ateraagent | 090de75b51dc027660710e168c516fa0507e30fcf98d4ea2790395e9ab5110ab

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

יישום הזמנה מקוונת.msi
Size

2.9MB
MD5

37d7404f46d43eac22991c947cc7b1f0
SHA1

abcc8525564e8264b539d685e826f957c12ef70d
SHA256

06ffaabe4a1829177f078d1e6ad6bbc6af79d16729abcc8a21e4ec854448bb3d
SHA512

17ba13c5306b76f41bf3467dd59d0de54c052789750efcf23f7e674f027fb53ccd1a1e5749be035f9a2c77dc8945ccc24444d20a838055daad611c578828263c
SSDEEP

49152:++1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:++lUlz9FKbsodq0YaH7ZPxMb8tT

Score

10^/10

ateraagent discovery rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x00370000000174a2-397.dat	family_ateraagent

Blocklisted process makes network request 7 IoCs

Processes:

msiexec.exerundll32.exerundll32.exe

flow	pid	Process
3	2400	msiexec.exe
5	2400	msiexec.exe
7	2400	msiexec.exe
11	1280	rundll32.exe
12	1280	rundll32.exe
17	2004	rundll32.exe
19	2004	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 13 IoCs

Processes:

AteraAgent.exeAteraAgent.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

Processes:

msiexec.exeAteraAgent.exeAteraAgent.exe

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState	AteraAgent.exe

Drops file in Windows directory 37 IoCs

Processes:

rundll32.exemsiexec.exerundll32.exeDrvInst.exerundll32.exerundll32.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8F96.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB4BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4BA.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI8C5A.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8F96.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA7AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA393.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA644.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA393.tmp-\System.Management.dll	rundll32.exe
File created	C:\Windows\Installer\f778b9e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f778b9e.ipi	msiexec.exe
File created	C:\Windows\Installer\f778b9d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F96.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA393.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA6C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA393.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8C5A.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8C5A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8F96.tmp	msiexec.exe
File created	C:\Windows\Installer\f778ba0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4BA.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB4BA.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI8F96.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8F96.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f778b9d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4BA.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA393.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA643.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4BA.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8C5A.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8C5A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA393.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe

Executes dropped EXE 2 IoCs

Processes:

AteraAgent.exeAteraAgent.exe

pid	Process
2368	AteraAgent.exe
2404	AteraAgent.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
1848	sc.exe

Loads dropped DLL 35 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exerundll32.exeMsiExec.exerundll32.exe

pid	Process
1348	MsiExec.exe
376	rundll32.exe
376	rundll32.exe
376	rundll32.exe
376	rundll32.exe
376	rundll32.exe
1348	MsiExec.exe
1280	rundll32.exe
1280	rundll32.exe
1280	rundll32.exe
1280	rundll32.exe
1280	rundll32.exe
1280	rundll32.exe
1280	rundll32.exe
1280	rundll32.exe
1280	rundll32.exe
1348	MsiExec.exe
2052	rundll32.exe
2052	rundll32.exe
2052	rundll32.exe
2052	rundll32.exe
2052	rundll32.exe
1348	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
1348	MsiExec.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

TaskKill.exeMsiExec.exeNET.exenet1.exeMsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

TaskKill.exe

pid	Process
2996	TaskKill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeAteraAgent.exeAteraAgent.exemsiexec.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe

Modifies registry class 22 IoCs

Processes:

msiexec.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "יישום הזמנה מקוונת.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";"	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

AteraAgent.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

msiexec.exeAteraAgent.exe

pid	Process
2552	msiexec.exe
2552	msiexec.exe
2404	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exerundll32.exe

description	pid	Process
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeSecurityPrivilege	2552	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe
Token: SeLockMemoryPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeMachineAccountPrivilege	2400	msiexec.exe
Token: SeTcbPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeLoadDriverPrivilege	2400	msiexec.exe
Token: SeSystemProfilePrivilege	2400	msiexec.exe
Token: SeSystemtimePrivilege	2400	msiexec.exe
Token: SeProfSingleProcessPrivilege	2400	msiexec.exe
Token: SeIncBasePriorityPrivilege	2400	msiexec.exe
Token: SeCreatePagefilePrivilege	2400	msiexec.exe
Token: SeCreatePermanentPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeDebugPrivilege	2400	msiexec.exe
Token: SeAuditPrivilege	2400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2400	msiexec.exe
Token: SeChangeNotifyPrivilege	2400	msiexec.exe
Token: SeRemoteShutdownPrivilege	2400	msiexec.exe
Token: SeUndockPrivilege	2400	msiexec.exe
Token: SeSyncAgentPrivilege	2400	msiexec.exe
Token: SeEnableDelegationPrivilege	2400	msiexec.exe
Token: SeManageVolumePrivilege	2400	msiexec.exe
Token: SeImpersonatePrivilege	2400	msiexec.exe
Token: SeCreateGlobalPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	1708	vssvc.exe
Token: SeRestorePrivilege	1708	vssvc.exe
Token: SeAuditPrivilege	1708	vssvc.exe
Token: SeBackupPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2160	DrvInst.exe
Token: SeLoadDriverPrivilege	2160	DrvInst.exe
Token: SeLoadDriverPrivilege	2160	DrvInst.exe
Token: SeLoadDriverPrivilege	2160	DrvInst.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeDebugPrivilege	1280	rundll32.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
2400	msiexec.exe
2400	msiexec.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeNET.exeAteraAgent.exe

description	pid	Process	procid_target
PID 2552 wrote to memory of 1348	2552	msiexec.exe	34
PID 2552 wrote to memory of 1348	2552	msiexec.exe	34
PID 2552 wrote to memory of 1348	2552	msiexec.exe	34
PID 2552 wrote to memory of 1348	2552	msiexec.exe	34
PID 2552 wrote to memory of 1348	2552	msiexec.exe	34
PID 2552 wrote to memory of 1348	2552	msiexec.exe	34
PID 2552 wrote to memory of 1348	2552	msiexec.exe	34
PID 1348 wrote to memory of 376	1348	MsiExec.exe	35
PID 1348 wrote to memory of 376	1348	MsiExec.exe	35
PID 1348 wrote to memory of 376	1348	MsiExec.exe	35
PID 1348 wrote to memory of 376	1348	MsiExec.exe	35
PID 1348 wrote to memory of 376	1348	MsiExec.exe	35
PID 1348 wrote to memory of 376	1348	MsiExec.exe	35
PID 1348 wrote to memory of 376	1348	MsiExec.exe	35
PID 1348 wrote to memory of 1280	1348	MsiExec.exe	36
PID 1348 wrote to memory of 1280	1348	MsiExec.exe	36
PID 1348 wrote to memory of 1280	1348	MsiExec.exe	36
PID 1348 wrote to memory of 1280	1348	MsiExec.exe	36
PID 1348 wrote to memory of 1280	1348	MsiExec.exe	36
PID 1348 wrote to memory of 1280	1348	MsiExec.exe	36
PID 1348 wrote to memory of 1280	1348	MsiExec.exe	36
PID 1348 wrote to memory of 2052	1348	MsiExec.exe	37
PID 1348 wrote to memory of 2052	1348	MsiExec.exe	37
PID 1348 wrote to memory of 2052	1348	MsiExec.exe	37
PID 1348 wrote to memory of 2052	1348	MsiExec.exe	37
PID 1348 wrote to memory of 2052	1348	MsiExec.exe	37
PID 1348 wrote to memory of 2052	1348	MsiExec.exe	37
PID 1348 wrote to memory of 2052	1348	MsiExec.exe	37
PID 2552 wrote to memory of 2920	2552	msiexec.exe	39
PID 2552 wrote to memory of 2920	2552	msiexec.exe	39
PID 2552 wrote to memory of 2920	2552	msiexec.exe	39
PID 2552 wrote to memory of 2920	2552	msiexec.exe	39
PID 2552 wrote to memory of 2920	2552	msiexec.exe	39
PID 2552 wrote to memory of 2920	2552	msiexec.exe	39
PID 2552 wrote to memory of 2920	2552	msiexec.exe	39
PID 2920 wrote to memory of 2588	2920	MsiExec.exe	40
PID 2920 wrote to memory of 2588	2920	MsiExec.exe	40
PID 2920 wrote to memory of 2588	2920	MsiExec.exe	40
PID 2920 wrote to memory of 2588	2920	MsiExec.exe	40
PID 2588 wrote to memory of 2780	2588	NET.exe	42
PID 2588 wrote to memory of 2780	2588	NET.exe	42
PID 2588 wrote to memory of 2780	2588	NET.exe	42
PID 2588 wrote to memory of 2780	2588	NET.exe	42
PID 2920 wrote to memory of 2996	2920	MsiExec.exe	43
PID 2920 wrote to memory of 2996	2920	MsiExec.exe	43
PID 2920 wrote to memory of 2996	2920	MsiExec.exe	43
PID 2920 wrote to memory of 2996	2920	MsiExec.exe	43
PID 2552 wrote to memory of 2368	2552	msiexec.exe	45
PID 2552 wrote to memory of 2368	2552	msiexec.exe	45
PID 2552 wrote to memory of 2368	2552	msiexec.exe	45
PID 2404 wrote to memory of 1848	2404	AteraAgent.exe	47
PID 2404 wrote to memory of 1848	2404	AteraAgent.exe	47
PID 2404 wrote to memory of 1848	2404	AteraAgent.exe	47
PID 1348 wrote to memory of 2004	1348	MsiExec.exe	49
PID 1348 wrote to memory of 2004	1348	MsiExec.exe	49
PID 1348 wrote to memory of 2004	1348	MsiExec.exe	49
PID 1348 wrote to memory of 2004	1348	MsiExec.exe	49
PID 1348 wrote to memory of 2004	1348	MsiExec.exe	49
PID 1348 wrote to memory of 2004	1348	MsiExec.exe	49
PID 1348 wrote to memory of 2004	1348	MsiExec.exe	49

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\יישום הזמנה מקוונת.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2400

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9DDF8D0D42700D7DC544627DE5C03DC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8C5A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259493170 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:376
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8F96.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259493903 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA393.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259498895 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2052
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB4BA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259503295 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DE99F1503DF0EAA898681B434515EBA M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\syswow64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
- - C:\Windows\syswow64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2996
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000O3Ui7IAF" /AgentId="c6d4013d-1f2c-4d28-9abc-87bbd15e99dc"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004BC" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f778b9f.rbs

Filesize
8KB

MD5
5c6f010fcdddce96f8050ed9cbf8540c

SHA1
9263bf549739ccce49cf9ff0a3865518c061f410

SHA256
d920eabd7549574e5c44483b280f7c1416b03f26cdf2e119c4ba639d1218b1b1

SHA512
d8c0b0b2057e00c0502452b63cf3f1a2d7718136929a97e24d59b1dc59d4b565513e5ba633c285350976ab567bc5361667717e52e92a9462e2bc760e09a7f540

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

Filesize
753B

MD5
8298451e4dee214334dd2e22b8996bdc

SHA1
bc429029cc6b42c59c417773ea5df8ae54dbb971

SHA256
6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

SHA512
cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Filesize
142KB

MD5
477293f80461713d51a98a24023d45e8

SHA1
e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

SHA256
a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

SHA512
23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Filesize
1KB

MD5
b3bb71f9bb4de4236c26578a8fae2dcd

SHA1
1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

SHA256
e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

SHA512
fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Filesize
693KB

MD5
2c4d25b7fbd1adfd4471052fa482af72

SHA1
fd6cd773d241b581e3c856f9e6cd06cb31a01407

SHA256
2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

SHA512
f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Filesize
588KB

MD5
17d74c03b6bcbcd88b46fcc58fc79a0d

SHA1
bc0316e11c119806907c058d62513eb8ce32288c

SHA256
13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

SHA512
f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Filesize
217B

MD5
23081513f81a0ea5933fa34fe3cf669b

SHA1
ced1cec1a44beec00c6bf0100c708aff51d06bd2

SHA256
cc01b6f9bf19425d6e1a5d19e6f10ab36cbb8d219c47bb218973ea2fa4612b20

SHA512
7d7b68d38334cf839ec6263bfacb974887f843d38c165bc10537a6808ea145ed0e955b70035b8e1e8d140e24aa4668cf22b63cfc42094ec2a8a16856a6932268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
4302ac33571a665623f83caa83e9d7b7

SHA1
38e4b1f7626af38f558f00b7585a8821a3ef371e

SHA256
85d864fdf43320e3535ad37f3d946a3bd648df66622cbbcb079b976abfa7ff41

SHA512
cc7530d96b6cf2d390a660fccd64170b6a32fb4ed777f3369ef92180abcaabfd94f74ba0ba8730084510fdeb42ded2a9b799d14c787424d3d11d2f2043642c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
727B

MD5
35c4db15ae8134b1a3c98ea826093e05

SHA1
e29e4bc58c86c0afbb1ed0ca27ffeddd5d4e0723

SHA256
881e48818c3b760cd417c3f4bd5c267c882688dd97623c02bb9480468f224a1e

SHA512
7362fb4193aa2c8de0c8f89de8e1ad74fc218b8e82633cfd73d2066659d50ae2e4bed648a9d553a121048e19cb07ce9e222ee22b302b3dc99b56fd7d79cc4b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
2234a2da0c7ba427c516a7ba532be7f4

SHA1
71bbac1f00303abebe6b8ee9f8cb1ec3f72e1e83

SHA256
a7c433170beb0d6d06d2b3e12790688c320e911d1217ec0eb90c6d46a28a5abb

SHA512
fdf3757943c042323652f78bb3135032c7268f61d6ec11317316768cde45527846de1e2c4bdeac2add5ccc8fa1548a8a53c514573eb07637669380e4d493790d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
b7f13dc1818fe477c7a6677e1b927739

SHA1
4d943bacd762efbee504f56eb29a29ade22f8c5b

SHA256
2f7f7c78e992bb96e2cc32a323bc881708e3fa160ff76ddad2703cf6933c9867

SHA512
efa8b3b369a8dbd90b2370552e30ccec2f3dcd7e3dafd89a238ae0a2b3c3d4da93f53701cc74328d816ce4e3a25d6baa1b3e9a377ca75b17565a388096be2039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
404B

MD5
ac4d3be86d673e934cb03c589570ce35

SHA1
daccd59a143dca972d97a4315e6452ddc7531f87

SHA256
c472baa1206d736a0bd93cbba4905faeb46ae89cc6bb407842c04f8db2033ab1

SHA512
e58a47f342303edfe4cd1feb038585f3c2637e2d8b2fc3a4698b6f28a7f456a88f08d074ff9f659edf41eae947d146a210b754ce1f9bbaea2a46c25dd5a4411b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e75fa9c1cf05d053c86634e46f1d4a7a

SHA1
3768c40aad4ef942d9723e27930829a314168560

SHA256
2f0c4a8e9b5f8b26dcba865d73d46b76016e81b81023c70baad8530a3ab1b774

SHA512
218d963d56bbcd556b3d93602ee8c0027ebe8277a7c28b4c89b7bdf5af413a3ab823e53d7bbd07e6ac6a1b9d887edd43fc785bc4be221180d8c7e5e355b4a56d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8df55bbd255b77eda04f4b1b58a1d98

SHA1
884b6c868c7962b7273ea67a84871edb3a6a5b07

SHA256
c029fa1df1332b1114a422740e3b4c07695fd480e0b32a61b2cbc913bd49e340

SHA512
4411458158eb2dc536e19630f6f82ca1da953a35f07807889e9c3e56c71eb269266af4423529176580d2d9c8dcf2f7445072693495a93349779094a2b812f027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
1c25800fa5d5391208174cd7cee4c270

SHA1
e1221d8308a67f7fc4a914d95b688135f074b10a

SHA256
0b04c5cf4e08489d9ebde0568ae4a4092f4e335e98d5f8564fb80d36b2b6677a

SHA512
00a98a2c8193d8757bde18d4ae2f97b4a6fc017cb2b0b66d304003a4b03838ee05fd66e876784a06a29a5a505ac69f8c28c26c6a7152e707907a67a888f0ca7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B6B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C77.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSI8C5A.tmp

Filesize
509KB

MD5
88d29734f37bdcffd202eafcdd082f9d

SHA1
823b40d05a1cab06b857ed87451bf683fdd56a5e

SHA256
87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

SHA512
1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

Download Submit
C:\Windows\Installer\MSI8F96.tmp-\CustomAction.config

Filesize
1KB

MD5
bc17e956cde8dd5425f2b2a68ed919f8

SHA1
5e3736331e9e2f6bf851e3355f31006ccd8caa99

SHA256
e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

SHA512
02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

Download Submit
C:\Windows\Installer\MSIA644.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\f778b9d.msi

Filesize
2.9MB

MD5
37d7404f46d43eac22991c947cc7b1f0

SHA1
abcc8525564e8264b539d685e826f957c12ef70d

SHA256
06ffaabe4a1829177f078d1e6ad6bbc6af79d16729abcc8a21e4ec854448bb3d

SHA512
17ba13c5306b76f41bf3467dd59d0de54c052789750efcf23f7e674f027fb53ccd1a1e5749be035f9a2c77dc8945ccc24444d20a838055daad611c578828263c

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1defc669a446a97c02ae8894cd3705aa

SHA1
a91698ebefc06619421149b2814f39a16a6ef06f

SHA256
9e5a10a21c9a632d8fa4c9e703a13b3d7afcc702ea71f79324405b4f3187b218

SHA512
98993a764f982709cd9184521232bb83c762af6a384ae3bdcedde61938479869e215c6b96da39ba6522a5608de0991462bb4ae0120c1f5779e4edb798869a11d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b9b8eb7232480f7ed348c9251c86fe0

SHA1
d3b27023e8c8c842039cd5d56c4bfdefcc0f449d

SHA256
e5ac676216066069bf3c0a726c9df5f0a341e06e84119980e2ce4fce8f47d77a

SHA512
9a41d28791684f75e22b10dfb579727582e997bf565cc22362b0efbae4345c3d5fcd9759b61397f1c5944068cb20a4b73e275277e434ebe43d5ee3a8e3c79c84

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61469d1cc8ff644865afc1c97713a383

SHA1
e5746ab187edce683ea11061d148a8ee420f331e

SHA256
99e5c91aa5d20ba51ba0bf200013a37537aa3a0e92b500580eec32d3696c2182

SHA512
518f37b05dfe577d049d28a06206b8f4d94edb854d9db026bbe8f940631bdaf14c2a10ac537d381ac516dfb55f4321993d00c39d31d6d2a67271cb01594eaa1e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19f0348477551c4c01ad0eeefd28023a

SHA1
bc01ab8bfff752112c206a2fcbd69c2d61b2a24a

SHA256
a098c1156d9179d34ce0849e718247e1992443508a60c4769b2220764d0998ea

SHA512
303a01bfab088e7adffd48db86af4d07fc5e1001922449143cf94b30fce729f6ff46fbb898d4bda7a10d676e1de7f17b0bd53d17596aeaf32be83a95a02654a2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b31e239dfb212bc6cdc9fa796c09ad

SHA1
af9882114f54cc29569608b7d4ca5476f2d3d687

SHA256
2c5380dabcb97104a365a1f8361ffaa0242eea1f19604806ae59b8d4bf1da0a2

SHA512
d21ae80b9c4c4d5c80ca4e371718da06baea693aa594df1258cdccd17adf6a25287b93ba0716795b888b428dbe00525a1482f4f25707b867d27ff3aad2803401

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec38a78f47e1ab384747196e53c250d9

SHA1
4cab6664dddcbecd8f87ab4c6693114b75f6939b

SHA256
f9659c9aa86f7244c28e48c85bf474c1a82e7a9de4be7a34d26e88c4ce76c2f9

SHA512
f8ba0365673d687ef50877d9aa7007f8119ba76e393fec87b49e306eea11f0134c3360ac5d7fb2299aeb6d7de7d7317d4d441120bae9a65248cbe60948f4e23a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40fd7ee8f5a439f0e75d3faaf086dc16

SHA1
8a37db5694c535d580b3f2034745faf0da5c7cfb

SHA256
e686abdcd20f0e3720de52383aacf6874320c2d4261a769975908769ae2d58f9

SHA512
16a82e4db3d1b74c40f9a81eb8501580eb18a5b83d0f929acf1eee006426230e8488175f12d6a8fb91c3f1616733f016cc401b87ff88070e7754cf23672e8397

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4145b40264a639e53f511d8dfaa0fd43

SHA1
1e4e0df9217ee5d4e095a73ad5e1a125ce65ddd5

SHA256
0bfeb46061969007c976a199533c672d748c2bb626b051ef93698d831058812a

SHA512
d01b56eabb5831def3ab872260d927c2c76ec2b58bc187ef6c4db7fc33c006a08ebb2efbc9ad351ae426c92400014ba21e3822655f9b1ef6d3ca87e93411d827

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d89ddeb791fea47b7770073a666d6e88

SHA1
76eb99fde868d61908e3e52b561a52587c544302

SHA256
1727f98c6c21d4479e34685e160c7dc052235311617fd0934e8819ad0c261cd4

SHA512
b1f21f71a8477ceff753e84665537b33bf63608330ad6e1fbb2465a3d56608281a9f68296bd044f3e114cdba1a7338c3f016eabfbd436d23beee94fbe776f2ea

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fd0821e9447bea24497046bbcf2158c

SHA1
17a57d8841544a6d249764fbc33486f6b6b4833c

SHA256
8b3b2d7854d2f443a5b4aa53d712e96c1081e88c540c3e467e37f1152ccafd95

SHA512
dd88036d2387ac3b19d9c18d26ac92e736c3361cfc99963a8a083124dfd6d9a4b2f61e3dce0f41201e16ea3bd0b840bca8aae3b02d6b6c1bc2b0559cf59363f9

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba6276ab00a980db5de7cd1f2310f8e3

SHA1
e25d3ac265b8beaf3c3c251aae5f5261312c4b90

SHA256
f1a7687b310bd3739a069904a496bcca657623cd7e976381e17b4b4b0b17647e

SHA512
ec2a8200e116f807125226b022c7dcdf71070c520a2923844790171b020ac0f25be89f47ebaea39256b230555ccd605d5988a6a33dad37f5234968757b2a89aa

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4caf01dad3ec14d02fbfa8cf92692ab6

SHA1
130c60a943a0e4248f3a14d73880b5a0a4ebbaa1

SHA256
6c7e158c8c54aa4c031aa3d32f49f492275f732a3aec14246ed374c7e7ed4087

SHA512
3b695ceccab707210715392fe63dac7d2ad338ddd4c39628d80ee5d5f3b89baeb9dc529f6e3806017820e176852aec03121b3f49a9b7344c9cf797a5edaf8a14

Download Submit
C:\Windows\Temp\CabC34F.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarC362.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
\Windows\Installer\MSI8C5A.tmp-\AlphaControlAgentInstallation.dll

Filesize
25KB

MD5
aa1b9c5c685173fad2dabebeb3171f01

SHA1
ed756b1760e563ce888276ff248c734b7dd851fb

SHA256
e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

SHA512
d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

Download Submit
\Windows\Installer\MSI8C5A.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI8F96.tmp-\Newtonsoft.Json.dll

Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
memory/376-72-0x0000000000940000-0x000000000096E000-memory.dmp

Filesize
184KB

Download
memory/376-76-0x00000000008B0000-0x00000000008BC000-memory.dmp

Filesize
48KB

Download
memory/1280-109-0x0000000004980000-0x0000000004A32000-memory.dmp

Filesize
712KB

Download
memory/1280-105-0x0000000000A50000-0x0000000000A5C000-memory.dmp

Filesize
48KB

Download
memory/1280-101-0x00000000009E0000-0x0000000000A0E000-memory.dmp

Filesize
184KB

Download
memory/2004-305-0x0000000000820000-0x000000000084E000-memory.dmp

Filesize
184KB

Download
memory/2004-309-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Filesize
48KB

Download
memory/2004-313-0x00000000047F0000-0x00000000048A2000-memory.dmp

Filesize
712KB

Download
memory/2368-233-0x0000000001150000-0x0000000001178000-memory.dmp

Filesize
160KB

Download
memory/2368-245-0x0000000001070000-0x0000000001108000-memory.dmp

Filesize
608KB

Download
memory/2404-294-0x000000001A540000-0x000000001A5F2000-memory.dmp

Filesize
712KB

Download