Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 02:34

General

  • Target

    9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3.msi

  • Size

    2.9MB

  • MD5

    156ff43b54310c6f8eb4d1a7fda1a90f

  • SHA1

    1f00b3e593a63abb8dc0e6aec58fc41f40a0a977

  • SHA256

    9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3

  • SHA512

    bf57a64120e3d026b5112706a3e1e7c11718f1a9aca61a301334a917de41b1b979bdea29710ebea6b1b13aa300baf5972dd21d12e34daf99566657553cf0bd64

  • SSDEEP

    49152:C+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:C+lUlz9FKbsodq0YaH7ZPxMb8tT

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

  • Ateraagent family
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 37 IoCs
  • Executes dropped EXE 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1952
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D0D9F54EB752A071463431430EA5F18C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI6347.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259482905 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2008
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI6AC7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259484465 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1308
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI87F9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259492000 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2180
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIA639.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259499582 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1792
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 15DDCE47E1B2670FC381D0866EA45FD9 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\syswow64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:752
      • C:\Windows\syswow64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:1624
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q3000008BLFqIAO" /AgentId="dabbb443-1b86-4273-9e29-90d26d5a5780"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1672
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1716
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "00000000000005EC"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:3000
  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
      2⤵
      • Launches sc.exe
      PID:1132
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dabbb443-1b86-4273-9e29-90d26d5a5780 "ccf08759-c953-4e39-97a7-856ad8d3e321" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q3000008BLFqIAO
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f77627d.rbs

    Filesize

    8KB

    MD5

    8858cebe0de5960c9f97e0538a0d65f1

    SHA1

    ea34aeacd3a4c3b5c4515c3c2e9c4d0af46d8bb8

    SHA256

    369acfe46b3150a451b6502b2b9f3a3f7cb489aa39bf923c54c9675dc0490bb1

    SHA512

    91928e87cc0a34366010b21306b6eb045774bdeb29842893e207d61e222692499df4cb50baddc6d66e47c3e7ebb90f386aaa25efac491a4ea1477d310102c2b4

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

    Filesize

    753B

    MD5

    8298451e4dee214334dd2e22b8996bdc

    SHA1

    bc429029cc6b42c59c417773ea5df8ae54dbb971

    SHA256

    6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

    SHA512

    cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

    Filesize

    142KB

    MD5

    477293f80461713d51a98a24023d45e8

    SHA1

    e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

    SHA256

    a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

    SHA512

    23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

    Filesize

    1KB

    MD5

    b3bb71f9bb4de4236c26578a8fae2dcd

    SHA1

    1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

    SHA256

    e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

    SHA512

    fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

    Filesize

    210KB

    MD5

    c106df1b5b43af3b937ace19d92b42f3

    SHA1

    7670fc4b6369e3fb705200050618acaa5213637f

    SHA256

    2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

    SHA512

    616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

    Filesize

    693KB

    MD5

    2c4d25b7fbd1adfd4471052fa482af72

    SHA1

    fd6cd773d241b581e3c856f9e6cd06cb31a01407

    SHA256

    2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

    SHA512

    f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI

    Filesize

    12B

    MD5

    3fa173e4e1e00396a06e409935a1e7f9

    SHA1

    089b85e04c266edd6dbb678ee91da656b19674b3

    SHA256

    297a53db6da22aa3ee4ce849c9952f08bb7296303a170c9ddc7acede10b64c25

    SHA512

    d0c34b51e5599c01edf4ca6acc89186bcea5b97a598c4f120b3063c171b9a1668ba5ff87014565360471973b30733a5521783fa3446bf376332aad23a4325d26

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

    Filesize

    182KB

    MD5

    9d8d50d2789c2a8d847d7953518a96f6

    SHA1

    42621852b40f3f068da5494c9879f846b4869399

    SHA256

    76aefe9205bce78d4533500e6839e892b7d80edc39abcd30ca67952925302b29

    SHA512

    91ea7152762f00fdfbc6cb8d5d15c2e07bc298af8958406b0b0fb652ee3d4a4da9d79ca7dde47dc7700285b20cba089f35745c2b3b84b9dc0d258bd9bdc89f56

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

    Filesize

    546B

    MD5

    158fb7d9323c6ce69d4fce11486a40a1

    SHA1

    29ab26f5728f6ba6f0e5636bf47149bd9851f532

    SHA256

    5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

    SHA512

    7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll

    Filesize

    688KB

    MD5

    50e3f5a0e04cbd99d4be8cfe914c7bbe

    SHA1

    19d99ae964f490e055942d516c60dfdedc585825

    SHA256

    89ed8cbc24723d67ac7e47d0d018ea293f15fc210d9b3e26dc555f464e9b15cd

    SHA512

    2f67dbb41631b6134414d1685815daea7f38120d88f83cb8f83763cf18b1f6aa2b9a5a7eaef816eb8a24998536556128c15128b4e301b765c859a9741d69ba25

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt

    Filesize

    23KB

    MD5

    03420408ace3977e3b7f4415b4a4e5a6

    SHA1

    e0ea6ff8df8eacc5bf2bb108d86513d183fa1ff9

    SHA256

    065788625d343c441890d8cbb2e25359484fcdd8911b77ffd797cd2f956067cf

    SHA512

    fcb03161aa3a7a5db3a7faeda120cc79d98cf326ec38a039f38a04b085fe33294eb25a8f78dd10c4bb51059eb16e94d2dcc737441f50b5beb474ea098a46e3b2

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

    Filesize

    588KB

    MD5

    17d74c03b6bcbcd88b46fcc58fc79a0d

    SHA1

    bc0316e11c119806907c058d62513eb8ce32288c

    SHA256

    13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

    SHA512

    f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

    Filesize

    221B

    MD5

    d78493fc96ef866767796bbd71d2ae0c

    SHA1

    b64d909f5225bc2dac6edf74c28567a17e1afdb9

    SHA256

    63efa86fc0ea8f3ab0148678fb6f45e7ba166fe5bebaef124b4f051934b79c4e

    SHA512

    4d21c92821960e46b34501a0ee53fa4db14cf0a14de8b772dfacc7dfc0398bfc393d223a2efb5c725e57b14174783dad71500fa3e1f2acc7824de3a4fbbf677d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    471B

    MD5

    01469d86975d80da48c7adbe1c3727cf

    SHA1

    7d4d07f80a88928d7b8e54ba6fb59e9b7e3d5c1c

    SHA256

    902833a88c63bf18bc32baebf9f2f987380a740f21a6e1f7ea60d0ff0554638b

    SHA512

    c4e27e3dbcd463969a2793736a9126c8910e40556151f30d890b7f6c4422344f65e98c127c4113608fa5e3e7d0f06505772c11085e8e3c6ae9b45910d3fe451c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

    Filesize

    727B

    MD5

    7cb686e6e2cd551cc1414d0f71c0fa65

    SHA1

    a65a5caa1b1d77bfa6cc6eb7eb976812add8d58d

    SHA256

    18bc957b344834d8dbea0ea7378a4fb3fd87a050f84907993f1b288a54d3be25

    SHA512

    9cb19be5e3977ee7e96b02ae19f32dec419974f73b62c6e841fa67ae2b11e30a446c5fed84dc7ae2193d35b5f0912a9137986a436889be9f39e3686eadf7df05

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    727B

    MD5

    40482c80cbdb2016f964a54e6c803c08

    SHA1

    514981e85af4f6d6aafc24080184091c69b1630f

    SHA256

    d63a105634357b3e49d24c7e69b0b0bc5529859a71a93cfff85528c7802a53dd

    SHA512

    ebdbd06353edbc52702d6ac8edb52ac7ff859888b1051c52e826c3c70773d6fab2fe7537229bdd1aadc8298810a8450a5fed8b655176de3a52bc460548bd875f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    400B

    MD5

    07bb556dc20677a5792ab5e58fa027d2

    SHA1

    0205d94b65867d47b8a6b122e0c1ab142092296d

    SHA256

    734f3ca296b7dacc6b5586a18d99144d7d0d0a449ebe5fb2a6ac45c193d46976

    SHA512

    8b9648da510a36d70b49a76557d438aa0ace75f9b5034e6cac0c52808130849d21272a6234093b3a7abb8e1ee437fc4122a88c0e6a7671c3446cc7caaf8af99b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

    Filesize

    404B

    MD5

    d84801b2f7f23b4b5e2043c85d6cd2ee

    SHA1

    3339fc856fd67447f22c17e997a0b5f6c44dcd8b

    SHA256

    ecdbfbeb8a6cb912fb9ce1d0ff9fd2f8d0af7c2982390977b495a51707c7660e

    SHA512

    7254b26ab5228d6ace7fe0fda35a752138060d9441dc7477f178bde911fcc01f735de9284f4f6b1e492d570dc0961d4f4e022378db3827dd43625d9996c49abc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd574b82c1f5425f84ba5510ce306dab

    SHA1

    e527becafd45e283b1bd1715e3470ca54785d557

    SHA256

    042b4bf4e0ba76f960d8ee2f3087535fa1d9b91ff5a195ec2f09478762db7ad8

    SHA512

    834f752079c4c781b424e42c9682b4935906c9c3d3460de64f8b42739de5e2f8a52c4a65981cdf53f9243b8b91daab6d4431449fd496567f028d568184757d3e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    716c91e6a9fa6a206228c93258443402

    SHA1

    b27dd13b459cd6a2217eb176080048452fda9ce7

    SHA256

    de382b0b713b1388fff07d2c841241bcb9cb2c055c24fe4b191bb924cef1f5f2

    SHA512

    d321dbe9527bfe2599bffbbef304d04fca740f5a0d47a833bfe5450f87f75ee1f9533d202cd1ef6ba5e648bafa3e77d5407435b82cda9f557fcb2592474b5a30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    412B

    MD5

    9a136fc22082e2d26155f30a6f4bef4c

    SHA1

    3cf602aa7757eb8c13a26151c75b65693cb10ccc

    SHA256

    04c554b9976fb5234728160d5e2ded5d70012e6d673ef481ee76cc3e15844651

    SHA512

    518f5ae39dcb6ef123a3cf778ee3a377ac9f19d2f056d07c6876a35e7c805a839ff63cb0ac1c82b6f9762ad8622cab8af31b22c8ae7dba373936ea05fdab0b78

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    30a9498a9bbf35ae430385c701b7b30a

    SHA1

    356e4e6025020fd8488fe68073b5b0a0475cf437

    SHA256

    0fc978e54a6227d56ab2c89b94e5bbdcc43d1167d4436baf377fb64583c86171

    SHA512

    ba6a58cc86c8f972d912c5a6f606999a209ac660136a0c9793cbdb81fd3a3c3306e017635b0d4bb8be1e3e9ac6a7b7f2feb339a78d889b8fffeb6bead2440c03

  • C:\Users\Admin\AppData\Local\Temp\Cab82D.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar177C.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\Installer\MSI6347.tmp

    Filesize

    509KB

    MD5

    88d29734f37bdcffd202eafcdd082f9d

    SHA1

    823b40d05a1cab06b857ed87451bf683fdd56a5e

    SHA256

    87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

    SHA512

    1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

  • C:\Windows\Installer\MSI6AC7.tmp-\CustomAction.config

    Filesize

    1KB

    MD5

    bc17e956cde8dd5425f2b2a68ed919f8

    SHA1

    5e3736331e9e2f6bf851e3355f31006ccd8caa99

    SHA256

    e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

    SHA512

    02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

  • C:\Windows\Installer\f77627b.msi

    Filesize

    2.9MB

    MD5

    156ff43b54310c6f8eb4d1a7fda1a90f

    SHA1

    1f00b3e593a63abb8dc0e6aec58fc41f40a0a977

    SHA256

    9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3

    SHA512

    bf57a64120e3d026b5112706a3e1e7c11718f1a9aca61a301334a917de41b1b979bdea29710ebea6b1b13aa300baf5972dd21d12e34daf99566657553cf0bd64

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fae741d90fc17c89abc9c1beefe7c7df

    SHA1

    a008e6ae2f0081f5fa5d80938e0536fa2ae49e30

    SHA256

    c90afbb783d984c3d9e0c27b24f9420c3fafbc19dcff3a6799a65f8f06dd6a13

    SHA512

    2c9feb282f625b5c16c89dee819c82d91337d4a86aa84892c69d2443dbbd904e0f0fc5e38587e0c4384a4a39160c546d3cdbdb3926ea6cb4956e85cd94465750

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    922bb85b9d1273e07c0f1df0109030d7

    SHA1

    8c727a4f25aea371499aed8e014c0eeb449eaac9

    SHA256

    0e3847b444d5034dc6713c69171ce46cad51ec0c98df09d0ccefdf759e72bdd6

    SHA512

    42ceb70f6075432d83b131bae26adf398b734a053834efdd3e4fb7fdae3c498890931a0d64d0e30f98ac11c2512a9cab7340d033053656cfab4f382d98c981ad

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3c3836e1c08e8ecab253dfd3ae9b96ac

    SHA1

    0e5f6e4767346f0468b65fb0ce537213babe5e51

    SHA256

    67cc544030ef460713f86c9d7e49b68cbd1f8150d624811ed169304cf09d7b8c

    SHA512

    21881558238e5d41df9e4269f016525da92b0ed2ebd8e3d66440ddfa74063454b9336bf9950eca0ce0a981e2c02d75b66d08eed287f6dc7d661b2085b3808a74

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c365b45de3d9e6783587570e05b6b977

    SHA1

    b2998e616a7226e3cf9ba6829c658902fda2c97f

    SHA256

    db734e94ae96217e773609cef9c58c34201fe4c890fd8d2e02e9d1db260ae879

    SHA512

    10b22d8c8df9ffcbdf253787fb1e99073edb928461cbe8a460d98e4082be59c49c29822d000c70a37be1d1a05babb433fa3087cd60261246819901c14ac17687

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6531f8637205d27cf7b34f7d6e20a53a

    SHA1

    03bd7a485185a6856e2f0239fca4abb8b5dee9f4

    SHA256

    963982347bb21b550183280c38172e608e488470bc35a809b78a4eeab882de89

    SHA512

    42b12741e8dfae5ee748147b4fd5ed4449acda351e638b4052800f164f4925216c4eac1df4d6a55aaf22aa2f9ff45b24881e63df21cd0413b42d3fde281e6ca8

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7d7b69a711a53d7ce8db1b9766ebe98e

    SHA1

    6f6fb68c66c4b1881faf11f61544c67308f09a52

    SHA256

    f933cbc5f629d07d83b713ac18034c5e1a9279781b4790ba41c3f26555f3a274

    SHA512

    a187cecc3aacb9975169b336654a4c1507d1d16f7e057a7f9d9175dad3154299042124258dcf63719365bb0ebe30cf43e9686a338fa722358eb02bf7c98610a5

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c22fb13414d8ed88e3b25932462c2492

    SHA1

    1bd46d1ed5d8d856fd4212aa6bd4cabaf63bcc12

    SHA256

    a143633be480f4515c1c368af7962d103417dafdfe18a866777e3ac5438e3128

    SHA512

    a3c6c9a95ead6d09ff18f1a4ee661bdd57aed3dd67b0166f306e888d7f8a8d470dbaaea986dbbaec6254695c01a6f32cc4888162aeee4bb540f1d1697cf0770a

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    66219b7fae599c2e72a6887ac959cc0f

    SHA1

    0c6dcdaf37728cc4711790a924dfef8c2a013fd8

    SHA256

    c486af07fca8565181afa5242779d4643e1f5f674292616ad576bb0489e8e48e

    SHA512

    7025d4909fa4336c7e71c10db186bbc6ba706132f24fb0ecee28abedc49e0004bc4fb0e5fcd6c9d75a27b50f8d657c0d8a0b1d1860429819c084b28ca535e152

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    818eed3a3e0256e17ae57c895d51c698

    SHA1

    588ce5090741d91a5c3ed9a925ebc66ef3deb1ac

    SHA256

    92152b927b528c04aa7f29de0b02f73292eff1f57bc3159ecd502a76b976bc58

    SHA512

    bed64fc896d34f676280e6133fb68c3f951a0518f5a41eeb91d09d964a053558558b2a18e72a6f0e2f06b3b6577eea9bed8e8cdb6a048a63fecf9d95ae3f7239

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e9a21ed00baf2f0eb9547ce857fe7908

    SHA1

    3f364941d12f79299cf769e381801b1011e9a1a6

    SHA256

    f46a29cff013c5f8c5d25fdcf3ff8114f9c5198bae30814bca509f6d4fcab394

    SHA512

    5e4d53566af4966b81141f163f378c21eea0b82f38677cba5dc9e975343b1eaee35674d32efd8e541c4268e359d7a189b0b79e490e4811ea610d2a17d6b74a1f

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ec4f441124e0fc3adcbb35a09166073c

    SHA1

    9e2add4cda9be7c3d46b2ac454c9fd4aa96abd1f

    SHA256

    87cfa439dcea39c1aa81123e64b8b2670036d07905b67bf504ead7ad1493d713

    SHA512

    e038b63edd3f13dc9897334c9c976ed59d50f2c8b78255ffe7af80a55578f167d8f4d1f339675f41d89e3b1704de2d5235b6ed99489ab4fc113c12d3231c66e2

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ed487b72d6bf414461d1f7eab99128c9

    SHA1

    e43fc01edf6ccfa1ff83fc3152c3457271b5c35d

    SHA256

    f2d0c59b8487f4622240e3268a3745a47b1e98be40075b74338d493b7c20f4f4

    SHA512

    62254a226c8ffe9fcbe1e8e1bacf7abe991a08147b3cb6f5ebbdecab94a0da655eeddb80cce29a2047daba3645216fc9f18941a1f365875a881f253d0df2b356

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4e22dd92a77db88aaf10de69b20c3c31

    SHA1

    a9761f497c2cf4cc42e676a010279c0e819bd5ed

    SHA256

    74ec7adc498f87ac76bf331aa2662abd48194ec58a904d8fd8f0c9cb3367f754

    SHA512

    d228929ff74caeade4d040169cd538501e8c8332e2a9ea4a86233fe3e4de750e635b6806122c4173962e2d6cbf348ae359f9ac9b7e1fb7beec36adfd3ddc1e89

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    731e923abcc2c8fdd033cc68d4f79df6

    SHA1

    8fce81661ca758cb38f8c7c67b27f7f34c80b654

    SHA256

    e36b43d4289e1a13ac0511444874f789f5545b7cd2da2025a6350496139e8ae6

    SHA512

    936bfcabd7eb7c90ea626552fb70d61b144b9bbc96941e503f55d83f37fce53e80aa20007723ab7f8dde4b1ae74b842804df77832df43e9d50180c037855d124

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3d1ae1c759781cd9f26471fc82d082d9

    SHA1

    dfd064f5cf1a6bf91baedb77e04cbdbe82798b89

    SHA256

    7efb1236dfaab0f4f35e6ca5dce8eb393f8f25e276c03849ff9eaef4195ab309

    SHA512

    cbf0112ecdc6fb9ae534b76768fd6423002a96183c3b325215da803d232b1d512a6b4803a90f0abbb4f9d397c67519b82119a2302bedbebdae06b75c9cc67ae1

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    7690f77142dc83e8ba39e2e64386c07d

    SHA1

    47eba41fb3fad7ddb48f0518078e6592d4aa03b9

    SHA256

    e4650057a337c9be990beb52144d3aaf7549a76078de01834bd4daf709cce72d

    SHA512

    c3cf9cde96732df06702f41ad7da190b01da4e7ec9f4f399b5392c1e9575e9170aa23cdbe71d00a3848c6156bb6dcdf1d6e6110f2851cecb5337238dccecb45a

  • C:\Windows\Temp\CabB673.tmp

    Filesize

    29KB

    MD5

    d59a6b36c5a94916241a3ead50222b6f

    SHA1

    e274e9486d318c383bc4b9812844ba56f0cff3c6

    SHA256

    a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

    SHA512

    17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

  • C:\Windows\Temp\TarB676.tmp

    Filesize

    81KB

    MD5

    b13f51572f55a2d31ed9f266d581e9ea

    SHA1

    7eef3111b878e159e520f34410ad87adecf0ca92

    SHA256

    725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

    SHA512

    f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

  • \Windows\Installer\MSI6347.tmp-\AlphaControlAgentInstallation.dll

    Filesize

    25KB

    MD5

    aa1b9c5c685173fad2dabebeb3171f01

    SHA1

    ed756b1760e563ce888276ff248c734b7dd851fb

    SHA256

    e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

    SHA512

    d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

  • \Windows\Installer\MSI6347.tmp-\Microsoft.Deployment.WindowsInstaller.dll

    Filesize

    179KB

    MD5

    1a5caea6734fdd07caa514c3f3fb75da

    SHA1

    f070ac0d91bd337d7952abd1ddf19a737b94510c

    SHA256

    cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

    SHA512

    a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

  • \Windows\Installer\MSI6AC7.tmp-\Newtonsoft.Json.dll

    Filesize

    695KB

    MD5

    715a1fbee4665e99e859eda667fe8034

    SHA1

    e13c6e4210043c4976dcdc447ea2b32854f70cc6

    SHA256

    c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

    SHA512

    bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

  • \Windows\Installer\MSI8EBE.tmp

    Filesize

    211KB

    MD5

    a3ae5d86ecf38db9427359ea37a5f646

    SHA1

    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

    SHA256

    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

    SHA512

    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

  • memory/1152-294-0x000000001A830000-0x000000001A8E2000-memory.dmp

    Filesize

    712KB

  • memory/1152-1048-0x0000000019E50000-0x0000000019E88000-memory.dmp

    Filesize

    224KB

  • memory/1308-101-0x0000000000960000-0x000000000098E000-memory.dmp

    Filesize

    184KB

  • memory/1308-109-0x0000000004620000-0x00000000046D2000-memory.dmp

    Filesize

    712KB

  • memory/1308-105-0x00000000009A0000-0x00000000009AC000-memory.dmp

    Filesize

    48KB

  • memory/1672-246-0x000000001B1E0000-0x000000001B278000-memory.dmp

    Filesize

    608KB

  • memory/1672-234-0x00000000013D0000-0x00000000013F8000-memory.dmp

    Filesize

    160KB

  • memory/1792-314-0x00000000048D0000-0x0000000004982000-memory.dmp

    Filesize

    712KB

  • memory/1792-310-0x0000000000980000-0x000000000098C000-memory.dmp

    Filesize

    48KB

  • memory/1792-306-0x00000000009D0000-0x00000000009FE000-memory.dmp

    Filesize

    184KB

  • memory/2008-76-0x0000000000970000-0x000000000097C000-memory.dmp

    Filesize

    48KB

  • memory/2008-72-0x0000000000920000-0x000000000094E000-memory.dmp

    Filesize

    184KB

  • memory/2028-1241-0x0000000000C40000-0x0000000000C72000-memory.dmp

    Filesize

    200KB

  • memory/2028-1256-0x0000000019770000-0x0000000019820000-memory.dmp

    Filesize

    704KB

  • memory/2028-1257-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB