Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 13:50
Behavioral task
behavioral1
Sample
setup (1).msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
setup (1).msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
setup (1).msi
-
Size
2.9MB
-
MD5
7f8ef88563fecc928cc24335bbb48ae6
-
SHA1
050fb5d48707f31f48e727deffd17f848b71b1ff
-
SHA256
671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97
-
SHA512
f27a7b1263054f60fa87ce24cadf83d3fd88efddf1ce67d704a77da24310192251dfd13a9f8f8ebc6254ad9749013a8e823d2e4fd0f8dd0065894078649f537a
-
SSDEEP
49152:7+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:7+lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x00070000000193a2-397.dat family_ateraagent -
Blocklisted process makes network request 7 IoCs
Processes:
msiexec.exerundll32.exerundll32.exeflow pid Process 3 1812 msiexec.exe 5 1812 msiexec.exe 7 1812 msiexec.exe 11 2528 rundll32.exe 13 2528 rundll32.exe 19 1684 rundll32.exe 23 1684 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in System32 directory 13 IoCs
Processes:
AteraAgent.exeAteraAgent.exedescription ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416 AteraAgent.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416 AteraAgent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 12 IoCs
Processes:
msiexec.exeAteraAgent.exeAteraAgent.exedescription ioc Process File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState AteraAgent.exe -
Drops file in Windows directory 37 IoCs
Processes:
rundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exeDrvInst.exedescription ioc Process File opened for modification C:\Windows\Installer\MSIF5E7.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\f76e2b2.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF721.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF81E.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76e2b1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE35F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE35F.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE5C0.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF5E7.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI24D.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSIF7B0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI24D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF720.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76e2b2.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIE35F.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE35F.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE35F.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIF5E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF5E7.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI24D.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE5C0.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI24D.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSIE5C0.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIF5E7.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF5E7.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI24D.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI24D.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIE35F.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE5C0.tmp-\Newtonsoft.Json.dll rundll32.exe File created C:\Windows\Installer\f76e2b4.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76e2b1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE5C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE5C0.tmp-\System.Management.dll rundll32.exe -
Executes dropped EXE 2 IoCs
Processes:
AteraAgent.exeAteraAgent.exepid Process 2568 AteraAgent.exe 1468 AteraAgent.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid Process 2220 sc.exe -
Loads dropped DLL 35 IoCs
Processes:
MsiExec.exerundll32.exerundll32.exerundll32.exeMsiExec.exerundll32.exepid Process 1312 MsiExec.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 1312 MsiExec.exe 2528 rundll32.exe 2528 rundll32.exe 2528 rundll32.exe 2528 rundll32.exe 2528 rundll32.exe 2528 rundll32.exe 2528 rundll32.exe 2528 rundll32.exe 2528 rundll32.exe 1312 MsiExec.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1312 MsiExec.exe 320 MsiExec.exe 320 MsiExec.exe 1312 MsiExec.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe 1684 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
net1.exeMsiExec.exerundll32.exeMsiExec.exeNET.exerundll32.exerundll32.exeTaskKill.exerundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Kills process with taskkill 1 IoCs
Processes:
TaskKill.exepid Process 3004 TaskKill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
DrvInst.exeAteraAgent.exeAteraAgent.exemsiexec.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My AteraAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs AteraAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot AteraAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe -
Modifies registry class 22 IoCs
Processes:
msiexec.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "setup (1).msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854 msiexec.exe -
Processes:
AteraAgent.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd AteraAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 AteraAgent.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
msiexec.exeAteraAgent.exepid Process 352 msiexec.exe 352 msiexec.exe 1468 AteraAgent.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exerundll32.exedescription pid Process Token: SeShutdownPrivilege 1812 msiexec.exe Token: SeIncreaseQuotaPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe Token: SeSecurityPrivilege 352 msiexec.exe Token: SeCreateTokenPrivilege 1812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1812 msiexec.exe Token: SeLockMemoryPrivilege 1812 msiexec.exe Token: SeIncreaseQuotaPrivilege 1812 msiexec.exe Token: SeMachineAccountPrivilege 1812 msiexec.exe Token: SeTcbPrivilege 1812 msiexec.exe Token: SeSecurityPrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeLoadDriverPrivilege 1812 msiexec.exe Token: SeSystemProfilePrivilege 1812 msiexec.exe Token: SeSystemtimePrivilege 1812 msiexec.exe Token: SeProfSingleProcessPrivilege 1812 msiexec.exe Token: SeIncBasePriorityPrivilege 1812 msiexec.exe Token: SeCreatePagefilePrivilege 1812 msiexec.exe Token: SeCreatePermanentPrivilege 1812 msiexec.exe Token: SeBackupPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeShutdownPrivilege 1812 msiexec.exe Token: SeDebugPrivilege 1812 msiexec.exe Token: SeAuditPrivilege 1812 msiexec.exe Token: SeSystemEnvironmentPrivilege 1812 msiexec.exe Token: SeChangeNotifyPrivilege 1812 msiexec.exe Token: SeRemoteShutdownPrivilege 1812 msiexec.exe Token: SeUndockPrivilege 1812 msiexec.exe Token: SeSyncAgentPrivilege 1812 msiexec.exe Token: SeEnableDelegationPrivilege 1812 msiexec.exe Token: SeManageVolumePrivilege 1812 msiexec.exe Token: SeImpersonatePrivilege 1812 msiexec.exe Token: SeCreateGlobalPrivilege 1812 msiexec.exe Token: SeBackupPrivilege 2776 vssvc.exe Token: SeRestorePrivilege 2776 vssvc.exe Token: SeAuditPrivilege 2776 vssvc.exe Token: SeBackupPrivilege 352 msiexec.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeLoadDriverPrivilege 2604 DrvInst.exe Token: SeLoadDriverPrivilege 2604 DrvInst.exe Token: SeLoadDriverPrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe Token: SeDebugPrivilege 2528 rundll32.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe Token: SeRestorePrivilege 352 msiexec.exe Token: SeTakeOwnershipPrivilege 352 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 1812 msiexec.exe 1812 msiexec.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
msiexec.exeMsiExec.exeMsiExec.exeNET.exeAteraAgent.exedescription pid Process procid_target PID 352 wrote to memory of 1312 352 msiexec.exe 35 PID 352 wrote to memory of 1312 352 msiexec.exe 35 PID 352 wrote to memory of 1312 352 msiexec.exe 35 PID 352 wrote to memory of 1312 352 msiexec.exe 35 PID 352 wrote to memory of 1312 352 msiexec.exe 35 PID 352 wrote to memory of 1312 352 msiexec.exe 35 PID 352 wrote to memory of 1312 352 msiexec.exe 35 PID 1312 wrote to memory of 2056 1312 MsiExec.exe 36 PID 1312 wrote to memory of 2056 1312 MsiExec.exe 36 PID 1312 wrote to memory of 2056 1312 MsiExec.exe 36 PID 1312 wrote to memory of 2056 1312 MsiExec.exe 36 PID 1312 wrote to memory of 2056 1312 MsiExec.exe 36 PID 1312 wrote to memory of 2056 1312 MsiExec.exe 36 PID 1312 wrote to memory of 2056 1312 MsiExec.exe 36 PID 1312 wrote to memory of 2528 1312 MsiExec.exe 37 PID 1312 wrote to memory of 2528 1312 MsiExec.exe 37 PID 1312 wrote to memory of 2528 1312 MsiExec.exe 37 PID 1312 wrote to memory of 2528 1312 MsiExec.exe 37 PID 1312 wrote to memory of 2528 1312 MsiExec.exe 37 PID 1312 wrote to memory of 2528 1312 MsiExec.exe 37 PID 1312 wrote to memory of 2528 1312 MsiExec.exe 37 PID 1312 wrote to memory of 1352 1312 MsiExec.exe 38 PID 1312 wrote to memory of 1352 1312 MsiExec.exe 38 PID 1312 wrote to memory of 1352 1312 MsiExec.exe 38 PID 1312 wrote to memory of 1352 1312 MsiExec.exe 38 PID 1312 wrote to memory of 1352 1312 MsiExec.exe 38 PID 1312 wrote to memory of 1352 1312 MsiExec.exe 38 PID 1312 wrote to memory of 1352 1312 MsiExec.exe 38 PID 352 wrote to memory of 320 352 msiexec.exe 40 PID 352 wrote to memory of 320 352 msiexec.exe 40 PID 352 wrote to memory of 320 352 msiexec.exe 40 PID 352 wrote to memory of 320 352 msiexec.exe 40 PID 352 wrote to memory of 320 352 msiexec.exe 40 PID 352 wrote to memory of 320 352 msiexec.exe 40 PID 352 wrote to memory of 320 352 msiexec.exe 40 PID 320 wrote to memory of 2148 320 MsiExec.exe 41 PID 320 wrote to memory of 2148 320 MsiExec.exe 41 PID 320 wrote to memory of 2148 320 MsiExec.exe 41 PID 320 wrote to memory of 2148 320 MsiExec.exe 41 PID 2148 wrote to memory of 1660 2148 NET.exe 43 PID 2148 wrote to memory of 1660 2148 NET.exe 43 PID 2148 wrote to memory of 1660 2148 NET.exe 43 PID 2148 wrote to memory of 1660 2148 NET.exe 43 PID 320 wrote to memory of 3004 320 MsiExec.exe 44 PID 320 wrote to memory of 3004 320 MsiExec.exe 44 PID 320 wrote to memory of 3004 320 MsiExec.exe 44 PID 320 wrote to memory of 3004 320 MsiExec.exe 44 PID 352 wrote to memory of 2568 352 msiexec.exe 46 PID 352 wrote to memory of 2568 352 msiexec.exe 46 PID 352 wrote to memory of 2568 352 msiexec.exe 46 PID 1312 wrote to memory of 1684 1312 MsiExec.exe 48 PID 1312 wrote to memory of 1684 1312 MsiExec.exe 48 PID 1312 wrote to memory of 1684 1312 MsiExec.exe 48 PID 1312 wrote to memory of 1684 1312 MsiExec.exe 48 PID 1312 wrote to memory of 1684 1312 MsiExec.exe 48 PID 1312 wrote to memory of 1684 1312 MsiExec.exe 48 PID 1312 wrote to memory of 1684 1312 MsiExec.exe 48 PID 1468 wrote to memory of 2220 1468 AteraAgent.exe 49 PID 1468 wrote to memory of 2220 1468 AteraAgent.exe 49 PID 1468 wrote to memory of 2220 1468 AteraAgent.exe 49 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\setup (1).msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DB3C8E2946A0FCA3F881BBB7C28CDDCF2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE35F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259449880 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2056
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE5C0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259450317 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF5E7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259454435 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1352
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI24D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259457602 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1684
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B1D05ED0AA273324DFD9565971E9F176 M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\syswow64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:1660
-
-
-
C:\Windows\syswow64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3004
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000NOSXQIA5" /AgentId="7a1fd8e0-290d-4622-870b-9bc56097e4ec"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2568
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D4" "0000000000000594"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:2220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5ea0417d393f9561e8221239307a5068e
SHA1aca03bda09a107c1042e172098648f94fd4325bd
SHA256681858b9e648b6c59cbd83d5febf4af4155a559d7d62999eb54dd0767219c17c
SHA5126e677709e6e4dcf5ea1cb5eaa1d0b0f34a84be8786763a33db8957f04ae784b2caa06c17c8803256731df6486a33c555da506c19bfb6c57246fcaa8eaf403094
-
Filesize
753B
MD58298451e4dee214334dd2e22b8996bdc
SHA1bc429029cc6b42c59c417773ea5df8ae54dbb971
SHA2566fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25
SHA512cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
213B
MD51ba4efa2f7e66bd616253f4bb0951e19
SHA106b78f6162c7fa3f095df4694b2f98b2ea521f0f
SHA256a2594ca7050cb1b574e8ef7f761bb8ad71bc3728c078601b195cfb08d93b8fb5
SHA5127fb8649d0f31e701f56578c17c9057a877389cff89681228436b10ac16b4c893205b30d9b6e8b83b39adddb99430e49904ce933e45c51cf0d416b43ed2411f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5fb7d985be173e4bbb25c78d9cc4535e2
SHA1c86cbe3deb55e57c3a9bc81c629c393bb8a9701c
SHA256e9d8f66896d2a23ff7e8afb7d2db5f1a77cbf7de7432b64e94e65efa197dea12
SHA512c2570fde3f7c6a7a6c21b9a9d88f7d3769ade4a6a5edd8f730537700303eb6f82c979baf4741170525067c216dba37cace728967659eba7b73894495ee94d118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize727B
MD54223b22a7e4be6712287c44bd1d05031
SHA1bebab80b8e326c7c6b9654708f0b25c2b4b2f303
SHA256453a5a7deb719b735941357560b3a78c33ae23b90b4c8beb7e9104b5856841d5
SHA51258fcd04822207364db746660d8c2e8064a0679cddd453cde952b4e2976ee912958a267cd7bac9e87acb926df2e6149e277b956be99f4c138c5c97ae3f35f7fab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5c59fe2122c01472472b32153f9357db9
SHA1ffd45432839790442f659390e16b2b4f96c066c5
SHA256fbe269cbc7e81263ef32c8a3b320697dc8d0b9f90d72c13b7e74b482a640b71b
SHA51251ae31fd5603d1b6038a3ed1134143bfb757372b8daf06f471d7ca5e54c4fb2bb27c4b257149861e5e3e841070f7d1bc7488bf3f799ea39c7daa7ec62fe5eb31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD536fe7158da79fa45f1d43848aef80690
SHA1e15fbf1265036060b765c632ed5600becae14352
SHA2569317cba3d1dcfa3f5fbd3671da95734303eba86b70c86386c8f14626af09d71b
SHA5124bd6e60d2ca13ebfe580fc49e06f915c02b18198d893da8d7b0feb0dd2c29309be89ed97c881ab5447ecb9740295b9bc83206209f130b1e63a6895db689653df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD5b978bc4b85a2b225f855cb246e64d6b5
SHA1cc54755c802a38fb2ddef6786b673dce28848e9d
SHA256286d1fc49ae523c768f7d993a4aa1fd7d0c98eef277ce9ddcedba90659cca333
SHA512056998f6109cbdbc195b79c26b2e7af28b492e42e905c03b3ae2d4087993a011d7084f50799193c2661ed9c885e95c3a7eae62498af4fa7a416ca085b3986dcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1a3472c533b1b3fb1f3979c98a695a3
SHA173de81cc62a35c70f596d8549267df35c23a0c5a
SHA2564ec7d03cee0d0415995a0e20b5c1032ca0c074b6970d6395c216e5092c4ecac4
SHA51271221f94efd4c6d5b4ebc69f4ffc4042acd91558fd868b8b101c8a0f26b666fbb50e6c3d98dfb24bafe0812f68e3ef0dd2acf4072fbd7adf465efffd441d7193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ec7c4690cf1212f30cc7f820f889ccb
SHA11fffd0a337d066032861e9a2f724dfeef401c48c
SHA256db61e7d5edffba7a4b645e404ca08e75f7df8075edbd3e01d5406d058f9106c1
SHA51204fc66001a5b4e044707deb179310fcac264e9b9124118087049ea71e7459aa9f3469d778aa56707103b2f1a457338c164fbf40198910c4ae58e849ce32b97dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5aa01388f867786a4db3f7dbee58d3e9d
SHA1f2109f86027065a2ab471862cbb68979df196013
SHA256cb5179b15e82fc2a1730df98fe6ed5942d5c09c59797b1aa03c70389c17587b5
SHA51282b0d0b0524f4b60fe62425399c9b6f542fb603d70e77390a1d98aa4b1512227e19388919ba3481b1264f8d729f8a37fc3d6d588254efae6c94b5b7357329b17
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
2.9MB
MD57f8ef88563fecc928cc24335bbb48ae6
SHA1050fb5d48707f31f48e727deffd17f848b71b1ff
SHA256671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97
SHA512f27a7b1263054f60fa87ce24cadf83d3fd88efddf1ce67d704a77da24310192251dfd13a9f8f8ebc6254ad9749013a8e823d2e4fd0f8dd0065894078649f537a
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c61b5e1e306f892eed1a98891b6aa281
SHA109fdd457ed52401d6421b8df392f0506732d7ea0
SHA2568c2d7a64482b2dd4bd82665d2ba28f2cf363673079c54ad9e8aa83b576d979b1
SHA5125f4c20c0363045e9d91c0bcd121ff64e67dd453cfd645c605e3a38d47f23b62a4a1e854977afb3068ec7d3b70e359a909810bcced9592065c0e4a588c838f72c
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504febb35cfb99eb08a5136fdcbc288df
SHA1f039c3e6ded7bf81ed1612976b84a4335d428268
SHA256eb918b6e71c4f8c8c5a07822c0a3d1402ac4e796f7152f39b126bd0fcb30e635
SHA512575b00b7eca97b621952f1f18644cb0c6b075b44f89afa2f6eee5d944164fa5a348c9d160c2a6201ea378cdb93aad351102f5eb170f1f5ff6f2e911295018c4e
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55baa51f0553c490c0d7682ecc21de822
SHA1afc9616fd091bcd247edc51cbfd9aee817ac4154
SHA2566cdbd5b262faa41aefc87dbd7affed06b2b770fd50aa11764463345edce7c4ba
SHA5124ac4243ed81bff27827751a767459e491529cea9680d4f468b6682d00a1e76914bd526da4487a3c8071573b8e529515da6a82619604e5e55ceccff9263c05042
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f177dd47085c2994e74c68e17a376e77
SHA1ce120cc6d08c7c7ad78aac282f4173d20e77c9c9
SHA25657b2f8e2f9cf57eae309215d97879b43a1eaec8c9f9af9bcdc0ca793e7594ec1
SHA512cfd93cc88096be756ff29edf0fb1f6062313b014a83075098ec185dd5a6df1e89c5cece721513000ab0cc24ec3e4361a03ba8c176209f9f22f4ef9ada4705ae1
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3fec551f6aa58b71803ea868d2c1383
SHA1f38226309615f30bb5e332507a9e5504d9c9e61b
SHA2566e0e11dfa3269525793631aa476e8829dd0cad5cb8d7442473fd8cd3747c6124
SHA512e5838d8b6d8bf4a0da19b7747ff3ed59f194e942a5b1683fdd9ee7f7bc7bbd1db951dad84b1c5785d89fef89074cb381584faa2fe6ad5601d9bce16c1aa50ad2
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a328df5ddde79ee7e3d5a82bdbcdd4fc
SHA10d51895176716a20c42af223f92b169f99101739
SHA25667d4164c7f52e2dd62534ba5b6d1dd2fdb62ba37129d6369c885aef58e30076f
SHA512ea9e5359467a537263b820d8f969511ffb0fcc595bdf4e4fb4dd8d7fc5af03115f689b7a963e0e457422599a8c560cdd90d09f53efdcdb21d59ddbb1f939b182
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b358f3eff8fc8c162b21c77ba28ab0ad
SHA160ec52fc05075ab38478de3a03e475dbe7d45a2b
SHA256e930717c5ac4cfc5b1bf5ea91dc0a3936e2bcca8e4c2bfa34e2509f53174e652
SHA5129e1f8408546f7e7d3480e9509e39d1fd5422d2498c2e8a8dd728b6fefc14dcf3ad12136bb9111c020374dab422a08809648d3e5da2bc72ac9af6c5051336454d
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d8c846b11349e9f2588cdd07d167f23
SHA172289bc35ea88745a03de50d117a69508e56dc4e
SHA2563bd71d49a338fb5631382699ae9b4f8e6900bdc6f65286d1adf6c632a6f18a67
SHA512b60f52418d49afac1aacc45ada7bc98b9e654ec1b68aa449e5bae900caf79f976a1e31fddaa7638ee162c7c9917d066638c2651360e89f7b225eb4f5d593e5b2
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50395acd7cd360e8cdd25a0b1fb18845a
SHA1d2cf416d9a4b309c53246fc67f4f9312094ba8ad
SHA256e2b3d49f7148ec43eb9dfb788b016bd8bb5047efa1f2665538a2891593daf57d
SHA512c7ca771112051b6611667f1876f2150f0743b3a17340a693de826b6450aa7b1f94e88395880e523a5375f7e1c8761d1f0ecf145b6dd2774981534bffe96b9c55
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5937ff0c9ead94b853af62d42ae2e8b2c
SHA12937b5b91081c97895edfc7eca1628a6ebc817b1
SHA25640bfd0165f08afd150e62d4bb3b82cbb8de37fc0ad3c437db8fcd99bcf2e74b4
SHA5127dc243ba8ca486ebf30e1ab7785379c13ffedc4c7b3ffb007a9a8f40a53dbce061e2c6c00dba17100009372f6b74c1f015725f9851959ac19015f5a6c4a687e1
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad