Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 10:14
Behavioral task
behavioral1
Sample
portal.msi
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
portal.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
portal.msi
-
Size
2.9MB
-
MD5
b03c2dc066f3726de8e77d626be0b08e
-
SHA1
94c9a919f59ea07c160dec604e7a3b80455df6df
-
SHA256
b285c120bd2b619c4326334f48a3b02696c4b9b54ed44027f9b8b99ef52bbef5
-
SHA512
e118086e2368872e019717cc1c92ac929425de22d8eda1866c7b910427c6e1655c8e6df9fb9d6203f0da6b9365506d08d69f08c09da463881dbd600369f55ec9
-
SSDEEP
49152:T+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:T+lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000a000000017420-404.dat family_ateraagent -
Blocklisted process makes network request 7 IoCs
Processes:
msiexec.exerundll32.exerundll32.exeflow pid Process 3 2688 msiexec.exe 5 2688 msiexec.exe 7 2688 msiexec.exe 11 2148 rundll32.exe 13 2148 rundll32.exe 18 1760 rundll32.exe 22 1760 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in System32 directory 13 IoCs
Processes:
AteraAgent.exeAteraAgent.exedescription ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 12 IoCs
Processes:
AteraAgent.exeAteraAgent.exemsiexec.exedescription ioc Process File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config msiexec.exe -
Drops file in Windows directory 37 IoCs
Processes:
DrvInst.exemsiexec.exerundll32.exerundll32.exerundll32.exerundll32.exedescription ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIA44D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB790.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\f76a3bf.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB965.tmp msiexec.exe File created C:\Windows\Installer\f76a3c1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC3F6.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIA6FC.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA6FC.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB790.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB966.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3F6.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC3F6.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC3F6.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSIA44D.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC3F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA44D.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA44D.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA6FC.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA6FC.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA6FC.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIB790.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB790.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBA14.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBAE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA6FC.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f76a3be.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA44D.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB790.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB790.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\f76a3be.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA44D.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\f76a3bf.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC3F6.tmp-\System.Management.dll rundll32.exe -
Executes dropped EXE 2 IoCs
Processes:
AteraAgent.exeAteraAgent.exepid Process 2188 AteraAgent.exe 1744 AteraAgent.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid Process 1524 sc.exe -
Loads dropped DLL 35 IoCs
Processes:
MsiExec.exerundll32.exerundll32.exerundll32.exeMsiExec.exerundll32.exepid Process 1880 MsiExec.exe 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe 1880 MsiExec.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 1880 MsiExec.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1880 MsiExec.exe 2628 MsiExec.exe 2628 MsiExec.exe 1880 MsiExec.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
NET.exenet1.exeTaskKill.exerundll32.exeMsiExec.exerundll32.exerundll32.exerundll32.exeMsiExec.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Kills process with taskkill 1 IoCs
Processes:
TaskKill.exepid Process 2892 TaskKill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
DrvInst.exeAteraAgent.exeAteraAgent.exemsiexec.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AteraAgent.exe -
Modifies registry class 22 IoCs
Processes:
msiexec.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "portal.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388" msiexec.exe -
Processes:
AteraAgent.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd AteraAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 AteraAgent.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
msiexec.exeAteraAgent.exepid Process 1220 msiexec.exe 1220 msiexec.exe 1744 AteraAgent.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exerundll32.exedescription pid Process Token: SeShutdownPrivilege 2688 msiexec.exe Token: SeIncreaseQuotaPrivilege 2688 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeSecurityPrivilege 1220 msiexec.exe Token: SeCreateTokenPrivilege 2688 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2688 msiexec.exe Token: SeLockMemoryPrivilege 2688 msiexec.exe Token: SeIncreaseQuotaPrivilege 2688 msiexec.exe Token: SeMachineAccountPrivilege 2688 msiexec.exe Token: SeTcbPrivilege 2688 msiexec.exe Token: SeSecurityPrivilege 2688 msiexec.exe Token: SeTakeOwnershipPrivilege 2688 msiexec.exe Token: SeLoadDriverPrivilege 2688 msiexec.exe Token: SeSystemProfilePrivilege 2688 msiexec.exe Token: SeSystemtimePrivilege 2688 msiexec.exe Token: SeProfSingleProcessPrivilege 2688 msiexec.exe Token: SeIncBasePriorityPrivilege 2688 msiexec.exe Token: SeCreatePagefilePrivilege 2688 msiexec.exe Token: SeCreatePermanentPrivilege 2688 msiexec.exe Token: SeBackupPrivilege 2688 msiexec.exe Token: SeRestorePrivilege 2688 msiexec.exe Token: SeShutdownPrivilege 2688 msiexec.exe Token: SeDebugPrivilege 2688 msiexec.exe Token: SeAuditPrivilege 2688 msiexec.exe Token: SeSystemEnvironmentPrivilege 2688 msiexec.exe Token: SeChangeNotifyPrivilege 2688 msiexec.exe Token: SeRemoteShutdownPrivilege 2688 msiexec.exe Token: SeUndockPrivilege 2688 msiexec.exe Token: SeSyncAgentPrivilege 2688 msiexec.exe Token: SeEnableDelegationPrivilege 2688 msiexec.exe Token: SeManageVolumePrivilege 2688 msiexec.exe Token: SeImpersonatePrivilege 2688 msiexec.exe Token: SeCreateGlobalPrivilege 2688 msiexec.exe Token: SeBackupPrivilege 2536 vssvc.exe Token: SeRestorePrivilege 2536 vssvc.exe Token: SeAuditPrivilege 2536 vssvc.exe Token: SeBackupPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeRestorePrivilege 2136 DrvInst.exe Token: SeRestorePrivilege 2136 DrvInst.exe Token: SeRestorePrivilege 2136 DrvInst.exe Token: SeRestorePrivilege 2136 DrvInst.exe Token: SeRestorePrivilege 2136 DrvInst.exe Token: SeRestorePrivilege 2136 DrvInst.exe Token: SeRestorePrivilege 2136 DrvInst.exe Token: SeLoadDriverPrivilege 2136 DrvInst.exe Token: SeLoadDriverPrivilege 2136 DrvInst.exe Token: SeLoadDriverPrivilege 2136 DrvInst.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeDebugPrivilege 2148 rundll32.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe Token: SeRestorePrivilege 1220 msiexec.exe Token: SeTakeOwnershipPrivilege 1220 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 2688 msiexec.exe 2688 msiexec.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
msiexec.exeMsiExec.exeMsiExec.exeNET.exeAteraAgent.exedescription pid Process procid_target PID 1220 wrote to memory of 1880 1220 msiexec.exe 34 PID 1220 wrote to memory of 1880 1220 msiexec.exe 34 PID 1220 wrote to memory of 1880 1220 msiexec.exe 34 PID 1220 wrote to memory of 1880 1220 msiexec.exe 34 PID 1220 wrote to memory of 1880 1220 msiexec.exe 34 PID 1220 wrote to memory of 1880 1220 msiexec.exe 34 PID 1220 wrote to memory of 1880 1220 msiexec.exe 34 PID 1880 wrote to memory of 1284 1880 MsiExec.exe 35 PID 1880 wrote to memory of 1284 1880 MsiExec.exe 35 PID 1880 wrote to memory of 1284 1880 MsiExec.exe 35 PID 1880 wrote to memory of 1284 1880 MsiExec.exe 35 PID 1880 wrote to memory of 1284 1880 MsiExec.exe 35 PID 1880 wrote to memory of 1284 1880 MsiExec.exe 35 PID 1880 wrote to memory of 1284 1880 MsiExec.exe 35 PID 1880 wrote to memory of 2148 1880 MsiExec.exe 36 PID 1880 wrote to memory of 2148 1880 MsiExec.exe 36 PID 1880 wrote to memory of 2148 1880 MsiExec.exe 36 PID 1880 wrote to memory of 2148 1880 MsiExec.exe 36 PID 1880 wrote to memory of 2148 1880 MsiExec.exe 36 PID 1880 wrote to memory of 2148 1880 MsiExec.exe 36 PID 1880 wrote to memory of 2148 1880 MsiExec.exe 36 PID 1880 wrote to memory of 1544 1880 MsiExec.exe 37 PID 1880 wrote to memory of 1544 1880 MsiExec.exe 37 PID 1880 wrote to memory of 1544 1880 MsiExec.exe 37 PID 1880 wrote to memory of 1544 1880 MsiExec.exe 37 PID 1880 wrote to memory of 1544 1880 MsiExec.exe 37 PID 1880 wrote to memory of 1544 1880 MsiExec.exe 37 PID 1880 wrote to memory of 1544 1880 MsiExec.exe 37 PID 1220 wrote to memory of 2628 1220 msiexec.exe 39 PID 1220 wrote to memory of 2628 1220 msiexec.exe 39 PID 1220 wrote to memory of 2628 1220 msiexec.exe 39 PID 1220 wrote to memory of 2628 1220 msiexec.exe 39 PID 1220 wrote to memory of 2628 1220 msiexec.exe 39 PID 1220 wrote to memory of 2628 1220 msiexec.exe 39 PID 1220 wrote to memory of 2628 1220 msiexec.exe 39 PID 2628 wrote to memory of 2096 2628 MsiExec.exe 40 PID 2628 wrote to memory of 2096 2628 MsiExec.exe 40 PID 2628 wrote to memory of 2096 2628 MsiExec.exe 40 PID 2628 wrote to memory of 2096 2628 MsiExec.exe 40 PID 2096 wrote to memory of 2540 2096 NET.exe 42 PID 2096 wrote to memory of 2540 2096 NET.exe 42 PID 2096 wrote to memory of 2540 2096 NET.exe 42 PID 2096 wrote to memory of 2540 2096 NET.exe 42 PID 2628 wrote to memory of 2892 2628 MsiExec.exe 43 PID 2628 wrote to memory of 2892 2628 MsiExec.exe 43 PID 2628 wrote to memory of 2892 2628 MsiExec.exe 43 PID 2628 wrote to memory of 2892 2628 MsiExec.exe 43 PID 1220 wrote to memory of 2188 1220 msiexec.exe 45 PID 1220 wrote to memory of 2188 1220 msiexec.exe 45 PID 1220 wrote to memory of 2188 1220 msiexec.exe 45 PID 1744 wrote to memory of 1524 1744 AteraAgent.exe 47 PID 1744 wrote to memory of 1524 1744 AteraAgent.exe 47 PID 1744 wrote to memory of 1524 1744 AteraAgent.exe 47 PID 1880 wrote to memory of 1760 1880 MsiExec.exe 49 PID 1880 wrote to memory of 1760 1880 MsiExec.exe 49 PID 1880 wrote to memory of 1760 1880 MsiExec.exe 49 PID 1880 wrote to memory of 1760 1880 MsiExec.exe 49 PID 1880 wrote to memory of 1760 1880 MsiExec.exe 49 PID 1880 wrote to memory of 1760 1880 MsiExec.exe 49 PID 1880 wrote to memory of 1760 1880 MsiExec.exe 49 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\portal.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2688
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 91F1C0AD387DB651A1A08EA4F1B2B7C72⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA44D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259433656 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1284
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA6FC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259434373 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB790.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259438476 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1544
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC3F6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259441659 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1760
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 578154CEA81CA7B75E22DF3296005EC1 M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\syswow64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:2540
-
-
-
C:\Windows\syswow64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2892
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000Kc2ZxIAJ" /AgentId="515894e3-4245-4e9b-a7e0-060a0f1a8c84"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2188
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000554" "0000000000000324"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:1524
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD581bafe1a44c363bbf507286a1aeb851b
SHA1e1a2833d416b5b7d21ed1525d881e026f342f2c6
SHA2562debf172381ecc15af495e96ab75d5bef8ba7c0414d6e52d32a4994c9e65d365
SHA512dc492fd30c9a9aac4673748edc393b3a4acbbec939a12e423e6a902da038b75563de0bb266d9e4ac54d3dfe6a1dbf889bc3bca7f5e3ada6a9af28bdc8e4f2c48
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
209B
MD5c4fc4c9888beb2535608cccdc47f72d2
SHA148cb2dd081bf526c9bb30c469200a8617f9c79cd
SHA2568471477e9da316e038e3f4999bf4632d8c1de4154a9548ad5f747829d4fbd059
SHA5127abc21065411236fb1d7b6cd7658edeb18ad6cb48effc925c6d804a164769382116b9c02667d7cb9f8dacf407e1b5203db08d532fa59505a83dd15c7557b6ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5441a4996e2ee86c4b588d8c0d407e7c2
SHA10987d79eaecf4afad0e5c6f7bd9bd0a90ceabbd4
SHA256300cfa12d5560f2b04e870fe42e15b6a2007e8f53e4ce1329bd506382075e657
SHA5128d6d5bd1ea7baafeb8ca750ce112ed7fad1477e1deef34994a145893eed217d1a9990a52d76790f8c00484378778504626e5c6a5f5193b8da661afdbd62600b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize727B
MD549ba85be2cb152368fe6ee8982cf3d76
SHA1f078fdb44c9c62d64dc79849c7e41dec4441a9c0
SHA25628b91a2a15dfce2bb789d5cf10e55dc8d46418af6e8574cba83ccad4d396be68
SHA51267f5293a94bf17ed5031eec51ee06bbc467860cdc48a2712694418185c0d400386bcd3d3c4fb46e7b5e50eee1a6a4747707a3058d0c982b4cb16e8374816e787
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD53aa154c597f0d3ef221b82298ce04f78
SHA1c15d53176e903bfab12665b3e42d1b9eccfb54d0
SHA256b75a76c1c71e981d5299e2a8f85d317d14da91fd79a615c70ef14876ebc9557d
SHA512b9b93ed7f99e8b96efb85a4dc9a8cee9f7057b87da9c2a1fe82fe8cd308f89c42e76e9170bb429999e1d985af7847463b8c60173c44413685472e0b5e2306324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD59b554e84670ddfdb2a18418576acc975
SHA1f352de8b26122002ffc0107563fbf02a8f9c5208
SHA256d5ac92c7663704c6e4305fa4c380e7d02b343b9a9aad9c65a43058f53ce5eba8
SHA512057e9827f6b193ce1fa812977d4d759e11a9be0b468e8dc2b398a77749e3be3166be7d9048ae1d109d644d006183aec5942cb127da4b42120de12b4aa0520fa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD5b675b463346b724b02a374dbcb29a0ed
SHA1112156ff311a0711acef120d98dec1b7810eaffc
SHA2566c4b5752722c7be05888c9a1fe363346a93d1d8852a7c0df948106b2d9f50b8f
SHA512c3f3f147bfd655ad6db8f8e45febf53bcdd226deb0e929f6a549c7b907bc65b99d7a598d96a6e082ff3dca82a75704c62914f43e29a0b1646e4ac1414057fe54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd6d3a6f21f6566cf19ccff088a10840
SHA18f47288a9a37db17234fdb2b834b03660215a7ca
SHA256e0d854488da69af6cb9a14e9a3ec54ec5ca432d4c95ce5402b7e6210c3a74281
SHA512df9a692d47a18b2c451bfa005f32a55ed6d372ef2ac115503853cc831fbf4f567ad6f06dfe537b6d6f494318926bc2e4386d4d80d3a6050bdd12807194d5f0e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d8e90b05c0406cb7a3c46f6cf5ce55b
SHA11b5ba303440c3fc9f4a03f989bd6782c11e45460
SHA2564b461d2d8de5c5106f47c206edf609639db9f2cc2819a52ce19f4d172db32814
SHA51206dd56a0302d6db4093bff86d24abd4c0c4d33dcc82e1a1b2480d595bab8212bb41450529e06bb6b7cf98ff9e0c48d6ee9b902dcdd9479fa92d10e846868fbf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5e00cb61de36627870de5b50883c6b3df
SHA1dd59146dee5b35aac633adbd7e81fc16d2817332
SHA256f4ed3a82f021465063477294d12ef77c5b8373ce8f03e16c10c56e6f1bb9ad49
SHA512dc8c3bf06723ae979969041fcfb82b275284e6c2744ebe830c31e590be78e726a62cbd553ae0e3aa178221511272a198e10b6f562dc3bbdbe44a597cb36df2e3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
2.9MB
MD5b03c2dc066f3726de8e77d626be0b08e
SHA194c9a919f59ea07c160dec604e7a3b80455df6df
SHA256b285c120bd2b619c4326334f48a3b02696c4b9b54ed44027f9b8b99ef52bbef5
SHA512e118086e2368872e019717cc1c92ac929425de22d8eda1866c7b910427c6e1655c8e6df9fb9d6203f0da6b9365506d08d69f08c09da463881dbd600369f55ec9
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc196a9d7c8e45e86d1e3baf0038eda3
SHA1f013dfca5676f0d2a5984451d38d514f8f0598a3
SHA2568e04d2120377c54c013798584cf28792ffc3e8aad205d5d1549bdb1e5ccf0446
SHA512e1465133ed40bab09029c81f9c61ee4eb7f9225f37250bae92f24945c935c9797c08c6fd617eb24413fbbf904577d9477a7c6033b9df7aeba7edf0f32c04f44f
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a34d230fffd9741ab438d805f53b11b0
SHA16c83eb248fefdee15087a8dbcfad1572019bd5d8
SHA2567f2e06a3c0827e2f70d38284f3dbe9a47c4f274b76c6479274215b0122d6aa76
SHA5128191ffb0e4bf5df056f53670d8fe99f2e83527dcd35607c2fa8f4a109c8026cacf7b53ce1d22161578da7fefe42910e7be054cb758d76db332e02f8e4158e65b
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ff225efa103586903dd9629428a4687
SHA1b94745a5b87f5a25abe27e9c35004decd12301c4
SHA256da8abe46f8d741aee48acf555cbd491de4e4d95000c8d8a81b9312282a300632
SHA512bd54a4b7e57f16ea394f570009ab2a85f572f9b3da3aed19611b6ab1fed4be982955fa114099253678821a22dcb1f7c2da3a494b245be6f944526ab92a1ba357
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585e41d82bbd40dccd0ed2b5ca58477ea
SHA187159e4d35b0dfe103af45c14f0fe02540489f6a
SHA25634b425b6f562852e96ce6c877bff77fb997369725ec9f8c971e1fae0e9c9f122
SHA512e742a059bbe7ed554e1631d4aef8cba39f915f7775d764b8aee2ca56ef4e150fe8de2bfe4c32831bb63f5602a30785ae94332948049aa615fe30572641fe5a60
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5766c80eec88adc9d4cdd3fd85d5f05fc
SHA17f1dfdc6dc465011502ba1ebd7b95792f337eb54
SHA256e2ac7aafcb7e0753d600679971136349f6313d8a5ae83480d74aecac5ef412d2
SHA512bc46c405c87db85ad8975c28c10a824f282b47555b507e67697a22647b9f1690303d9c68c6396cb8403acd771c7d963d8949dc97a77077425b19c95a6ac15948
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5178d558a5fd507a6fc05fc937e03d178
SHA146409f5ea891b3a80e4cf281768d4a36a5b60240
SHA256ff0fa3f0d6bc63e8ab3f182ba67bd3436e3aee0ae65c13ef500330023c875234
SHA5129db7b638544426265cb52262989130dcc39d1ea0af040205c0d5f841e8bf000c380b0575786c2f8699f66c94a6dff17abb607980c635351e425f9ed6b6429754
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edda162ec2abf9f9305151b7d4f8a39e
SHA1047e90173bf0eae6a46422d1fa6a5448e988bb4d
SHA256bca2cc37ec90e6c5684a0c568b5906c015538fd683ef713c7fbf190708c9177e
SHA51224673a9d961f6842c18f83747f9b6d0bfa3307de35ffba9417c74afa444a1571b6353530e499db02843c168eee53c1edfee130ae5c05df955958c52bfdc3fab5
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531a3f9de2e27d243a8652109e686aab3
SHA1342f2414cf62ca9de7cb1d44e5030205eeba114e
SHA2560311f1cdf38ac0b9d0d21037623b94f32fd31011e5a913dfcf9ee6edbdc7cf80
SHA5127ca6ea2ddaa0e7181f7d8ca25db211fb78552f037ab6984323863acf50f3a235b3bf21abd82e975f68729b962121f5b264d3b32e29057c3389981bedc7561059
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a43353ecf557dc21cf0f5508b3470bac
SHA1999bceee1bce18f41359bb0ffe109f67baccca52
SHA256c621b793a180e598d3a04d10cc7005648cdffeb381867748779b379f516f4b1b
SHA512fe12ba558168f346d9dc3829e44bf2db42f4350b2ff989d2b238308013eb09da4290d603cd3cb38bdc849f1faa2cbc6c3cf05bfe80063d20eb040014a45b2665
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf2970bc1f17702265203ba397d24e14
SHA19f1c4962a6da1b6b0747a6b0d77acce5686cb0a9
SHA2561d2b40e93dc90c73fe702174f8955a8b10e24e0e3b57bf89166ec2ff3c55ad04
SHA51234609f52e4e35f8b55014f2c9cf56986835247e2d6c68b8a668e52138bef54550ebe3ad66fd3f4b52f443ba3a960da5bcd94c09429c58c4b6c9ea63fb2932771
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ff156738cd0c135f7f600353cae149c
SHA14b6e6b12b032b64a37f3958f4a51b880028e7cf0
SHA256293bcd4d2c6765946ba0050ff6057caefd3b60a05ff3781392eb2090ee059d28
SHA51299d16fc4bd22e069f3d0dd3a96e2563eba3a602c4a4b502e8c9472894fbdc5a59e940d94839f1781ce1f45e2aa7b99acfc07fa7f8c490d4284a1bdfdc9ceea19
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD583f4e616d4881cd0ade7a02f849b38fd
SHA1c6679c4fbe512e805a555db14d6ebaddb802d17e
SHA256cc1ea0f7ca534e80a7006c0521c158b267d042a27930a9fa76f19c4e79af51cd
SHA5129b9e4f07fa7db299347a3d346b083061db78d0d4cf643f6ef319e5e6e93f37e447e68bc66ee96e93c246524d038460913dfc0681f7efdef6ee8fb36a675e69a3
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0