ateraagent | f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72.msi
Size

2.6MB
MD5

055047fe65e1d28dd3bb2e53a9bbcf31
SHA1

126af029786aae23fb19e4ab3b71d50a04880393
SHA256

f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72
SHA512

94da78ac9c85e16e628872ba1d318db1733bb917711836df73b30b5d9825d6f04db5418c094220a20886ecd892e5721238ab47e1ca7b7674c163fa35a91c0ddf
SSDEEP

49152:sBRNlatz55q6jzoz//stPEqQpTIQW8MQ6M97ouRUbFFOV47S9gonUI:MRNlap55qAczWgW9MxcFFOV42+

Score

10^/10

ateraagent discovery persistence privilege_escalation rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow	pid	Process
3	1768	msiexec.exe
5	1768	msiexec.exe
7	1768	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 18 IoCs

Processes:

AteraAgent.exeAteraAgent.exeAgentPackageAgentInformation.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AgentPackageAgentInformation.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

Processes:

msiexec.exeAteraAgent.exeAgentPackageAgentInformation.exeAteraAgent.exe

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt	AgentPackageAgentInformation.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState	AteraAgent.exe

Drops file in Windows directory 15 IoCs

Processes:

DrvInst.exerundll32.exemsiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI59E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\f7704e2.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f7704e1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7704e1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59E.tmp-\AlphaControlAgentInstallationDialog.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI59E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\f7704e2.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12D9.tmp	msiexec.exe
File created	C:\Windows\Installer\f7704e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 3 IoCs

Processes:

AteraAgent.exeAteraAgent.exeAgentPackageAgentInformation.exe

pid	Process
1656	AteraAgent.exe
2284	AteraAgent.exe
2880	AgentPackageAgentInformation.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
2276	sc.exe

Loads dropped DLL 7 IoCs

Processes:

MsiExec.exerundll32.exe

pid	Process
776	MsiExec.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
776	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
1768	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exeMsiExec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

AgentPackageAgentInformation.exeDrvInst.exeAteraAgent.exeAteraAgent.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe

Modifies registry class 22 IoCs

Processes:

msiexec.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\79434ABCE9E7E284E9AA26F75095FF38	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\79434ABCE9E7E284E9AA26F75095FF38\INSTALLFOLDER_files_Feature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\Version = "17301507"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\SourceList\PackageName = "f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\PackageCode = "655C96A5C53078D41AE7A5F332041A28"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\79434ABCE9E7E284E9AA26F75095FF38	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\79434ABCE9E7E284E9AA26F75095FF38\AdvertiseFlags = "388"	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

AteraAgent.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

msiexec.exeAteraAgent.exe

pid	Process
2784	msiexec.exe
2784	msiexec.exe
2284	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	Process
Token: SeShutdownPrivilege	1768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1768	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeCreateTokenPrivilege	1768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1768	msiexec.exe
Token: SeLockMemoryPrivilege	1768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1768	msiexec.exe
Token: SeMachineAccountPrivilege	1768	msiexec.exe
Token: SeTcbPrivilege	1768	msiexec.exe
Token: SeSecurityPrivilege	1768	msiexec.exe
Token: SeTakeOwnershipPrivilege	1768	msiexec.exe
Token: SeLoadDriverPrivilege	1768	msiexec.exe
Token: SeSystemProfilePrivilege	1768	msiexec.exe
Token: SeSystemtimePrivilege	1768	msiexec.exe
Token: SeProfSingleProcessPrivilege	1768	msiexec.exe
Token: SeIncBasePriorityPrivilege	1768	msiexec.exe
Token: SeCreatePagefilePrivilege	1768	msiexec.exe
Token: SeCreatePermanentPrivilege	1768	msiexec.exe
Token: SeBackupPrivilege	1768	msiexec.exe
Token: SeRestorePrivilege	1768	msiexec.exe
Token: SeShutdownPrivilege	1768	msiexec.exe
Token: SeDebugPrivilege	1768	msiexec.exe
Token: SeAuditPrivilege	1768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1768	msiexec.exe
Token: SeChangeNotifyPrivilege	1768	msiexec.exe
Token: SeRemoteShutdownPrivilege	1768	msiexec.exe
Token: SeUndockPrivilege	1768	msiexec.exe
Token: SeSyncAgentPrivilege	1768	msiexec.exe
Token: SeEnableDelegationPrivilege	1768	msiexec.exe
Token: SeManageVolumePrivilege	1768	msiexec.exe
Token: SeImpersonatePrivilege	1768	msiexec.exe
Token: SeCreateGlobalPrivilege	1768	msiexec.exe
Token: SeBackupPrivilege	2832	vssvc.exe
Token: SeRestorePrivilege	2832	vssvc.exe
Token: SeAuditPrivilege	2832	vssvc.exe
Token: SeBackupPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeLoadDriverPrivilege	2508	DrvInst.exe
Token: SeLoadDriverPrivilege	2508	DrvInst.exe
Token: SeLoadDriverPrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
1768	msiexec.exe
1768	msiexec.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

msiexec.exeMsiExec.exeAteraAgent.exe

description	pid	Process	procid_target
PID 2784 wrote to memory of 776	2784	msiexec.exe	35
PID 2784 wrote to memory of 776	2784	msiexec.exe	35
PID 2784 wrote to memory of 776	2784	msiexec.exe	35
PID 2784 wrote to memory of 776	2784	msiexec.exe	35
PID 2784 wrote to memory of 776	2784	msiexec.exe	35
PID 2784 wrote to memory of 776	2784	msiexec.exe	35
PID 2784 wrote to memory of 776	2784	msiexec.exe	35
PID 776 wrote to memory of 1664	776	MsiExec.exe	36
PID 776 wrote to memory of 1664	776	MsiExec.exe	36
PID 776 wrote to memory of 1664	776	MsiExec.exe	36
PID 776 wrote to memory of 1664	776	MsiExec.exe	36
PID 776 wrote to memory of 1664	776	MsiExec.exe	36
PID 776 wrote to memory of 1664	776	MsiExec.exe	36
PID 776 wrote to memory of 1664	776	MsiExec.exe	36
PID 2784 wrote to memory of 1656	2784	msiexec.exe	37
PID 2784 wrote to memory of 1656	2784	msiexec.exe	37
PID 2784 wrote to memory of 1656	2784	msiexec.exe	37
PID 2284 wrote to memory of 2276	2284	AteraAgent.exe	39
PID 2284 wrote to memory of 2276	2284	AteraAgent.exe	39
PID 2284 wrote to memory of 2276	2284	AteraAgent.exe	39
PID 2284 wrote to memory of 2880	2284	AteraAgent.exe	42
PID 2284 wrote to memory of 2880	2284	AteraAgent.exe	42
PID 2284 wrote to memory of 2880	2284	AteraAgent.exe	42

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DC75E4E294691E963B60500DD51DBDC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI59E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259458663 1 AlphaControlAgentInstallationDialog!AlphaControlAgentInstallationDialog.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1664
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="4" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId=""
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000398" "0000000000000060"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:2276
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" bc60a05d-2701-41f3-a793-f607cdfdea4e "a4cc4ebf-995c-4207-9c27-c881dd1c8043" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7704e3.rbs

Filesize
8KB

MD5
6bfc4ce8eb82247eec6d517caf3d8988

SHA1
0b8b2589bcd6dc54743b5669c34b310e16f4b83d

SHA256
8a8bb4f1d1652ac4b8ec66e1b2dd458e2187c4a84c1bc8d97991a6a8c19bcf15

SHA512
fde10fc673a28ef0b6d7acba5297c8b1866ea2ef0998faf922c7153d37bfc79700c2e1714b4fd9d77d1ee197ca847ced5b1973922fb3ab91435c693556222df7

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

Filesize
753B

MD5
8298451e4dee214334dd2e22b8996bdc

SHA1
bc429029cc6b42c59c417773ea5df8ae54dbb971

SHA256
6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

SHA512
cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Filesize
138KB

MD5
8dd350bb44e45c0b89d0c2cea8e1fd9f

SHA1
298ccacd3f218f8d98709a43df09acc82178cbf2

SHA256
127fde9b3c238f66232d0f0db1d3ff62d2c46d16f50aa92073d26977f36f463a

SHA512
ec8c638a8c616c7fa7989585cd5c577c3bff88801789c5b975e016ec888c0d2a1d3f492d12bbb3618ee93c79c80dc1f666ed9e21ffe595dd7b2f3c9f601e03c0

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Filesize
1KB

MD5
b3bb71f9bb4de4236c26578a8fae2dcd

SHA1
1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

SHA256
e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

SHA512
fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

Filesize
209KB

MD5
b322ca965d1571b468b8c49d387d7f84

SHA1
cc1c2fd52c081e36c2b01f05fb2995d0807fcb19

SHA256
e45af7598efae14255851cf7d23c669af1a0e89fffa64e4e12c59960542ad0da

SHA512
50cfb1240491efe00760c37150f2f8a7dc6769f58fbeccc811eea9574917f383c510af3bce181efe7515e417fc211314aad48326a296f6c1093ca23ff76c9318

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Filesize
693KB

MD5
fdde119bd5c37341879e1bd1bfce033a

SHA1
e7228d4dd8a2a0fa7d60f50f68e32560932c3a6a

SHA256
9a7f775a3d2569ee6a830a7814f1b6068613153b14bc5515ea7644dd51e5972e

SHA512
8f91ae407ae1998d86e2edadf9b871e31f8b46b24f7285d17e6f221c33ed19623cbb16f4b73f94dde860dd47ad122f38cba7f5810350b049f79d89c417f53ab8

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI

Filesize
12B

MD5
dc63026e80d2bb04f71e41916f807e33

SHA1
6cda386d2c365f94ea3de41e2390fd916622eb51

SHA256
3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

SHA512
61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Filesize
173KB

MD5
31def444e6135301ea3c38a985341837

SHA1
f135be75c721af2d5291cb463cbc22a32467084a

SHA256
36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

SHA512
bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

Filesize
546B

MD5
158fb7d9323c6ce69d4fce11486a40a1

SHA1
29ab26f5728f6ba6f0e5636bf47149bd9851f532

SHA256
5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

SHA512
7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll

Filesize
94KB

MD5
9d8b5941ea5b905e8197a175ef2b15a9

SHA1
86a078e94b5578ec4125f50f78c8518a8ce1d086

SHA256
c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d

SHA512
fab5fe82873862ce8ed1a427482093cca307f6663e9f6497fdc244ce461312872d419ff274cdca0c496414c28681901f335c9911b95d2a7c112d30e32d74e498

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll

Filesize
688KB

MD5
ba66874c510645c1fb5fe74f85b32e98

SHA1
e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

SHA256
12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

SHA512
44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt

Filesize
23KB

MD5
85c7dfee3ac75319cd3936bffb18ea08

SHA1
fa066643d34ab5a9567de5a40919fe3a8efaa91f

SHA256
1d55b849317752203884ffb445525b0dff6868969313f055b978f2b39a83da4b

SHA512
5371417163b10dd9b61b57414f88ca75746b41748b5a4ceb67e42a7aceca2ab9b68bfaa95e7a6f68371cad947b4f9569b28e5c0e08ec9c91f5b5f9c49ac47425

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Filesize
588KB

MD5
d39533ae3451324100a8be62845799e6

SHA1
31af6d7acac3ff2b67a3b6d5dca6ba22809988d3

SHA256
fa52b413bec029179f4dc476b9198f53d9034b0de59ae2439a8882403b61d07e

SHA512
ce69bde9859ba32aa24b09538e5ccefa8766f2f264bf637fae2d0ec1419e306f767e3343793448d960880c82d328fa6e7b75e14cbc2de3403fb21c80f03318bd

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Filesize
166B

MD5
ddf8ba14ad0d3989f2d2e809ddbc545c

SHA1
7a9abb7e644f41c92d17ab2c2ea419749b0b8eff

SHA256
391b2930dadc06987e7e485f0b0cec5563a95a5d0a25540f467de767a1cd4ad2

SHA512
bfd35a582730be2008ae8dfc5adaa1cc1f272f0e0bb82d38feecda785b5b5d8eb699c8ffc5d5e53ed1797eb9e3ac8612dbabc96bbf696b3f18b5bdd07bd510d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
7795df33fc7dd3aa62e0bc052f9dfbad

SHA1
ea227ec994561b5bce01c5228f9c337286fbec9c

SHA256
6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736

SHA512
de11027f0ca32119ebbb17976ecbe6582ab6af8caa7ce522d75c4185da722550f1f981064db9be6074eb1c6c096c933c2de7ee42b1f31b4fedc9982f87157f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9

Filesize
727B

MD5
fa7db42a9d9f0a91fbfa3719ed26a7a2

SHA1
b902e20b3fa4845a3a253dab7594750514b35f01

SHA256
a8f54cb906b48086ffc06af5009f0df6c1fa7a1495861112a5e11f9e5fada604

SHA512
d214aaa0d654012e5a000b2fd1d770fe92a8540f33978361d0e83f34a3feab7e358ceffbc81378b4c9c73a8cd3dfa7ebb4a1add7811ce26b9afd3214222d1590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
f0339c0506fe0b51215f7227b14e656f

SHA1
cf937eeed1483e23e81244baa03d5e8f112c56d5

SHA256
47bf8749c1ac54c6586d625c99219f03c6a073f3b3f5689444985aae85a3e5b1

SHA512
afb55465411bce78b7453e17aca382e0add24a1b0dd7f116cb077a2641abcbde8684e076d69ca6a3a61a3e47d156f85c80621082ab1a80f4a5b3b1b75f20d5bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
680eadb8ccfbe86fac4ffa4bd3ca9d20

SHA1
08de4a67e6ab4b788c8972b3162f550af796b183

SHA256
2cde88acfbf25fe6b582985404b343b3beb3e08363aa3d08afd024d475087e1c

SHA512
9066688a52b6791b76f5ad5057262b2d467be797f1528e31cd6ad14cc61f045cc8ae94158bb4259ffb99e5189c74049311a9d5cf951d0cc812a5c2bef4140f92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9

Filesize
408B

MD5
ee56baffff0dff7f204360a2ab06a82b

SHA1
279c6ee1582d6bdd569ec8d1e4c7c61c23b8545e

SHA256
6206bcc585bedd0e4cf429fe33649ba21d859e1c950dddd6dc9f7c8851e409d7

SHA512
13d92e4d2c6f62f65f72ca0cf08972a2ae9a7a273a00996e2f5ce56d6dcb2ae004aec361a4f131f4fab746ec95e6985cb58fc9e4665ecfdc62b97b1f41078b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cf21217b912552c17a6ef76c262c36b

SHA1
07860c4b494663ead5457435a3bd06ad09fe8425

SHA256
b72ff82642484b4edcbf41f99bcff41ac9c6ef5793131eba45c8401bef9c6a34

SHA512
523b86c425cca6985b53a06a14cdd83131a10e6e7864c282a17796755da85a93af205f4b1dddce33e140b68fe0f8a31c0c4c30cd4ae01b89e8b801fe6c4cc5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
d0261afd534938ba1d4faaf40eea981e

SHA1
d0e993a652da0b393b03e2c8069883fbf5249f7f

SHA256
318e9d72e928a93de3ba94bb5a2978880daf1374f919212c864945a781705702

SHA512
268b29dda2d24a302715778ffb36a7788bbaa298312862cbb8a75540656f8dd0087b521c40f36843a236790d9bc7c9a52546afdf8e86a26efb24b2e411a908d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDFD6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE0E2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSI12D9.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI59E.tmp

Filesize
245KB

MD5
acf29f18088d57d255b2b5c859e6d844

SHA1
cb0260ff6e7dd2189677d1c2afc9d25cd0c6f208

SHA256
767b905a0af875fde991601e1ea86ce40af300e6054ea719cad02fe72df28fd8

SHA512
29fe0a4159a7aabb7886475824c5b23310863304a315cf59b5d6bf44c0dc2c4df36521c38ff97e5336a8c7dda63a3f1b0405b493985c3ee4f308693bed9f638b

Download Submit
C:\Windows\Installer\f7704e1.msi

Filesize
2.6MB

MD5
055047fe65e1d28dd3bb2e53a9bbcf31

SHA1
126af029786aae23fb19e4ab3b71d50a04880393

SHA256
f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72

SHA512
94da78ac9c85e16e628872ba1d318db1733bb917711836df73b30b5d9825d6f04db5418c094220a20886ecd892e5721238ab47e1ca7b7674c163fa35a91c0ddf

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de5a95eb15e55abda6c32b4532f12d53

SHA1
23fc7c00ef1b1ff6144d559068624aedc6de0673

SHA256
3574bb86ed776531869d140ee9c6bdece2d274f011b8f34b79af43eff4f4f8a7

SHA512
2fa30dce3e772f6249aa58acb793e6f630e9b20e73e07ed8ffaa95834d811a78a15ac5dcc134cccbe199fdc4063369b79c1fcce4485f38e261131b9a0d65d2b0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a00779bec254974ea048034d8eae969

SHA1
396d9faeffc70c0bbef637f43e5e42b63fd71032

SHA256
3a6f7b6d1a0f7efc37a0dd8442150fc1268c79366045bfc9e9008f57b023f118

SHA512
e7a9e411d32b021c5abc884fb4310cad2bded6907204a30e92ebae92e625d270948735de8bb0609b9b3e93f723ecb29f77bb74ae5817d3b6f913fdadd3b2f89b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04dbbd64519771e785f510493923a9b3

SHA1
3f666f0fffd77ff9242c8dbd3fd9c4f962aa1e52

SHA256
63ed6ef757ca4e63e69ae099dc614bb5e675901c8098d189ed024a75a71ea93c

SHA512
76159593ee63ba8e3e08eea2642676bee1d1255af4169c4b13d66b23da47750ae3a8afef042cf249be88073b47436bb90490cffbd84ee4e09496eff89544089f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
944ff1750b872abb0f1e8d1695b89f28

SHA1
2d06fe65458a63a1d9cbc0f7936bb9f91fd89c9d

SHA256
87b1c3dfae86d4cdd73d42bbc2a4f6baf85a1ea555830c725d094860ec61797c

SHA512
2f9b39fc1a36d1054849b6fcc1824dbf4d03324aec1f6f175d62c9eb00f39746ee2178aee706639bd3bfbf8f4e554434db938f2581e34e8e376f8ac55d240dd5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5185fbf27759f8cbe9ef0d50585ed3d

SHA1
1791ec8a9c645cb734b9b0c1379c1e83431ce6ac

SHA256
b7d1dde91bde5ac0de101f629ae87c967aea7b542d8a352453b6545fc3c47158

SHA512
15d91db4cbb7e9853beb820a7368c53a8b1e4bd32b099caf6227c6de95dcd0b07a1dfad132b713d400c45b46e3071f53bc6b3a060c1b0de3809eb2633c0917a2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
545208d399988d2ad9a5c5943bbd3204

SHA1
1d348b303c66f2b3377bf08b66edb7e015c02989

SHA256
47aa21d76ea05f28a75be87c2404ccdd1f088e6f85faecea61224ce7c07f01df

SHA512
187ea5e992a6070c4d87f927c2c6fed14b209d7eb9dcd00e6133c240e48b7e158f8c66fc5f2e080bc9955639821e28c57e1e937fa9819b62cd40564fb21c4504

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c656aebcddec9b407a4c9a3c92e478

SHA1
d4e55cca52a45fe7a997ffec384413b872449e80

SHA256
f226bb53416a0594736bcca54535b694b0475ffec46eed930bc22037a8b0bcd3

SHA512
115857a0bf9e387782b00f1ad920276e1c8c266c23826723d1e2d391ad31de04960c86df18a28d79c2927bb89d146e0ffcd1d638e75ac36d950531b60ab2e0de

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62217d3ab02e6c1028954fffe269df2a

SHA1
cf25b9024d16f9ca2edfeec4945b78f913a27497

SHA256
225901fb370fbad951e56985e824bcd2f28f3456b7cde7d98bbdeae943ec552e

SHA512
446a434d254826f056d7683061b3c91de3b0ad5ad927b685ccdc890de270ddcc9771e84fedc16509977610fc83f5b67f67916589f6a3af6fa44e5ff8dea188e0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baf07fb3a044e15e53549de6f7a6cbb3

SHA1
915376566fa660ba1e9516e68366498b652ddb31

SHA256
35e144b1643c5f8137b56c3b77c6afd38da92fb8f385e79029acedbc0efc4b75

SHA512
26e215ae4ade255d02eda4f42336ca5ebf58921dac7d2e9a2e5bf20f0fd3d17f446c6f21eaa607bb6f1241314cd31018bc6fcc8d4e3332c76d7613a88089e6f4

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fb3d56c63200fb9f52732b5c28970af

SHA1
838071225c5b02fba3a948939a7217443250a872

SHA256
30c6de06b1ffcd58e2d47f9306862c5d329af2bb9db4923643e23d0506b78cfc

SHA512
6068aefd54b8c2ccf7f14889f98b667452bae7b6e53a246d946b625d87f5136c675e94761af84db723a20fe528bf7002c8a63fa0ebf0f5bd6c7b8c9c9af9d4d6

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6316eb7298036cc68618c49d24ae9e2

SHA1
7c7f4238829d161d9cd06980a6a4c1473a7811c4

SHA256
21b4ffd7835943418aabbfe8b1581c291267ab26f0476047a17b05d34c21eb4e

SHA512
7211fd59b7297ea9c0ce3864a907d77e4f1b9d7c06294c9b7565583e7f4c6f84942aaa0eadedc9784836cccdf85dace03a354fc9d582ad7ebf02aeb4c5f7b1f8

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2d409a0fbedee26569b861abb5cc5ad

SHA1
00b2142e60d4ef61dd4d7de9a3ccaa33dac4af22

SHA256
f38087ce287199c8ad8b9cee2c10777cf10b5aa7b1cee6e2e5d952eb88503ae5

SHA512
dd5cd1ee1711bba0e9cb2dc8aa0f369ac66c40d0314d741a1f94dee22d0323622e58330cddbd21de8bf7db136e215a764a2a81647501d2912056e8cfcf129d75

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7aaa3dbc4fa6b50e29575b395643618f

SHA1
0caec724f731b93972da97154ecb54884705f8c4

SHA256
7ad7875dc739574686c4cf752bc6f5f87c686f594a2a5fb4f73f33d71375ebc8

SHA512
4e1715bddff6b30b6c90b804e5e44686352508eb8595d21ce82fa44ee8af9c1ffb5dfa9cdbe93acea37c0acb5a9f1dcce36d096d52ddd6c4e45aa6212ac4aefd

Download Submit
C:\Windows\Temp\Cab24B0.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar24D2.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
583e6728cc652c34c1aea1ec4fbe75e6

SHA1
bf82a87e07548fe3dfcf4e969cb3c2183fbdeaef

SHA256
c5862b36c178d32abea5576d661a29fba5d4a1489a6e4e39f40220986aae94c0

SHA512
f20f3d7fcfe97c0a224a3f04f55b062deafcc75b3bb35af75de7e83794c84e48acfefdb7e507bbd5c42d4ef1562ab00b8adf55a773f744578e390c2409dc999b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e16a3130d39f3de092f8262f83645697

SHA1
6c4f07ecac585a7ebec4afcc466743491f0bdc48

SHA256
ec8ede644387786cba4c6fe0ff4bba2f72baa8bbf27f831e1167de0f6c5f584b

SHA512
73bc3d65c7eda94512e2ee3e91fdb8280f12e0382fb05a300d74989842af4890043dce65c2c59e8dacb1a3908149c2dbae31f12b29d9bf6283be394205e6743f

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7084c766bac4467724ef144d291d9f49

SHA1
f3cf9a26b40f1411744f10fd28b1b2952d1aee2d

SHA256
39ebad708c7f730de2ba7ef4299ffbf021cce8d306bc20a00457a7cdcb0350db

SHA512
66c7d932e7f26c02484c63e0c3af6b9b79e2d461991e0c85201f62203e103742b690b0efe591af672957a9a0ea81ac25569eeb16a0c020896e456ea83d2675b9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4547a5cb72738b6e1ce22346fc4d616

SHA1
c69cb9575925101ef2149263d9666607a9ed3837

SHA256
9048d1005241e7c2c2d95b9616c169e19d2afb2f7a14a5b19bd59f7daf581b9a

SHA512
0914d40beb87135dbf028d08b142bcda5ea7426e1a1ae1bf31e20f6064c40bc337611cef38261d4fb74a2df601f96122b1d9331eb22595b72505fe1956f79335

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75c08a767e354f53defc90163063076c

SHA1
b7607580f616c64cd0ff77739cefc209b502c250

SHA256
a8b5099a2ad1b7b961551e47eef82e08b3fef9f6336293381e0308c41c0a08c5

SHA512
829a2790af11559baf366aebb9e1217344044689ec27e6df3c3ae11fc920bc102e967d189405ecd2d3a74dcfcf89e29d16df6e8c7e4dc0b04689c7a5958880cf

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a297d6b49026eaa008a2608c3a423aaf

SHA1
997884dc7508c00f169e71cf65caf3891e6ab20c

SHA256
cfa8185a552b34fe397ae31c4fdb3784cb13d23b62a403dc079f827ae3e1c959

SHA512
869cae769dd1a407d2905c2c3e6c6f4c424432eebd47cc3f67dde9e24d864dacd7c0880731aa7bed437c27389c30a7ff44b531973d029bbae3ee66c7b8369606

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07295d69a3dabddee7c0e2852820b875

SHA1
634a8786ec161f0df695110f0bfaa29e72e07920

SHA256
4498cae02f98d28e80829a78dc2539e8aa30bf8a623a9507e6fd908ddd500b50

SHA512
559f12defb0aba1d6652812b9add2ddf1b096d34ad10a43ffb8d7fdad7b412c54707a651f426f05d7d6d80344dd03536266d5bc0547efa6042d7d38aff28099d

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2076906e65f01887790649add02b711

SHA1
f38afa3970a304d4bdd78e1bb5d85c1497ca8072

SHA256
ed0874174823a9dcd6c2f4ccb60e3f367358f38679fdb2676993f3a97d3c2107

SHA512
f8af7ff9866799e66e454dffe3ebe7a496cf840d1ebd99979fe8ccd2f81ee8bc36d2fee7f8308890a000af84609f811e46113da43eb9db187287f6775445be78

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
851e34440635304074032d236a6e8035

SHA1
295f0ce6fc6a2f46e0aa0655c7483eee92439d0b

SHA256
36894dd10ed940af35e5701785634142053967c9175275657117ad5ccf53172e

SHA512
87c69b64247218d911dd4986e663f14e325657241613aced61cd9310fe516c2d8027761915cad8d430ded02b54b98f445b0e7159858a04fabfda6eb970c68c64

Download Submit
\Windows\Installer\MSI59E.tmp-\AlphaControlAgentInstallationDialog.dll

Filesize
6KB

MD5
23b4b8d7a19b6de1bf97308c084a31c6

SHA1
cf8ac83896cfc180fe2f1c3d5db67adb25860038

SHA256
5b47208bdd53b9d55efbb807063a783a992fb4aca3b7da15ac64f30930a4cbc0

SHA512
b1ca3006d9aa1c25efbd84eb67d18dd0b88fd23190e296d0b005364223ef057c18d0ae6253d987fbca3e675646654557e897c9a9e5b354fb5b76d42775480830

Download Submit
\Windows\Installer\MSI59E.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
memory/1656-101-0x0000000001390000-0x00000000013B6000-memory.dmp

Filesize
152KB

Download
memory/1656-113-0x0000000001260000-0x00000000012F8000-memory.dmp

Filesize
608KB

Download
memory/1664-70-0x00000000004D0000-0x00000000004FE000-memory.dmp

Filesize
184KB

Download
memory/1664-74-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/2284-159-0x0000000019400000-0x00000000194B2000-memory.dmp

Filesize
712KB

Download
memory/2284-949-0x0000000001330000-0x0000000001368000-memory.dmp

Filesize
224KB

Download
memory/2880-1096-0x0000000000280000-0x000000000029C000-memory.dmp

Filesize
112KB

Download
memory/2880-1085-0x0000000000630000-0x00000000006E0000-memory.dmp

Filesize
704KB

Download
memory/2880-1082-0x00000000003A0000-0x00000000003D0000-memory.dmp

Filesize
192KB

Download