ateraagent | 671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97.msi
Size

2.9MB
MD5

7f8ef88563fecc928cc24335bbb48ae6
SHA1

050fb5d48707f31f48e727deffd17f848b71b1ff
SHA256

671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97
SHA512

f27a7b1263054f60fa87ce24cadf83d3fd88efddf1ce67d704a77da24310192251dfd13a9f8f8ebc6254ad9749013a8e823d2e4fd0f8dd0065894078649f537a
SSDEEP

49152:7+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:7+lUlz9FKbsodq0YaH7ZPxMb8tT

Score

10^/10

ateraagent discovery persistence privilege_escalation rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000b000000016edb-383.dat	family_ateraagent

Blocklisted process makes network request 7 IoCs

Processes:

msiexec.exerundll32.exerundll32.exe

flow	pid	Process
3	2860	msiexec.exe
5	2860	msiexec.exe
7	2860	msiexec.exe
11	2584	rundll32.exe
13	2584	rundll32.exe
18	780	rundll32.exe
19	780	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 13 IoCs

Processes:

AteraAgent.exeAteraAgent.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

Processes:

msiexec.exeAteraAgent.exeAteraAgent.exe

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	msiexec.exe

Drops file in Windows directory 37 IoCs

Processes:

msiexec.exerundll32.exerundll32.exerundll32.exerundll32.exeDrvInst.exe

description	ioc	Process
File created	C:\Windows\Installer\f76fa27.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE30.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1155.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB13.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF9E.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B0B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFE30.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1145.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B0B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFB13.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFE30.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF9E.tmp-\Newtonsoft.Json.dll	rundll32.exe
File created	C:\Windows\Installer\f76fa2a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B0B.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1B0B.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1B0B.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFB13.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFB13.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1196.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIF9E.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\f76fa27.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB13.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFE30.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFE30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE30.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF9E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\f76fa28.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1223.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76fa28.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B0B.tmp-\CustomAction.config	rundll32.exe

Executes dropped EXE 2 IoCs

Processes:

AteraAgent.exeAteraAgent.exe

pid	Process
1336	AteraAgent.exe
1948	AteraAgent.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
1560	sc.exe

Loads dropped DLL 35 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exerundll32.exeMsiExec.exerundll32.exe

pid	Process
1244	MsiExec.exe
1320	rundll32.exe
1320	rundll32.exe
1320	rundll32.exe
1320	rundll32.exe
1320	rundll32.exe
1244	MsiExec.exe
2584	rundll32.exe
2584	rundll32.exe
2584	rundll32.exe
2584	rundll32.exe
2584	rundll32.exe
2584	rundll32.exe
2584	rundll32.exe
2584	rundll32.exe
2584	rundll32.exe
1244	MsiExec.exe
2948	rundll32.exe
2948	rundll32.exe
2948	rundll32.exe
2948	rundll32.exe
2948	rundll32.exe
1244	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
1244	MsiExec.exe
780	rundll32.exe
780	rundll32.exe
780	rundll32.exe
780	rundll32.exe
780	rundll32.exe
780	rundll32.exe
780	rundll32.exe
780	rundll32.exe
780	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
2860	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exenet1.exeTaskKill.exeNET.exerundll32.exeMsiExec.exerundll32.exerundll32.exerundll32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

TaskKill.exe

pid	Process
1064	TaskKill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeAteraAgent.exeAteraAgent.exemsiexec.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AteraAgent.exe

Modifies registry class 22 IoCs

Processes:

msiexec.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

AteraAgent.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

msiexec.exeAteraAgent.exe

pid	Process
2208	msiexec.exe
2208	msiexec.exe
1948	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exerundll32.exe

description	pid	Process
Token: SeShutdownPrivilege	2860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeSecurityPrivilege	2208	msiexec.exe
Token: SeCreateTokenPrivilege	2860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2860	msiexec.exe
Token: SeLockMemoryPrivilege	2860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2860	msiexec.exe
Token: SeMachineAccountPrivilege	2860	msiexec.exe
Token: SeTcbPrivilege	2860	msiexec.exe
Token: SeSecurityPrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeLoadDriverPrivilege	2860	msiexec.exe
Token: SeSystemProfilePrivilege	2860	msiexec.exe
Token: SeSystemtimePrivilege	2860	msiexec.exe
Token: SeProfSingleProcessPrivilege	2860	msiexec.exe
Token: SeIncBasePriorityPrivilege	2860	msiexec.exe
Token: SeCreatePagefilePrivilege	2860	msiexec.exe
Token: SeCreatePermanentPrivilege	2860	msiexec.exe
Token: SeBackupPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeShutdownPrivilege	2860	msiexec.exe
Token: SeDebugPrivilege	2860	msiexec.exe
Token: SeAuditPrivilege	2860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2860	msiexec.exe
Token: SeChangeNotifyPrivilege	2860	msiexec.exe
Token: SeRemoteShutdownPrivilege	2860	msiexec.exe
Token: SeUndockPrivilege	2860	msiexec.exe
Token: SeSyncAgentPrivilege	2860	msiexec.exe
Token: SeEnableDelegationPrivilege	2860	msiexec.exe
Token: SeManageVolumePrivilege	2860	msiexec.exe
Token: SeImpersonatePrivilege	2860	msiexec.exe
Token: SeCreateGlobalPrivilege	2860	msiexec.exe
Token: SeBackupPrivilege	2888	vssvc.exe
Token: SeRestorePrivilege	2888	vssvc.exe
Token: SeAuditPrivilege	2888	vssvc.exe
Token: SeBackupPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeLoadDriverPrivilege	1096	DrvInst.exe
Token: SeLoadDriverPrivilege	1096	DrvInst.exe
Token: SeLoadDriverPrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeDebugPrivilege	2584	rundll32.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
2860	msiexec.exe
2860	msiexec.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeNET.exeAteraAgent.exe

description	pid	Process	procid_target
PID 2208 wrote to memory of 1244	2208	msiexec.exe	35
PID 2208 wrote to memory of 1244	2208	msiexec.exe	35
PID 2208 wrote to memory of 1244	2208	msiexec.exe	35
PID 2208 wrote to memory of 1244	2208	msiexec.exe	35
PID 2208 wrote to memory of 1244	2208	msiexec.exe	35
PID 2208 wrote to memory of 1244	2208	msiexec.exe	35
PID 2208 wrote to memory of 1244	2208	msiexec.exe	35
PID 1244 wrote to memory of 1320	1244	MsiExec.exe	36
PID 1244 wrote to memory of 1320	1244	MsiExec.exe	36
PID 1244 wrote to memory of 1320	1244	MsiExec.exe	36
PID 1244 wrote to memory of 1320	1244	MsiExec.exe	36
PID 1244 wrote to memory of 1320	1244	MsiExec.exe	36
PID 1244 wrote to memory of 1320	1244	MsiExec.exe	36
PID 1244 wrote to memory of 1320	1244	MsiExec.exe	36
PID 1244 wrote to memory of 2584	1244	MsiExec.exe	37
PID 1244 wrote to memory of 2584	1244	MsiExec.exe	37
PID 1244 wrote to memory of 2584	1244	MsiExec.exe	37
PID 1244 wrote to memory of 2584	1244	MsiExec.exe	37
PID 1244 wrote to memory of 2584	1244	MsiExec.exe	37
PID 1244 wrote to memory of 2584	1244	MsiExec.exe	37
PID 1244 wrote to memory of 2584	1244	MsiExec.exe	37
PID 1244 wrote to memory of 2948	1244	MsiExec.exe	38
PID 1244 wrote to memory of 2948	1244	MsiExec.exe	38
PID 1244 wrote to memory of 2948	1244	MsiExec.exe	38
PID 1244 wrote to memory of 2948	1244	MsiExec.exe	38
PID 1244 wrote to memory of 2948	1244	MsiExec.exe	38
PID 1244 wrote to memory of 2948	1244	MsiExec.exe	38
PID 1244 wrote to memory of 2948	1244	MsiExec.exe	38
PID 2208 wrote to memory of 2836	2208	msiexec.exe	40
PID 2208 wrote to memory of 2836	2208	msiexec.exe	40
PID 2208 wrote to memory of 2836	2208	msiexec.exe	40
PID 2208 wrote to memory of 2836	2208	msiexec.exe	40
PID 2208 wrote to memory of 2836	2208	msiexec.exe	40
PID 2208 wrote to memory of 2836	2208	msiexec.exe	40
PID 2208 wrote to memory of 2836	2208	msiexec.exe	40
PID 2836 wrote to memory of 2984	2836	MsiExec.exe	41
PID 2836 wrote to memory of 2984	2836	MsiExec.exe	41
PID 2836 wrote to memory of 2984	2836	MsiExec.exe	41
PID 2836 wrote to memory of 2984	2836	MsiExec.exe	41
PID 2984 wrote to memory of 2660	2984	NET.exe	43
PID 2984 wrote to memory of 2660	2984	NET.exe	43
PID 2984 wrote to memory of 2660	2984	NET.exe	43
PID 2984 wrote to memory of 2660	2984	NET.exe	43
PID 2836 wrote to memory of 1064	2836	MsiExec.exe	44
PID 2836 wrote to memory of 1064	2836	MsiExec.exe	44
PID 2836 wrote to memory of 1064	2836	MsiExec.exe	44
PID 2836 wrote to memory of 1064	2836	MsiExec.exe	44
PID 2208 wrote to memory of 1336	2208	msiexec.exe	46
PID 2208 wrote to memory of 1336	2208	msiexec.exe	46
PID 2208 wrote to memory of 1336	2208	msiexec.exe	46
PID 1948 wrote to memory of 1560	1948	AteraAgent.exe	48
PID 1948 wrote to memory of 1560	1948	AteraAgent.exe	48
PID 1948 wrote to memory of 1560	1948	AteraAgent.exe	48
PID 1244 wrote to memory of 780	1244	MsiExec.exe	49
PID 1244 wrote to memory of 780	1244	MsiExec.exe	49
PID 1244 wrote to memory of 780	1244	MsiExec.exe	49
PID 1244 wrote to memory of 780	1244	MsiExec.exe	49
PID 1244 wrote to memory of 780	1244	MsiExec.exe	49
PID 1244 wrote to memory of 780	1244	MsiExec.exe	49
PID 1244 wrote to memory of 780	1244	MsiExec.exe	49

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C785C0D0B286769612B7811B5E17B6F5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFB13.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259456011 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1320
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFE30.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259456557 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF9E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259461112 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2948
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1B0B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259463951 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A3DBCEF41718C00381343291A857D952 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\syswow64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      System Location Discovery: System Language Discovery
      PID:2660
- - C:\Windows\syswow64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1064
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000NOSXQIA5" /AgentId="703503df-f41c-466c-8e8c-b7ecc2b03583"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000005D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76fa29.rbs

Filesize
8KB

MD5
2cfef2231c4aa9b5ca1cfbf1cfd402eb

SHA1
f263a2aee4fb094a6ba917ec7de0165c7e0e6510

SHA256
95473e98caac11860f40d7d4bf0a26f8317c2dff421147e576aace94f0be3d1a

SHA512
0977a493b6364d4c20ea33b5d94f78e218ca5a669effccfb9257025335e4fd5dbfa6cc3406c18333cd8738e6f7357a30071fca42398078357e0918bf42090d39

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

Filesize
753B

MD5
8298451e4dee214334dd2e22b8996bdc

SHA1
bc429029cc6b42c59c417773ea5df8ae54dbb971

SHA256
6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

SHA512
cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Filesize
142KB

MD5
477293f80461713d51a98a24023d45e8

SHA1
e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

SHA256
a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

SHA512
23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Filesize
1KB

MD5
b3bb71f9bb4de4236c26578a8fae2dcd

SHA1
1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

SHA256
e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

SHA512
fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Filesize
693KB

MD5
2c4d25b7fbd1adfd4471052fa482af72

SHA1
fd6cd773d241b581e3c856f9e6cd06cb31a01407

SHA256
2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

SHA512
f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Filesize
588KB

MD5
17d74c03b6bcbcd88b46fcc58fc79a0d

SHA1
bc0316e11c119806907c058d62513eb8ce32288c

SHA256
13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

SHA512
f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Filesize
213B

MD5
68fd3d00878c8efc5e7c80ee03eb81f3

SHA1
dbbff6825f2f2546d844b503a85b8f37c5d2de10

SHA256
60a5e325414ed27e51942c589c249dd40ad6f3372ec5586a3a42a817b1d1f334

SHA512
d93506ab5dc47b075eba8b00df5cf63c5dcc09be44db537b2fc4d0bc3d9a8e6f3c6103b878a5588cceaec1474e88f6990835e0f09e58ced89b7d9faede9f49db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
fb7d985be173e4bbb25c78d9cc4535e2

SHA1
c86cbe3deb55e57c3a9bc81c629c393bb8a9701c

SHA256
e9d8f66896d2a23ff7e8afb7d2db5f1a77cbf7de7432b64e94e65efa197dea12

SHA512
c2570fde3f7c6a7a6c21b9a9d88f7d3769ade4a6a5edd8f730537700303eb6f82c979baf4741170525067c216dba37cace728967659eba7b73894495ee94d118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
727B

MD5
8bdebd93ec988865e599b1d688e43076

SHA1
7075487ffb6979163d8597eacb4560b612f36057

SHA256
342601b53dfb59bac280943d1271d1881ff6644a34eebb67d668a7ba98fd6ed6

SHA512
da5788d3a58655597c3f94a67cf159a29a91821af41988e90992046272acdfb941cb4f520024bca31b0683904282b88894926473551164bff5664c1bd5d0b806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
dff1a96bcc8ba610989c3e3aff921023

SHA1
e874669fc49fb9b997c8d03113c32a7962caaecf

SHA256
f4129317fa3fc2b0598795af66060ddfe82abd84e6b00140ad2d9bfe1e2c1b1b

SHA512
c3db712b5c10802316ff3bab988bb8a87f05b87d385b1db25fd7c2bd729f117aa94ef3a205c22e3bc704822895cad09203190c04e734d4633d901f7f2f20809c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
39c3fa1ce5dc4192a317e30e3461f736

SHA1
d8fdddca0213267ff7227cc6a0a0d8e4c8476dfc

SHA256
2836d923c5bd2346c6eadcb208a75ad55c1e1fbb7af23237243680b1777c0e6b

SHA512
f5771e3625cc50371c45d9d73c78875a3f88989769910a64fa21de2e620c2c68760747df2d629524e9ac3bfa845bbbe0a136c83bd2363fd3e4aad76da18c8c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
404B

MD5
73995202b2adabff3e60af7a4c66a468

SHA1
2bb162a641d98fd70a6f17a9d9e47c4865caa58a

SHA256
11bde4f7c3b0960cc29358ee77f81ec95658280b44bfcd3c07b89a88e722677f

SHA512
a3c1eff3827aba071f283b0db1d5bc0654b321e1dfdbb46f42431db0cd64ff1d01551919f09a346d8b3f67ff328316feedb83d68d45e7518f739b88395e0ad0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3dc4d924614cfdbc59f40632a8e9bab

SHA1
b448c187ebd47ac9fed47fc638be1d228762615b

SHA256
cabe2d0ecdd4087b4665f71fc4ff19e7613decbb08614058325cb9aa8b7731c4

SHA512
b7f1030bca8a53c85aaf65b3bd993b8dd736adb753ca88f2080d914546a16ea236208325e2b2234a5e14de47b1408c6ad968190030d84d993000640bd198dd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da6a817cd32a391929bbdd7df2a6c44f

SHA1
6bd5b36cb62bd0a5fd0240c7bdd313f6448e1c30

SHA256
fa4c29911033cfd06f80b45a641db7e3e01db445f4466185e050139e11e785c8

SHA512
19eb79e0d6914f4c868a8636cde11f0be4102f4a82e4f30dd31145b79c07a8e2f6d50cea1a87886608d861345ec7e04d635f72eba85ea58714b61592d796b897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
6b2cf768b0947b5c2428d39c60e9beba

SHA1
725ce20c8f817f1d3061bafd2cb5678bf012991c

SHA256
391475bfccbad755dce74dc4725a49e211bf6e76bccecd3bb084fae2cbfc7faf

SHA512
828702101210eb550c820b0cd6d4245d8880ad5138989138c7477f79e82b34018a7a30939ec6387d3cf6dfb7be15aacccde6115cab94bcaa51bf14a128013d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD6F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE6B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSI1155.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIFB13.tmp

Filesize
509KB

MD5
88d29734f37bdcffd202eafcdd082f9d

SHA1
823b40d05a1cab06b857ed87451bf683fdd56a5e

SHA256
87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

SHA512
1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

Download Submit
C:\Windows\Installer\MSIFE30.tmp-\CustomAction.config

Filesize
1KB

MD5
bc17e956cde8dd5425f2b2a68ed919f8

SHA1
5e3736331e9e2f6bf851e3355f31006ccd8caa99

SHA256
e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

SHA512
02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

Download Submit
C:\Windows\Installer\f76fa27.msi

Filesize
2.9MB

MD5
7f8ef88563fecc928cc24335bbb48ae6

SHA1
050fb5d48707f31f48e727deffd17f848b71b1ff

SHA256
671f3e2880a809c70eb4ba951984f9cf4d52306988ab46af78fcd56879969a97

SHA512
f27a7b1263054f60fa87ce24cadf83d3fd88efddf1ce67d704a77da24310192251dfd13a9f8f8ebc6254ad9749013a8e823d2e4fd0f8dd0065894078649f537a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fa4fbbacd39558b4907eaa2f1f49a23

SHA1
c114a44860013a2924cc68719e03bb59549a97b5

SHA256
9cff8406cc9f853ea962322cebf6690d9e5df32b988a19b3c6eb07c742dc234c

SHA512
e9997f443ef137564fb152c419069ae2e698df7638878a9ccd1d2f83bb0bae723fab2ebb834d1a91bff19b393bcf0ccd3ddb9621aa2fe1058db25d71cbf858ad

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30f5aa7e32dd3e27a39749f7163e6287

SHA1
d3035a18da05a45ed182fcdfa8ea28457d330a75

SHA256
cd08bf2bcf68a633aa909aed6b689024d5f58499b690150b86b568b66e810dce

SHA512
a8c707b993fa9bee17f19a0e11c014dc402085f9a11b73344737d26cd2cbe91ae3a262a18f66476b30c41a2417b1828f0a1e2ec3ac98bffa2d822c1bfdbef032

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50a1e0464c559768ee149a7ede96abc2

SHA1
01b83ac5a5635044de37f5e0d3b4a3ac1e72b878

SHA256
ffd835a1d1631f1754ac9fdcf923cc6557c55a706a609530ee3a577bf9a92609

SHA512
b9799ed3deaab57cd9a80a88e668f402909f58ba955b34e8a6b93332703fa95900388d4c48f43900a862d03cfeeba8f94e4bd766ec1fd2b11b578984ba25471c

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e08ec1d55c362f6ce2d9ec56db9b9288

SHA1
de7d2a84c333e525ab27f79501e2190a2c137a94

SHA256
1409f38c71de1a51dccebffd044abb10969b72856a03661192e54597ca04b566

SHA512
eeb39c3ed8b7ad9a68e7b5a77bb02f1183d633b96008f5ddb9a1656a72cf101af1bc1876d4ee689794b07f4bc84648161ec384659eb4e79f6dfc03811776300b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d8f340ccde36656c99485f0c1a30f06

SHA1
335666ad5d227b553c9e14e33e4f25161c45084a

SHA256
8822745b1f2ac6cc66ae38625ddf716e2f6ab782606c165fffcced85140830c5

SHA512
aa851baa740425072d12c1f24eda083a3618804d9afd80120481f66592b997308275adc8cfb1ed0cfa19c64d7bb248c3c9e9f9edc9bde6f888cab51b63cc81a4

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
967b7464726f31659c01f5151cf201ca

SHA1
441eb5afce4815f4ebb69bc66665c4b56519c8da

SHA256
222830f06632ac8da49501791d6123d2687bffb9171932d32c1a08ad7e339528

SHA512
03fc91cd6ecb9d5511e7bb6ee0857061deade19d358f77948f50eb7a2116fe931c50d3906f9a36a5aa064f1a7d12072e6d4c760f266de06e9ad1940438493b1d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b89cb128f02ca580719eacafe00d189

SHA1
334268e4aa11aba25126b5e38a73d8e6d3ce6f0b

SHA256
5057482667be5b075f39fd614fc6b4533615777ff3a19370616ebe804a8dd011

SHA512
3fff9d9afeb48bd0d4ddbc86df8e3a34a2409014a9fa03c36b3cee2f8f44c19101fd0a9830a3476c6835d34fe8a06888b6a3ac480d64dc824c81c896c46b83f5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6fca158ba2c0d331a8833704ce95ff9

SHA1
7f60f3a1fb394f40c5b31f468d5740f78f6d751f

SHA256
f37e900253ef46053f84129ee66028c7205610463954bdbde28cd780da2f72f3

SHA512
fc91aff11d462ffa39eea8f57cf3123c18d574272b1fc16874210ba4e153f999ea7e5b0f2a5eba12a217e2043f4f6a8b854812e97d1be581ca7822689d56182a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7eaecaf9fa8a2c0a6fcd85f90288f4f

SHA1
5239c27df2571297432db054b26ffd98aec88152

SHA256
0f351a1da6a3123781dfa0c94b748eee0ec4a5b8e72dd24360101d788a92210f

SHA512
b07eb78ba6735a4c11d8b4c40e8b8d378e5b4d1762c3b83891610c351a377abf0f5f3422a06e777778389ee890b011c740816e2b2d4c1247d8000b66cd63d551

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f93627dd339a1cfba3b88353a49798a3

SHA1
845850d73dbfc844476bc6e78648d9f24503ed11

SHA256
4487568db0a28b2fadb022a5b3d05d83b28a44af05ecd003e585b63090b05d3a

SHA512
04d664459fe0f9c974b9081a6756acedb30a072b9cb6203db7d055af4163fdb2a08736a48adcce79291074c33dad4af949909eeb1676cbc7f047fc68f3eba167

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a808323a5bedb7714a7ed94c7130797a

SHA1
6d736fa4a07ef696141c77d4d23c61cae9c9aa77

SHA256
e62aaf3e08452a7d6e2bd492a844233d844424296e79b02bd9634d3c8f206b14

SHA512
8337e5b3179eae7528c11fcc4f219d3db071adb7b9e32561bf5e8e45028911fc0b84420c051ade664e943651d2fc32c3ee31b996ede9055daaeff2e8dd653abf

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
206654e5f230fe32e73ef3297786fc25

SHA1
9d59c4a9273eb5f47a8914d4dee756b6ca39525a

SHA256
70fdbbaf2b9cbac0354764e199a3d06ed3eb49f8ae97d95c9fc99526d90e2ddf

SHA512
4552423191b654d68ef0c740b1d047160771ac42b6afa88a66b02a8ffc8816f119c689365a57805368d53f01d62c0097f8a1e34e8be9ec1a31a0996df82861fa

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
873fb5a25349e1d8af7fb9c613fb8339

SHA1
d5461b72ad7ccba294dd0b8944352a87ad24c363

SHA256
0e3607100004076a5735e6e7b2e2bd47a037a6b5f94b341e75fe036e97dfc6fd

SHA512
96683539c3611379ea7e4f50ec0637ac6d6de1b5be729e158e29b58186cf0a76aff2f272134c8848fb64c62521cddf0a4d000bf3ea9dc385884bab05a58a4047

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d8f0a7bca3434250f08d0a20fd9ba76

SHA1
05559ba29e951791160230a81238a831b3e60043

SHA256
66510d600e4c295dc1c8fb2f46d0ae776001085f7fee0482fd2e7aab988c0f13

SHA512
45d59aae5aed474ef62d10143480940a1d3a8c3a808ae5e091f411faaf362b417d46b99b9ed2204fddc5304e375150d04d88c2c475b463af4b0f0f1592e46c40

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
076783e6820004e40dfbd4aba36beb6c

SHA1
f32027c55693e2192eaf900c90efccda9cbfd61b

SHA256
94ef093db89fc0d23ace9102cca94de6a2ef6e75307b31a8e3f514047754c13f

SHA512
bba091bf2149f1f2df85f3d63f73e11b37289f0c20d1dc24df96a6837b6fcf996ef692f6fb1c99d47f1229c507713492c8cd1b5b6640b7a13136ea2dd8bed9bd

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8430c903aa2ea5bdeb310ee1fd33657

SHA1
3ca7b05d533d580ba0b3481f7e8c46db3c85b2d7

SHA256
fb2c0a2980c195ea362050328e4c7ff965f9ebc8e5bfe90f5fd8089f92d3a14c

SHA512
c7ba4dede7b456ede81d87bc3e8b678b27267c2ec26475594c1a624b9ef4d1218f7ba9b7c0de8787eecd3170250ab627c7b85e132f9517c378de246552156f2d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78eaabd99b8d16874db69e52ba18c8a2

SHA1
72f2a0aa8121afe72b9d450d215445d7e2a101a8

SHA256
8eafadbf24895460850b9d686ff2cf37d139d9a755e99009f0146d7810b10531

SHA512
aa6796119f585a6d3a3752b2f62007b1b09946cfafb5b67ca9efc288fe5ea09599e3bd12cbdd15b00f302ef6463de7053b4f2160788925271b44ceb7784e7da8

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8033b42cedfdf7fc942a956ce50d2956

SHA1
6e21d5f57b6fe52fb835e535d2b12ab9e48c63d7

SHA256
816ad5d3755ba4fa926ee222416dc654aec26416cfb851f7284bf18608bf52ea

SHA512
cffda51d9a81aa2184f786dedbb608ebf76048e84565be4de497410276d351722dfc35b41c71caa01e463c077d0947692cce2ba9b3cc17953dfb1af8b5257510

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81b9ee06bbfd4c4b6d32dd30a2bd08d8

SHA1
3d38ec288989111ca0e75e6eb7d1ca6c9de6c8e1

SHA256
2687e9ee1f91a87a4ac56577d94ad63dd069c7a0ba2cb5662d640ebc68ebc15e

SHA512
07994bad18f44fc0c61240d0f4346d6e1a380e3cce3ecb043abbfa4313428122b8c8a982ea06997ddd516dc7595098a6bdbf00c941df6c7cf906e922fe72783f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c27697fa57267b1f4741cef7fd73003

SHA1
e0e2845bdbc082608adb4d7e2cf4de4ca5c040f3

SHA256
73022660fd5b0282c44bffb886e688a00ae813a69e67ae481fdae56b7bef8cb9

SHA512
6eaf955b47cb76979aa69a4e98a5750fb12c640945cebca2fd08c8e8ae7be1b0dbc4688eacb146aa263e23dd828e3721e91a7b1df9163065b73b578005249ef5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d1875beb9331d6f9ea83858d07e29e61

SHA1
6ef582e24bf3ba3e3f8db427a7e8342c0918522d

SHA256
a6d7fa837dd90e63caf60ebcc9b31f66a5cd0013919807a5c22d5965a72e6c1f

SHA512
c3c600476673824c2413f39e6cc697c716ddead0fa638e6dff634bdaddddba095de9799535ac0284b6e68aafc66108b86bd702c4115477af279600a40c781eaa

Download Submit
C:\Windows\Temp\Cab2990.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar29A3.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
\Windows\Installer\MSIFB13.tmp-\AlphaControlAgentInstallation.dll

Filesize
25KB

MD5
aa1b9c5c685173fad2dabebeb3171f01

SHA1
ed756b1760e563ce888276ff248c734b7dd851fb

SHA256
e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

SHA512
d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

Download Submit
\Windows\Installer\MSIFB13.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSIFE30.tmp-\Newtonsoft.Json.dll

Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
memory/780-313-0x0000000004870000-0x0000000004922000-memory.dmp

Filesize
712KB

Download
memory/780-305-0x0000000000480000-0x00000000004AE000-memory.dmp

Filesize
184KB

Download
memory/780-309-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/1320-76-0x0000000000830000-0x000000000083C000-memory.dmp

Filesize
48KB

Download
memory/1320-72-0x00000000007D0000-0x00000000007FE000-memory.dmp

Filesize
184KB

Download
memory/1336-245-0x00000000020C0000-0x0000000002158000-memory.dmp

Filesize
608KB

Download
memory/1336-233-0x0000000000A80000-0x0000000000AA8000-memory.dmp

Filesize
160KB

Download
memory/1948-298-0x000000001A2D0000-0x000000001A382000-memory.dmp

Filesize
712KB

Download
memory/2584-109-0x0000000004C10000-0x0000000004CC2000-memory.dmp

Filesize
712KB

Download
memory/2584-105-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2584-101-0x00000000006A0000-0x00000000006CE000-memory.dmp

Filesize
184KB

Download