Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 14:06

General

  • Target

    setup1.msi

  • Size

    2.9MB

  • MD5

    7f8ef88563fecc928cc24335bbb48ae6

  • SHA1

    050fb5d48707f31f48e727deffd17f848b71b1ff

  • SHA256

    671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97

  • SHA512

    f27a7b1263054f60fa87ce24cadf83d3fd88efddf1ce67d704a77da24310192251dfd13a9f8f8ebc6254ad9749013a8e823d2e4fd0f8dd0065894078649f537a

  • SSDEEP

    49152:7+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:7+lUlz9FKbsodq0YaH7ZPxMb8tT

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

  • Ateraagent family
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup1.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1476
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2792
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F54B1208E41DDE8D76C905A4F6B8F723
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2288
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC302.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240632875 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:776
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC610.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240633390 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2112
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICA09.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634421 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3960
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID597.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637359 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4324
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 45CB66CE36BF1B8E52ED1D57553027EA E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3324
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3716
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4196
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000NOSXQIA5" /AgentId="afdd92ec-88fc-434b-96b3-7d9d964f4819"
        2⤵
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:4684
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3536
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
      1⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
        2⤵
        • Launches sc.exe
        PID:2136
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" afdd92ec-88fc-434b-96b3-7d9d964f4819 "46993ac3-74df-45b3-ab68-cf5eb76a1fc5" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000NOSXQIA5
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1496
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" afdd92ec-88fc-434b-96b3-7d9d964f4819 "d7914daf-e8ca-4c92-be13-1f41c97558a3" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000NOSXQIA5
        2⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57c276.rbs

      Filesize

      8KB

      MD5

      19dfba1fc6b56b7f14f3e4afd77a4636

      SHA1

      ee2f5b437970a0209114f773cdefb5b9db9ffa6e

      SHA256

      fc052120c8fe2f416e402becb2ab7293581698fdeac7582fa591c30231b4c907

      SHA512

      e48cbf33adc8c3478c23c093195f5220af6806358cb40848f39db00a2b3da9f2344590cc4f0f338ee9ababbb9ce586e9b6d5d383acbd0bf154b850f7500f3fb1

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

      Filesize

      142KB

      MD5

      477293f80461713d51a98a24023d45e8

      SHA1

      e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

      SHA256

      a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

      SHA512

      23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

      Filesize

      1KB

      MD5

      b3bb71f9bb4de4236c26578a8fae2dcd

      SHA1

      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

      SHA256

      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

      SHA512

      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

      Filesize

      210KB

      MD5

      c106df1b5b43af3b937ace19d92b42f3

      SHA1

      7670fc4b6369e3fb705200050618acaa5213637f

      SHA256

      2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

      SHA512

      616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

      Filesize

      693KB

      MD5

      2c4d25b7fbd1adfd4471052fa482af72

      SHA1

      fd6cd773d241b581e3c856f9e6cd06cb31a01407

      SHA256

      2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

      SHA512

      f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI

      Filesize

      12B

      MD5

      eb053699fc80499a7185f6d5f7d55bfe

      SHA1

      9700472d22b1995c320507917fa35088ae4e5f05

      SHA256

      bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

      SHA512

      d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

      Filesize

      173KB

      MD5

      fd9df72620bca7c4d48bc105c89dffd2

      SHA1

      2e537e504704670b52ce775943f14bfbaf175c1b

      SHA256

      847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

      SHA512

      47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

      Filesize

      546B

      MD5

      158fb7d9323c6ce69d4fce11486a40a1

      SHA1

      29ab26f5728f6ba6f0e5636bf47149bd9851f532

      SHA256

      5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

      SHA512

      7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll

      Filesize

      94KB

      MD5

      e2a9291940753244c88cb68d28612996

      SHA1

      bad8529a85c32e5c26c907cfb2fb0da8461407ae

      SHA256

      6565e67d5db582b3de0b266eb59a8acec7cdf9943c020cb6879833d8bd784378

      SHA512

      f07669a3939e3e6b5a4d90c3a5b09ca2448e8e43af23c08f7a8621817a49f7b0f5956d0539333a6df334cc3e517255242e572eaef02a7bbf4bc141a438bf9eb9

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll

      Filesize

      688KB

      MD5

      3ef8d12aa1d48dec3ac19a0ceabd4fd8

      SHA1

      c81b7229a9bd55185a0edccb7e6df3b8e25791cf

      SHA256

      18c1ddbdbf47370cc85fa2cf7ba043711ab3eadbd8da367638686dfd6b735c85

      SHA512

      0ff2e8dbfef7164b22f9ae9865e83154096971c3f0b236d988ab947e803c1ed03d86529ab80d2be9ff33af305d34c9b30082f8c26e575f0979ca9287b415f9f9

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

      Filesize

      588KB

      MD5

      17d74c03b6bcbcd88b46fcc58fc79a0d

      SHA1

      bc0316e11c119806907c058d62513eb8ce32288c

      SHA256

      13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

      SHA512

      f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

      Filesize

      213B

      MD5

      dbf8b1dc65e9c75484326e581cf39f49

      SHA1

      472bfb4d74afc1a89d98b20de842c79d9eaba637

      SHA256

      9566bda5b005b4b5d33983577a21f62b9ec0c1134297df15f793c1d5f47ef917

      SHA512

      3e2731330dba5fe9e57eac917a708c4a78b74b6ee9847bcb234c8deaf69cbd5b8055b307eca8abb04319da9c9cb20872514935b0846c390afc7249cb0be8edef

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

      Filesize

      471B

      MD5

      fb7d985be173e4bbb25c78d9cc4535e2

      SHA1

      c86cbe3deb55e57c3a9bc81c629c393bb8a9701c

      SHA256

      e9d8f66896d2a23ff7e8afb7d2db5f1a77cbf7de7432b64e94e65efa197dea12

      SHA512

      c2570fde3f7c6a7a6c21b9a9d88f7d3769ade4a6a5edd8f730537700303eb6f82c979baf4741170525067c216dba37cace728967659eba7b73894495ee94d118

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

      Filesize

      727B

      MD5

      4223b22a7e4be6712287c44bd1d05031

      SHA1

      bebab80b8e326c7c6b9654708f0b25c2b4b2f303

      SHA256

      453a5a7deb719b735941357560b3a78c33ae23b90b4c8beb7e9104b5856841d5

      SHA512

      58fcd04822207364db746660d8c2e8064a0679cddd453cde952b4e2976ee912958a267cd7bac9e87acb926df2e6149e277b956be99f4c138c5c97ae3f35f7fab

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

      Filesize

      727B

      MD5

      c59fe2122c01472472b32153f9357db9

      SHA1

      ffd45432839790442f659390e16b2b4f96c066c5

      SHA256

      fbe269cbc7e81263ef32c8a3b320697dc8d0b9f90d72c13b7e74b482a640b71b

      SHA512

      51ae31fd5603d1b6038a3ed1134143bfb757372b8daf06f471d7ca5e54c4fb2bb27c4b257149861e5e3e841070f7d1bc7488bf3f799ea39c7daa7ec62fe5eb31

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

      Filesize

      400B

      MD5

      23c27004935b2b635fa48573251677e0

      SHA1

      1d42841f2a7722753a38e5629249736f9bf12598

      SHA256

      fc70620bb80f95007761abfc1701befb9ab1185d666c4b35ef4e6321afd842b9

      SHA512

      65a93e1d2daa9de8bd91d78c83aee39ef849046a05030f4a772321a1bf7f39a8077cb230418479220c6735174566a47f416c467410acda7fd44060b814aecd2f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

      Filesize

      404B

      MD5

      f8241c3ac28571fc57de5c6a1f75a003

      SHA1

      e29cfdaccc2934ebc22b4f1e9ad405e9ee0534b1

      SHA256

      89c92e869d2647c16938dc0fdcdb6952bc1320f85a512684d69696b60d9c6af1

      SHA512

      ada0ad5efaf514074dc7515366e3f388a6944234795d7cad75da95b467c08c06ed6eca17eb86a851db3bd92961d3eabe71b9d6963cf49e16b2a51877c61286c4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

      Filesize

      412B

      MD5

      67f6f4acb985066d9bc1a80a654e5867

      SHA1

      985fc09c5e82950c6f8942f7af682fed671abe07

      SHA256

      60cd3f9a4fc8a017189108c3d36d4ee171136c59100b7b60129ccf38b75c8f01

      SHA512

      788ec31e7fc444ba02af82b5c91c54418211a3fd5851e63727c5136320b8c56f90975cc42a09d60e1c3dd0e8d148634ba623ef3f13ec6d3479c2b7b8be207e49

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

      Filesize

      651B

      MD5

      9bbfe11735bac43a2ed1be18d0655fe2

      SHA1

      61141928bb248fd6e9cd5084a9db05a9b980fb3a

      SHA256

      549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

      SHA512

      a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

    • C:\Windows\Installer\MSIC302.tmp

      Filesize

      509KB

      MD5

      88d29734f37bdcffd202eafcdd082f9d

      SHA1

      823b40d05a1cab06b857ed87451bf683fdd56a5e

      SHA256

      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

      SHA512

      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

    • C:\Windows\Installer\MSIC302.tmp-\AlphaControlAgentInstallation.dll

      Filesize

      25KB

      MD5

      aa1b9c5c685173fad2dabebeb3171f01

      SHA1

      ed756b1760e563ce888276ff248c734b7dd851fb

      SHA256

      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

      SHA512

      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

    • C:\Windows\Installer\MSIC302.tmp-\Microsoft.Deployment.WindowsInstaller.dll

      Filesize

      179KB

      MD5

      1a5caea6734fdd07caa514c3f3fb75da

      SHA1

      f070ac0d91bd337d7952abd1ddf19a737b94510c

      SHA256

      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

      SHA512

      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

    • C:\Windows\Installer\MSIC610.tmp-\CustomAction.config

      Filesize

      1KB

      MD5

      bc17e956cde8dd5425f2b2a68ed919f8

      SHA1

      5e3736331e9e2f6bf851e3355f31006ccd8caa99

      SHA256

      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

      SHA512

      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

    • C:\Windows\Installer\MSIC610.tmp-\Newtonsoft.Json.dll

      Filesize

      695KB

      MD5

      715a1fbee4665e99e859eda667fe8034

      SHA1

      e13c6e4210043c4976dcdc447ea2b32854f70cc6

      SHA256

      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

      SHA512

      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

    • C:\Windows\Installer\MSICBA1.tmp

      Filesize

      211KB

      MD5

      a3ae5d86ecf38db9427359ea37a5f646

      SHA1

      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

      SHA256

      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

      SHA512

      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

    • C:\Windows\Installer\e57c275.msi

      Filesize

      2.9MB

      MD5

      7f8ef88563fecc928cc24335bbb48ae6

      SHA1

      050fb5d48707f31f48e727deffd17f848b71b1ff

      SHA256

      671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97

      SHA512

      f27a7b1263054f60fa87ce24cadf83d3fd88efddf1ce67d704a77da24310192251dfd13a9f8f8ebc6254ad9749013a8e823d2e4fd0f8dd0065894078649f537a

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

      Filesize

      404B

      MD5

      5d74526b6c2d9af3ff273f362a8a3bf5

      SHA1

      f65213233dcf1898bdf3fc8d1655987af80d8092

      SHA256

      912797d674283d9ed2d9ced229bf47c07dafc73b0df23d4429b8d024c1248251

      SHA512

      c753895958699d442f3a278451f042f031592c1b1c1b6f795d34b9232ee903fdf2667e8ae1b699af6e2ca1f17780acfd72d4950b04cfc758987383492079cc0c

    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

      Filesize

      412B

      MD5

      6661964d2bb2efbcbd16a61425f03ab6

      SHA1

      ec724c9d88b0bcecc4fd96992d1db7292f3912a7

      SHA256

      91565733565dacc31c686bf6e91e644b291c0d44ec0ef40ceb48a6188a3be862

      SHA512

      b9de4ef58a353fe84117992a77b07bd6211eda65e4cfe23feda3785d67395a14080f61840bb970c7bc0f0e76255dd1c6ef34cf0c2d75cf76ca5541ece5c70018

    • memory/776-39-0x0000000002B80000-0x0000000002BAE000-memory.dmp

      Filesize

      184KB

    • memory/776-43-0x0000000002BC0000-0x0000000002BCC000-memory.dmp

      Filesize

      48KB

    • memory/1496-275-0x000002139ADE0000-0x000002139AE90000-memory.dmp

      Filesize

      704KB

    • memory/1496-277-0x00000213825B0000-0x00000213825CC000-memory.dmp

      Filesize

      112KB

    • memory/1496-272-0x0000021381C30000-0x0000021381C60000-memory.dmp

      Filesize

      192KB

    • memory/2112-80-0x0000000005050000-0x00000000053A4000-memory.dmp

      Filesize

      3.3MB

    • memory/2112-79-0x0000000004F20000-0x0000000004F42000-memory.dmp

      Filesize

      136KB

    • memory/2112-76-0x0000000004F90000-0x0000000005042000-memory.dmp

      Filesize

      712KB

    • memory/2448-201-0x0000012339070000-0x0000012339092000-memory.dmp

      Filesize

      136KB

    • memory/2448-241-0x0000012339640000-0x0000012339678000-memory.dmp

      Filesize

      224KB

    • memory/2448-195-0x0000012339100000-0x00000123391B2000-memory.dmp

      Filesize

      712KB

    • memory/3960-110-0x00000000047E0000-0x0000000004846000-memory.dmp

      Filesize

      408KB

    • memory/4684-160-0x0000020461EE0000-0x0000020461F78000-memory.dmp

      Filesize

      608KB

    • memory/4684-148-0x0000020447900000-0x0000020447928000-memory.dmp

      Filesize

      160KB

    • memory/4684-165-0x0000020447D70000-0x0000020447DAC000-memory.dmp

      Filesize

      240KB

    • memory/4684-164-0x0000020447D10000-0x0000020447D22000-memory.dmp

      Filesize

      72KB