69533151675ab4f248fbc8cdedeb
SHA1eb736e17118ac79e341b49eb29ea04433e65e66f
SHA256e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486
SHA512e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84
-
Filesize
717B
MD5ef0a07aec4367a64c16c581da2657aa9
SHA113011a5abcbadb3424fb6ecee560665556bb1d24
SHA256f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987
SHA51235cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46
-
Filesize
7KB
MD5362ce475f5d1e84641bad999c16727a0
SHA16b613c73acb58d259c6379bd820cca6f785cc812
SHA2561f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
SHA5127630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b
-
Filesize
1.9MB
MD5b110ba42ca8d339b18293ac3f1e94f03
SHA1e21ac41d052159076b34823d2653db0decdf7f8c
SHA256c860712a06a55cdddfed7a9f86f0df36da1e475b9901148d07d5b02331ba0f77
SHA512d81efa032f3ff5edc247440cff1e911a82230b757c02534209fead7ecf630fe5308f9a32a78cc229f175cb447735d539eb61039bfb4ff9f8e77b8dbccda2b0ba
-
Filesize
1.1MB
MD59a9b1fd85b5f1dcd568a521399a0d057
SHA134ed149b290a3a94260d889ba50cb286f1795fa6
SHA25688d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d
SHA5127c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776
-
Filesize
375KB
MD53c93b399b417b0d6a232d386e65a8b46
SHA1bb26deae135f405229d6f76eb6faaeb9a3c45624
SHA25629bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7
SHA512a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149
-
Filesize
321KB
MD5d3901e62166e9c42864fe3062cb4d8d5
SHA1c9c19eec0fa04514f2f8b20f075d8f31b78bae70
SHA256dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c
SHA512ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111
-
Filesize
814KB
MD59b1f97a41bfb95f148868b49460d9d04
SHA1768031d5e877e347a249dfdeab7c725df941324b
SHA25609491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4
SHA5129c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4
-
Filesize
1.2MB
MD5e74d2a16da1ddb7f9c54f72b8a25897c
SHA132379af2dc1c1cb998dc81270b7d6be054f7c1a0
SHA256a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46
SHA51252b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
Filesize11B
MD55eda46a55c61b07029e7202f8cf1781c
SHA1862ee76fc1e20a9cc7bc1920309aa67de42f22d0
SHA25612bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442
SHA5124cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
Filesize12B
MD55796d1f96bb31a9d07f4db8ae9f0ddb3
SHA193012724e6cc0a298838aede678806e6c0c6517d
SHA256a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4
SHA512890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c
-
Filesize
48KB
MD51de36e30b49387d159c9b3a0076997ab
SHA14d189b63c159413715af7cd89fb2e9a7a802090c
SHA25645e4d8ab5922ec210cde416e352de52734e902b14c125056ca64c3439f979990
SHA51211eab8c85ca903216490b645e5f263b64c6031f50183c11f3915b65a507c2245a54024b4313382d5fcc22225ecc56250784e79f6b76695baabfd429d21b8f193
-
Filesize
48KB
MD57fd460b1c7b9f1cb2147a60fb2dc9c21
SHA1cc668900e09db9291c056372e0214dc8f3e9e573
SHA256064b68bb71e48c60275ce08344b3f36662d3411f5c776103d16a3208e938293a
SHA512fe53bf7e97e15b8e01e7a98ebc74a729314ae022366f776bba5c7cc9ebe9555f95d258522933f23c7d5c685c246992ae02f1f25c90f4601d6aaec8cc1386a282
-
Filesize
2.8MB
MD505974ad24d0fc5005fd90ca96941beaa
SHA17ccf99236729a614ca0d15b7e5a18ece0dd14242
SHA25630215a902c746227df0d5fed400eaf74a5c1e827d50eec7c21cd37ea1b299aa5
SHA512c9426d56833d61a1763f93ce5388a4c2b5af3c0ae9a71b200a0a3bab1937381220d9a981077c2bd286a53faebde764ffe1608729e4d3895a69b2318403b89ca9
-
Filesize
2.6MB
MD5b255b465a565130ddd717d87c0429c49
SHA18c1a6c1e2d61a4382e5690d9edab17916b62dbc4
SHA25671aee953e0cad03b838f1929789cf251ae2c2f1a2f7d84e6855866a7096ddf82
SHA51283dbdba4d41b7558d2afbdc6d8d0efbf66ff24d796f56793a9a5d11d82afca4502107f7742931f8c2446183df6e67894fcb2f7d1ae1ea5f93d40d83682c4a83d
-
Filesize
1.1MB
MD56c6f85e896655a6eb726482f04c49086
SHA12e0c55cd4894117428b34d21a1d53738fce4b02c
SHA256e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e
SHA512b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15
-
C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
Filesize541B
MD5d0efb0a6d260dbe5d8c91d94b77d7acd
SHA1e33a8c642d2a4b3af77e0c79671eab5200a45613
SHA2567d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102
SHA512a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c
-
Filesize
12B
MD53d66ae5ed06891e8ce75a39a24070844
SHA1368064119835d4376727a14706c41384446183e8
SHA25673dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176
SHA512c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a
-
Filesize
644KB
MD5842f933bd194a1156d309a8c62e9c187
SHA102d0d6499f8cf39a886376733a0d4de912a8fc1d
SHA256f56ad437aff22da5fc3c1b2cf0ea503929848c959ae162ca25bc5d658a859227
SHA512a33bc0df02c38bb65e3f166044b158534dca30253a0d95c5efb6d747c81808b2dc98488c656e9633716d289eaca883482949384f8f8e16d7a43ba8b74ed39059
-
Filesize
569KB
MD59614d1da18956de06747c03068208d66
SHA1fea2680ddb9e4ceea8489a132df9a1542febfe88
SHA256dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab
SHA512d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d
-
Filesize
16KB
MD5b2e89027a140a89b6e3eb4e504e93d96
SHA1f3b1b34874b73ae3032decb97ef96a53a654228f
SHA2565f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982
SHA51293fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19
-
Filesize
809B
MD58b6737800745d3b99886d013b3392ac3
SHA1bb94da3f294922d9e8d31879f2d145586a182e19
SHA25686f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
SHA512654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df
-
Filesize
12KB
MD587f8f3617cbf0bd91d811e4d9acccc46
SHA1313af95d95f1135c9d6aa11479f36b6a2ee9d346
SHA2563a1f4023dcbe7a2ddf9f4845bbe2efbc4117e7bfdc4afeb9b5dc7fe1815af282
SHA5129c51a04007ba6d636bdd4b8d31e09fb60002108c3b054475eb5cf9141e4f414c6898dcf6675e8c7847277b2e94f908f06f19b13cc87fb80d7067e38700d2d140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5ffbcd1a642773b6966b3fb592a31a060
SHA14f11f9f769868a8cace14d992475bd19b111cd4b
SHA25648d55b5241b0a6fd59a32a49a51b8f853b9acb41e824cf9c32741b785f19dad7
SHA512f837ed9c71b3e453999bf5e962221cc933bce1a5b955d1fce23de627d88ff3f7a5c92c0b0b80b013ac7f00a2380fa2bedb43d89dd214f682b0ea1e2474ca8bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize727B
MD5c09feb246a12b3c371735239b403e286
SHA17cce0dda148b0de1d7acff032e7f8331f2916736
SHA2561883ff514ff8a1002407a2ee3f537d4fdfc6b26a677b10c981e0eef4e4e60be7
SHA512c69e044a8cb4134279ec526ee28fe7bdb85fc4cbd279f9012b46b4d76c0d059478e3e7da3aa1bc5033d65eed7d2841caca589c99f90e08de8eae9d12c4f797ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD55374a99237df7a9042905d7867d9d9de
SHA1b53700bb4068cfefae2b4aff8207ae68e429d9da
SHA256735c4c40a3fcda17583561b6250c49e457428e72befc53f14047d69f931528f6
SHA5129accd40a2a307f51cf290df8b156445f5789fefe7f24d898fc49fd3449db47bd1b60d41cf4358f49725c18328844e7b8ba41606f5fdd8ff418902b486c1000bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD532fce5e2573c9763253deb7a593e7275
SHA1a210ecb18d9e189ecc043e2ec31076dbf947ebeb
SHA2569d1b21be754bc44621b1a4c282d5437a732a7c8cc4a7971dcf77dd7ea3988af5
SHA51287419b0bed40e707a441f3443a820bf497f0f39b69842d45092605397753966adbc30591071fdb277f8ef904f4cfecee735a16297adfe26fda0beccabb73e3fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD5934734b23be44b5628486ee0a0e39461
SHA1d9acc335d4fa79528aa14d13d143208b954448b3
SHA256af8d493f31b6fcae8b6daf0b9c0d8f550cee039413cd181a009e5d6db79c57b7
SHA51256359f69c67cf00c6a9b5d178eb6df8328762cb37cc0c1f8fdbb129420659316f38fa149d81516fa64a2b00afd7464b3b9151c8fd0bf8c7b3d323900da0d3ec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5236609fd4db4ee768e22c00695cb565e
SHA19e264142ac9efd9c3446f93af91e046b43cfcde9
SHA25621c4d8568d4ff67408993320b1f4183361a8acb56b47d1f565b4e71e11e3e7f0
SHA5121cd5b1adf078c9761f532d383b420024be8f20b28931f18f1b9999a38673a67d3db0a83d4ba2721295259087b90cd6b71a1502797f95bab8f8aea0095469f184
-
Filesize
651B
MD59bbfe11735bac43a2ed1be18d0655fe2
SHA161141928bb248fd6e9cd5084a9db05a9b980fb3a
SHA256549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
SHA512a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483
-
Filesize
4.5MB
MD525a0aa722268b17888b4e159a9f82f18
SHA168ccb5adae9095056a9d5592f6a850f30715a86b
SHA25672896d8abeeeb40360596927c0feade8f0bc28f9937d35f646b9ba2a47f1edca
SHA51279a574f95dbb5ff11e35f2938fcd6a9e22a3f1a35d7e032aceb099dd69ad45dcdf006d92aeb7d1086e3d0615241f6669e510d5dee6f7d262e0e3d4179822365d
-
Filesize
60KB
MD5878e361c41c05c0519bfc72c7d6e141c
SHA1432ef61862d3c7a95ab42df36a7caf27d08dc98f
SHA25624de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40
SHA51259a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
2.9MB
MD5a232621b778a64163b77169820ad579e
SHA1252a8e0aa905aa1880161ab53aaeb54e345991a8
SHA2568c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6
SHA512b6df966ed6f9d2e98e09300a01c6bc0e1c8641de3f4f28f462debe619560f002720fdfd5ae4247106e6deda1f67161f8f87c8f6db1ea45d73fa1a6b7a870b929
-
Filesize
12KB
MD58e16d54f986dbe98812fd5ec04d434e8
SHA18bf49fa8e12f801559cc2869365f0b184d7f93fe
SHA2567c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd
SHA512e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029
-
Filesize
2KB
MD50315a579f5afe989154cb7c6a6376b05
SHA1e352ff670358cf71e0194918dfe47981e9ccbb88
SHA256d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d
SHA512c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af
-
Filesize
179KB
MD54dc11547a5fc28ca8f6965fa21573481
SHA1d531b0d8d2f8d49d81a4c17fbaf3bc294845362c
SHA256e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d
SHA512bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6
-
Filesize
135KB
MD567ae7b2c36c9c70086b9d41b4515b0a8
SHA1ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b
SHA25679876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69
SHA5124d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078
-
Filesize
119KB
MD5b9b0e9b4d93b18b99ece31a819d71d00
SHA12be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e
SHA2560f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf
SHA512465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53
-
Filesize
10KB
MD562458e58313475c9a3642a392363e359
SHA1e63a3866f20e8c057933ba75d940e5fd2bf62bc6
SHA25685620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562
SHA51249fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad
-
Filesize
4KB
MD51cec22ca85e1b5a8615774fca59a420b
SHA1049a651751ef38321a1088af6a47c4380f9293fc
SHA25660a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf
SHA5120f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb
-
Filesize
52KB
MD501e8bc64139d6b74467330b11331858d
SHA1b6421a1d92a791b4d4548ab84f7140f4fc4eb829
SHA256148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438
SHA5124099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5
-
Filesize
602B
MD52b103ff9b4f0cce10340fe556d2ea3ff
SHA1da7c4b893512a66d030075e0a9eae46e7856ab84
SHA25684b4852a2333c532e54054aa71da574815ebe095279fbf9824c3fb1bab3128bc
SHA5122d09697fb44d224e422a9486f5955d61a61cd2facd4245278509498102e8e841026af7fc383c85bd8bb902958d87330e5d24ea3991e1231e18ebb225f9f79169
-
Filesize
4KB
MD55d543e584d71819e9a2785bd761e235e
SHA11a7f256615609b555b95ef7cb58e7eacdae44b9b
SHA2569c77c25c6d878da71c9aedd891525787660bba47f667bf4eedf036f9b832c11f
SHA512085bfe9b63c17636ca92e102c17fb3025cd44e3ddd783d2818f812677bfdfb6f0885ab02d36a18d1932b2ad6ba9c5cebc90e3970ab22e1241eeaadf6c583cc2c
-
Filesize
850B
MD56831b35a2eda09ab3b4a1b03ed58c257
SHA19f585ffe527a1daf7b13465f8247671a5e95db27
SHA256d35a519426d384a747227d681f7c9dfd752d4348773f1889cd5aa8a82bc8780b
SHA512c06a77af7a62be232de78f6f1dad56001714bd4f5e6dc79d014b1bf80b01848fb7dfa65f1dc92c5079f3dc94f0167d45ae1d956db7578403973c63713ce971bf
-
Filesize
1KB
MD5b2abc5ffe2b01e3b299f59ccd4fcffb9
SHA1eda141697b7351fec4d12d021c921e08aea442e1
SHA256b77d90f23bb73b0dc94e7548347ae8edb9b5f72b2062782052c1a77fd1369562
SHA512993e3e2e0cfe2e052b06d7e5a3e88b313b351075f7482ae343d6011e895c8164945a6eb449ddb52d129321df9b54c168296205cc8aa4c68019c117c0e0456a24
-
Filesize
2KB
MD5e19ac0e29ec06ba91933f667bb8dd8d5
SHA162c39778f8ddfeafc92abb4e51bcdd7743e177bd
SHA256a45a54354b6241db6ac6340190fa49f3c07691d03b576aac792a757dd3bd86dc
SHA5127f45acf1b97bb2e105b14ea03736329c5a7dcf65bc67988301b279f795fa1b495334d7fb626a532cb66d641263ca657f9c7be65131f065aba50fddc822fed23a
-
Filesize
2KB
MD5668e3c53a691ef481c3bd749012d42ca
SHA1db3b62032f15cbaab7059984525883bfbb5816b7
SHA25604745075b0e25f1a54c7412f271d2853e0923b543053db976bcd3de5f67646d9
SHA5125315a5fd8909ac93ed67eb7afbc417d9a87415a3021c6ff633ef2243a239bbc1a5d016c9876dcf099eca694f50735ba875ded7f37925385c243373a0b4850514
-
Filesize
4KB
MD56663f2e2b7c31bd084c389e56b3cb0dd
SHA185aa4ae21dd0a1178914eb3eec4e871544e8a38b
SHA256e127dc1f58d59a51f53b9fc24096493d341705843eb39a60a1f347d44ff3b99d
SHA512780900bd368406d6f9f6a0c690c0e180c445cc59fa26b1ba749b085c999c6724db3b80bdbaa6647f6fbeab97d5e8f350734acf35d67c57315c145bc9b76c24aa
-
Filesize
2.7MB
MD5df5eb1af99091a902effa52463eda084
SHA1b04578b36490a4ec0092e9a44ae6b2679670450a
SHA25683ef8e362af27279b63ef28379675a087984791e5eaf4a9272a5cb4e52dd059c
SHA512663e11667ec5c6c7969ce61f90d869f3723cbd007236150478ef6dbd861ddc75cf5f96b0345319bd178cd87045daa39a0d6ca4af83cf8dcdb4ebe7462d3eeabd
-
Filesize
571B
MD5de10be3435fbcab7eeccaa67e2431619
SHA17afdb3c4c042692ea3f19f2d2275bada7cacfbfd
SHA256d193eda99410268676293d315164ff29cd263ca0251a0238592a23a9d78476b0
SHA512bda2f23885d4bb07c328622d7f637379f63f08b57eb54c4a665fb56d5f68e61d36ff4b4e3cc2b8b2b3d3c5f2e0d3dbb581770eec4fddf9a8c0f4b6555ad3c1af
-
Filesize
182KB
MD51d4329601bef6492cd3227df5bcd5125
SHA1d03a3c50ba7663b52c13b54b08b9284f40e4f848
SHA256bd703470b2f35e3c4d917d3038bf806fcc7c155142d300806c95500274951efd
SHA512b0cfc1aef000d428d1ff4f2df41539284a048571e26a2c1a217093e593e546f5af79bbc61be8458021a9829a7d79f68cb8728bf942475096b53c81a66094dd7b
-
Filesize
179KB
MD57a1c100df8065815dc34c05abc0c13de
SHA13c23414ae545d2087e5462a8994d2b87d3e6d9e2
SHA256e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed
SHA512bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327
-
Filesize
345KB
MD50376dd5b7e37985ea50e693dc212094c
SHA102859394164c33924907b85ab0aaddc628c31bf1
SHA256c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415
SHA51269d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5
-
Filesize
427KB
MD585315ad538fa5af8162f1cd2fce1c99d
SHA131c177c28a05fa3de5e1f934b96b9d01a8969bba
SHA25670735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7
SHA512877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556
-
Filesize
1.8MB
MD5befe2ef369d12f83c72c5f2f7069dd87
SHA1b89c7f6da1241ed98015dc347e70322832bcbe50
SHA2569652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131
SHA512760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD57f12003d0b00927dd57a80a47eef0977
SHA10dd07d2d8220c192f2427268f7aa9329ba8db0b6
SHA25683b1b9807d662acc4320386493825f37d78c35ae97f66579bf0e0f7b593b6497
SHA5120fe2c75756c1b1dfbc14511c994976b031dd3d0a3c262e6295c3921965034bf6e0326efd750bd5d0a9cba11d54985c75cb658dc28690974d24cec643e60ae330
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5564af0fb304236f9cfef610354dc4f79
SHA19814442285b986b68fb9f63c4d82e2ace0b2127c
SHA2566d8565a9492c009133e03e01ec783153bf5b7ad57186128f4b41c8820d488adc
SHA51231618172e10c9c492a9813e7063e6517e83f9f9f3297ac108b06a3f9d72d46ac08dfa98374f038731cd80c8329a393009c6d46fa809fadd05789aeb73927b6ab
-
Filesize
24.1MB
MD5c4b9e78915c708e2d460b44ea0f08282
SHA1be1746aac0018a2438ccf19d51d3f73272bdecfd
SHA256dfc59be69aad6bbdfca9b5761122e013a4c5a4004b2e3114a708a445c1827350
SHA5124b4e95890347654b1088d87a35980ff0966522ee4d5b42cdb0c80ed856ef353b0ad2d0a236e7963b5ea8166d2856b125288d4cfd17c68b7725e3d06b3c602166
-
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{55288381-2d84-41b1-8d37-6a732a460169}_OnDiskSnapshotProp
Filesize6KB
MD5927d1ba801c7e7496e364ce9b783fe05
SHA1f5fd44fa7da78cc7804e347da640828958cee8c4
SHA256596828f66c1e42863963219e7c5d44dab0c8e2d7ab85b78a53f8423dbef4606d
SHA512841152adaa036c1b701d936549229dd0f121b095a6daa8600fcaddfa080e87e2e6b437e903b3d989e07eca41e5725ec571e2bef7a4a9a56b95ffaba321a2c2b8