Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/01/2025, 02:34
Behavioral task
behavioral1
Sample
9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3.msi
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3.msi
Resource
win10v2004-20241007-en
General
-
Target
9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3.msi
-
Size
2.9MB
-
MD5
156ff43b54310c6f8eb4d1a7fda1a90f
-
SHA1
1f00b3e593a63abb8dc0e6aec58fc41f40a0a977
-
SHA256
9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3
-
SHA512
bf57a64120e3d026b5112706a3e1e7c11718f1a9aca61a301334a917de41b1b979bdea29710ebea6b1b13aa300baf5972dd21d12e34daf99566657553cf0bd64
-
SSDEEP
49152:C+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:C+lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
resource yara_rule behavioral1/files/0x0009000000018b28-470.dat family_ateraagent -
Blocklisted process makes network request 8 IoCs
flow pid Process 3 1952 msiexec.exe 5 1952 msiexec.exe 7 1952 msiexec.exe 11 1308 rundll32.exe 12 1308 rundll32.exe 27 1792 rundll32.exe 30 1792 rundll32.exe 32 1792 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 AteraAgent.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 AgentPackageAgentInformation.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt AgentPackageAgentInformation.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll AteraAgent.exe -
Drops file in Windows directory 37 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI87F9.tmp-\Newtonsoft.Json.dll rundll32.exe File created C:\Windows\Installer\f77627c.ipi msiexec.exe File created C:\Windows\Installer\f77627e.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI6347.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6347.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI6AC7.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f77627c.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSI6347.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8EAE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8FF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI919E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA639.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI87F9.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIA639.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIA639.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6347.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6347.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6AC7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6AC7.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6AC7.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI87F9.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA639.tmp msiexec.exe File opened for modification C:\Windows\Installer\f77627b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI87F9.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\f77627b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6AC7.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6AC7.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI87F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI87F9.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA639.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI6347.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8EBE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA639.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe -
Executes dropped EXE 3 IoCs
pid Process 1672 AteraAgent.exe 1152 AteraAgent.exe 2028 AgentPackageAgentInformation.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1132 sc.exe -
Loads dropped DLL 35 IoCs
pid Process 2560 MsiExec.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2560 MsiExec.exe 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe 2560 MsiExec.exe 2180 rundll32.exe 2180 rundll32.exe 2180 rundll32.exe 2180 rundll32.exe 2180 rundll32.exe 2560 MsiExec.exe 2332 MsiExec.exe 2332 MsiExec.exe 2560 MsiExec.exe 1792 rundll32.exe 1792 rundll32.exe 1792 rundll32.exe 1792 rundll32.exe 1792 rundll32.exe 1792 rundll32.exe 1792 rundll32.exe 1792 rundll32.exe 1792 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1952 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe -
Kills process with taskkill 1 IoCs
pid Process 1624 TaskKill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs AgentPackageAgentInformation.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs AgentPackageAgentInformation.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates AgentPackageAgentInformation.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" AteraAgent.exe -
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000 msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd AteraAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 AteraAgent.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2876 msiexec.exe 2876 msiexec.exe 1152 AteraAgent.exe 2028 AgentPackageAgentInformation.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1952 msiexec.exe Token: SeIncreaseQuotaPrivilege 1952 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeSecurityPrivilege 2876 msiexec.exe Token: SeCreateTokenPrivilege 1952 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1952 msiexec.exe Token: SeLockMemoryPrivilege 1952 msiexec.exe Token: SeIncreaseQuotaPrivilege 1952 msiexec.exe Token: SeMachineAccountPrivilege 1952 msiexec.exe Token: SeTcbPrivilege 1952 msiexec.exe Token: SeSecurityPrivilege 1952 msiexec.exe Token: SeTakeOwnershipPrivilege 1952 msiexec.exe Token: SeLoadDriverPrivilege 1952 msiexec.exe Token: SeSystemProfilePrivilege 1952 msiexec.exe Token: SeSystemtimePrivilege 1952 msiexec.exe Token: SeProfSingleProcessPrivilege 1952 msiexec.exe Token: SeIncBasePriorityPrivilege 1952 msiexec.exe Token: SeCreatePagefilePrivilege 1952 msiexec.exe Token: SeCreatePermanentPrivilege 1952 msiexec.exe Token: SeBackupPrivilege 1952 msiexec.exe Token: SeRestorePrivilege 1952 msiexec.exe Token: SeShutdownPrivilege 1952 msiexec.exe Token: SeDebugPrivilege 1952 msiexec.exe Token: SeAuditPrivilege 1952 msiexec.exe Token: SeSystemEnvironmentPrivilege 1952 msiexec.exe Token: SeChangeNotifyPrivilege 1952 msiexec.exe Token: SeRemoteShutdownPrivilege 1952 msiexec.exe Token: SeUndockPrivilege 1952 msiexec.exe Token: SeSyncAgentPrivilege 1952 msiexec.exe Token: SeEnableDelegationPrivilege 1952 msiexec.exe Token: SeManageVolumePrivilege 1952 msiexec.exe Token: SeImpersonatePrivilege 1952 msiexec.exe Token: SeCreateGlobalPrivilege 1952 msiexec.exe Token: SeBackupPrivilege 1716 vssvc.exe Token: SeRestorePrivilege 1716 vssvc.exe Token: SeAuditPrivilege 1716 vssvc.exe Token: SeBackupPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeRestorePrivilege 3000 DrvInst.exe Token: SeRestorePrivilege 3000 DrvInst.exe Token: SeRestorePrivilege 3000 DrvInst.exe Token: SeRestorePrivilege 3000 DrvInst.exe Token: SeRestorePrivilege 3000 DrvInst.exe Token: SeRestorePrivilege 3000 DrvInst.exe Token: SeRestorePrivilege 3000 DrvInst.exe Token: SeLoadDriverPrivilege 3000 DrvInst.exe Token: SeLoadDriverPrivilege 3000 DrvInst.exe Token: SeLoadDriverPrivilege 3000 DrvInst.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeDebugPrivilege 1308 rundll32.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe Token: SeRestorePrivilege 2876 msiexec.exe Token: SeTakeOwnershipPrivilege 2876 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1952 msiexec.exe 1952 msiexec.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2560 2876 msiexec.exe 35 PID 2876 wrote to memory of 2560 2876 msiexec.exe 35 PID 2876 wrote to memory of 2560 2876 msiexec.exe 35 PID 2876 wrote to memory of 2560 2876 msiexec.exe 35 PID 2876 wrote to memory of 2560 2876 msiexec.exe 35 PID 2876 wrote to memory of 2560 2876 msiexec.exe 35 PID 2876 wrote to memory of 2560 2876 msiexec.exe 35 PID 2560 wrote to memory of 2008 2560 MsiExec.exe 36 PID 2560 wrote to memory of 2008 2560 MsiExec.exe 36 PID 2560 wrote to memory of 2008 2560 MsiExec.exe 36 PID 2560 wrote to memory of 2008 2560 MsiExec.exe 36 PID 2560 wrote to memory of 2008 2560 MsiExec.exe 36 PID 2560 wrote to memory of 2008 2560 MsiExec.exe 36 PID 2560 wrote to memory of 2008 2560 MsiExec.exe 36 PID 2560 wrote to memory of 1308 2560 MsiExec.exe 37 PID 2560 wrote to memory of 1308 2560 MsiExec.exe 37 PID 2560 wrote to memory of 1308 2560 MsiExec.exe 37 PID 2560 wrote to memory of 1308 2560 MsiExec.exe 37 PID 2560 wrote to memory of 1308 2560 MsiExec.exe 37 PID 2560 wrote to memory of 1308 2560 MsiExec.exe 37 PID 2560 wrote to memory of 1308 2560 MsiExec.exe 37 PID 2560 wrote to memory of 2180 2560 MsiExec.exe 38 PID 2560 wrote to memory of 2180 2560 MsiExec.exe 38 PID 2560 wrote to memory of 2180 2560 MsiExec.exe 38 PID 2560 wrote to memory of 2180 2560 MsiExec.exe 38 PID 2560 wrote to memory of 2180 2560 MsiExec.exe 38 PID 2560 wrote to memory of 2180 2560 MsiExec.exe 38 PID 2560 wrote to memory of 2180 2560 MsiExec.exe 38 PID 2876 wrote to memory of 2332 2876 msiexec.exe 40 PID 2876 wrote to memory of 2332 2876 msiexec.exe 40 PID 2876 wrote to memory of 2332 2876 msiexec.exe 40 PID 2876 wrote to memory of 2332 2876 msiexec.exe 40 PID 2876 wrote to memory of 2332 2876 msiexec.exe 40 PID 2876 wrote to memory of 2332 2876 msiexec.exe 40 PID 2876 wrote to memory of 2332 2876 msiexec.exe 40 PID 2332 wrote to memory of 1992 2332 MsiExec.exe 41 PID 2332 wrote to memory of 1992 2332 MsiExec.exe 41 PID 2332 wrote to memory of 1992 2332 MsiExec.exe 41 PID 2332 wrote to memory of 1992 2332 MsiExec.exe 41 PID 1992 wrote to memory of 752 1992 NET.exe 43 PID 1992 wrote to memory of 752 1992 NET.exe 43 PID 1992 wrote to memory of 752 1992 NET.exe 43 PID 1992 wrote to memory of 752 1992 NET.exe 43 PID 2332 wrote to memory of 1624 2332 MsiExec.exe 44 PID 2332 wrote to memory of 1624 2332 MsiExec.exe 44 PID 2332 wrote to memory of 1624 2332 MsiExec.exe 44 PID 2332 wrote to memory of 1624 2332 MsiExec.exe 44 PID 2876 wrote to memory of 1672 2876 msiexec.exe 46 PID 2876 wrote to memory of 1672 2876 msiexec.exe 46 PID 2876 wrote to memory of 1672 2876 msiexec.exe 46 PID 2560 wrote to memory of 1792 2560 MsiExec.exe 48 PID 2560 wrote to memory of 1792 2560 MsiExec.exe 48 PID 2560 wrote to memory of 1792 2560 MsiExec.exe 48 PID 2560 wrote to memory of 1792 2560 MsiExec.exe 48 PID 2560 wrote to memory of 1792 2560 MsiExec.exe 48 PID 2560 wrote to memory of 1792 2560 MsiExec.exe 48 PID 2560 wrote to memory of 1792 2560 MsiExec.exe 48 PID 1152 wrote to memory of 1132 1152 AteraAgent.exe 49 PID 1152 wrote to memory of 1132 1152 AteraAgent.exe 49 PID 1152 wrote to memory of 1132 1152 AteraAgent.exe 49 PID 1152 wrote to memory of 2028 1152 AteraAgent.exe 51 PID 1152 wrote to memory of 2028 1152 AteraAgent.exe 51 PID 1152 wrote to memory of 2028 1152 AteraAgent.exe 51 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1952
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D0D9F54EB752A071463431430EA5F18C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI6347.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259482905 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2008
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI6AC7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259484465 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI87F9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259492000 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2180
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA639.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259499582 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1792
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 15DDCE47E1B2670FC381D0866EA45FD9 M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\syswow64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:752
-
-
-
C:\Windows\syswow64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1624
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q3000008BLFqIAO" /AgentId="dabbb443-1b86-4273-9e29-90d26d5a5780"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1672
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "00000000000005EC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:1132
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dabbb443-1b86-4273-9e29-90d26d5a5780 "ccf08759-c953-4e39-97a7-856ad8d3e321" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q3000008BLFqIAO2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2028
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD58858cebe0de5960c9f97e0538a0d65f1
SHA1ea34aeacd3a4c3b5c4515c3c2e9c4d0af46d8bb8
SHA256369acfe46b3150a451b6502b2b9f3a3f7cb489aa39bf923c54c9675dc0490bb1
SHA51291928e87cc0a34366010b21306b6eb045774bdeb29842893e207d61e222692499df4cb50baddc6d66e47c3e7ebb90f386aaa25efac491a4ea1477d310102c2b4
-
Filesize
753B
MD58298451e4dee214334dd2e22b8996bdc
SHA1bc429029cc6b42c59c417773ea5df8ae54dbb971
SHA2566fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25
SHA512cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
210KB
MD5c106df1b5b43af3b937ace19d92b42f3
SHA17670fc4b6369e3fb705200050618acaa5213637f
SHA2562b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
SHA512616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
Filesize12B
MD53fa173e4e1e00396a06e409935a1e7f9
SHA1089b85e04c266edd6dbb678ee91da656b19674b3
SHA256297a53db6da22aa3ee4ce849c9952f08bb7296303a170c9ddc7acede10b64c25
SHA512d0c34b51e5599c01edf4ca6acc89186bcea5b97a598c4f120b3063c171b9a1668ba5ff87014565360471973b30733a5521783fa3446bf376332aad23a4325d26
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
Filesize182KB
MD59d8d50d2789c2a8d847d7953518a96f6
SHA142621852b40f3f068da5494c9879f846b4869399
SHA25676aefe9205bce78d4533500e6839e892b7d80edc39abcd30ca67952925302b29
SHA51291ea7152762f00fdfbc6cb8d5d15c2e07bc298af8958406b0b0fb652ee3d4a4da9d79ca7dde47dc7700285b20cba089f35745c2b3b84b9dc0d258bd9bdc89f56
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
Filesize546B
MD5158fb7d9323c6ce69d4fce11486a40a1
SHA129ab26f5728f6ba6f0e5636bf47149bd9851f532
SHA2565e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
SHA5127eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
Filesize688KB
MD550e3f5a0e04cbd99d4be8cfe914c7bbe
SHA119d99ae964f490e055942d516c60dfdedc585825
SHA25689ed8cbc24723d67ac7e47d0d018ea293f15fc210d9b3e26dc555f464e9b15cd
SHA5122f67dbb41631b6134414d1685815daea7f38120d88f83cb8f83763cf18b1f6aa2b9a5a7eaef816eb8a24998536556128c15128b4e301b765c859a9741d69ba25
-
Filesize
23KB
MD503420408ace3977e3b7f4415b4a4e5a6
SHA1e0ea6ff8df8eacc5bf2bb108d86513d183fa1ff9
SHA256065788625d343c441890d8cbb2e25359484fcdd8911b77ffd797cd2f956067cf
SHA512fcb03161aa3a7a5db3a7faeda120cc79d98cf326ec38a039f38a04b085fe33294eb25a8f78dd10c4bb51059eb16e94d2dcc737441f50b5beb474ea098a46e3b2
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
221B
MD5d78493fc96ef866767796bbd71d2ae0c
SHA1b64d909f5225bc2dac6edf74c28567a17e1afdb9
SHA25663efa86fc0ea8f3ab0148678fb6f45e7ba166fe5bebaef124b4f051934b79c4e
SHA5124d21c92821960e46b34501a0ee53fa4db14cf0a14de8b772dfacc7dfc0398bfc393d223a2efb5c725e57b14174783dad71500fa3e1f2acc7824de3a4fbbf677d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD501469d86975d80da48c7adbe1c3727cf
SHA17d4d07f80a88928d7b8e54ba6fb59e9b7e3d5c1c
SHA256902833a88c63bf18bc32baebf9f2f987380a740f21a6e1f7ea60d0ff0554638b
SHA512c4e27e3dbcd463969a2793736a9126c8910e40556151f30d890b7f6c4422344f65e98c127c4113608fa5e3e7d0f06505772c11085e8e3c6ae9b45910d3fe451c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize727B
MD57cb686e6e2cd551cc1414d0f71c0fa65
SHA1a65a5caa1b1d77bfa6cc6eb7eb976812add8d58d
SHA25618bc957b344834d8dbea0ea7378a4fb3fd87a050f84907993f1b288a54d3be25
SHA5129cb19be5e3977ee7e96b02ae19f32dec419974f73b62c6e841fa67ae2b11e30a446c5fed84dc7ae2193d35b5f0912a9137986a436889be9f39e3686eadf7df05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD540482c80cbdb2016f964a54e6c803c08
SHA1514981e85af4f6d6aafc24080184091c69b1630f
SHA256d63a105634357b3e49d24c7e69b0b0bc5529859a71a93cfff85528c7802a53dd
SHA512ebdbd06353edbc52702d6ac8edb52ac7ff859888b1051c52e826c3c70773d6fab2fe7537229bdd1aadc8298810a8450a5fed8b655176de3a52bc460548bd875f
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD507bb556dc20677a5792ab5e58fa027d2
SHA10205d94b65867d47b8a6b122e0c1ab142092296d
SHA256734f3ca296b7dacc6b5586a18d99144d7d0d0a449ebe5fb2a6ac45c193d46976
SHA5128b9648da510a36d70b49a76557d438aa0ace75f9b5034e6cac0c52808130849d21272a6234093b3a7abb8e1ee437fc4122a88c0e6a7671c3446cc7caaf8af99b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD5d84801b2f7f23b4b5e2043c85d6cd2ee
SHA13339fc856fd67447f22c17e997a0b5f6c44dcd8b
SHA256ecdbfbeb8a6cb912fb9ce1d0ff9fd2f8d0af7c2982390977b495a51707c7660e
SHA5127254b26ab5228d6ace7fe0fda35a752138060d9441dc7477f178bde911fcc01f735de9284f4f6b1e492d570dc0961d4f4e022378db3827dd43625d9996c49abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd574b82c1f5425f84ba5510ce306dab
SHA1e527becafd45e283b1bd1715e3470ca54785d557
SHA256042b4bf4e0ba76f960d8ee2f3087535fa1d9b91ff5a195ec2f09478762db7ad8
SHA512834f752079c4c781b424e42c9682b4935906c9c3d3460de64f8b42739de5e2f8a52c4a65981cdf53f9243b8b91daab6d4431449fd496567f028d568184757d3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5716c91e6a9fa6a206228c93258443402
SHA1b27dd13b459cd6a2217eb176080048452fda9ce7
SHA256de382b0b713b1388fff07d2c841241bcb9cb2c055c24fe4b191bb924cef1f5f2
SHA512d321dbe9527bfe2599bffbbef304d04fca740f5a0d47a833bfe5450f87f75ee1f9533d202cd1ef6ba5e648bafa3e77d5407435b82cda9f557fcb2592474b5a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD59a136fc22082e2d26155f30a6f4bef4c
SHA13cf602aa7757eb8c13a26151c75b65693cb10ccc
SHA25604c554b9976fb5234728160d5e2ded5d70012e6d673ef481ee76cc3e15844651
SHA512518f5ae39dcb6ef123a3cf778ee3a377ac9f19d2f056d07c6876a35e7c805a839ff63cb0ac1c82b6f9762ad8622cab8af31b22c8ae7dba373936ea05fdab0b78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD530a9498a9bbf35ae430385c701b7b30a
SHA1356e4e6025020fd8488fe68073b5b0a0475cf437
SHA2560fc978e54a6227d56ab2c89b94e5bbdcc43d1167d4436baf377fb64583c86171
SHA512ba6a58cc86c8f972d912c5a6f606999a209ac660136a0c9793cbdb81fd3a3c3306e017635b0d4bb8be1e3e9ac6a7b7f2feb339a78d889b8fffeb6bead2440c03
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
2.9MB
MD5156ff43b54310c6f8eb4d1a7fda1a90f
SHA11f00b3e593a63abb8dc0e6aec58fc41f40a0a977
SHA2569f38e1f504a6dfdbe946619e02696c34ec37e4ee9cb992281f05d8bb103246f3
SHA512bf57a64120e3d026b5112706a3e1e7c11718f1a9aca61a301334a917de41b1b979bdea29710ebea6b1b13aa300baf5972dd21d12e34daf99566657553cf0bd64
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fae741d90fc17c89abc9c1beefe7c7df
SHA1a008e6ae2f0081f5fa5d80938e0536fa2ae49e30
SHA256c90afbb783d984c3d9e0c27b24f9420c3fafbc19dcff3a6799a65f8f06dd6a13
SHA5122c9feb282f625b5c16c89dee819c82d91337d4a86aa84892c69d2443dbbd904e0f0fc5e38587e0c4384a4a39160c546d3cdbdb3926ea6cb4956e85cd94465750
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5922bb85b9d1273e07c0f1df0109030d7
SHA18c727a4f25aea371499aed8e014c0eeb449eaac9
SHA2560e3847b444d5034dc6713c69171ce46cad51ec0c98df09d0ccefdf759e72bdd6
SHA51242ceb70f6075432d83b131bae26adf398b734a053834efdd3e4fb7fdae3c498890931a0d64d0e30f98ac11c2512a9cab7340d033053656cfab4f382d98c981ad
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c3836e1c08e8ecab253dfd3ae9b96ac
SHA10e5f6e4767346f0468b65fb0ce537213babe5e51
SHA25667cc544030ef460713f86c9d7e49b68cbd1f8150d624811ed169304cf09d7b8c
SHA51221881558238e5d41df9e4269f016525da92b0ed2ebd8e3d66440ddfa74063454b9336bf9950eca0ce0a981e2c02d75b66d08eed287f6dc7d661b2085b3808a74
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c365b45de3d9e6783587570e05b6b977
SHA1b2998e616a7226e3cf9ba6829c658902fda2c97f
SHA256db734e94ae96217e773609cef9c58c34201fe4c890fd8d2e02e9d1db260ae879
SHA51210b22d8c8df9ffcbdf253787fb1e99073edb928461cbe8a460d98e4082be59c49c29822d000c70a37be1d1a05babb433fa3087cd60261246819901c14ac17687
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56531f8637205d27cf7b34f7d6e20a53a
SHA103bd7a485185a6856e2f0239fca4abb8b5dee9f4
SHA256963982347bb21b550183280c38172e608e488470bc35a809b78a4eeab882de89
SHA51242b12741e8dfae5ee748147b4fd5ed4449acda351e638b4052800f164f4925216c4eac1df4d6a55aaf22aa2f9ff45b24881e63df21cd0413b42d3fde281e6ca8
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d7b69a711a53d7ce8db1b9766ebe98e
SHA16f6fb68c66c4b1881faf11f61544c67308f09a52
SHA256f933cbc5f629d07d83b713ac18034c5e1a9279781b4790ba41c3f26555f3a274
SHA512a187cecc3aacb9975169b336654a4c1507d1d16f7e057a7f9d9175dad3154299042124258dcf63719365bb0ebe30cf43e9686a338fa722358eb02bf7c98610a5
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c22fb13414d8ed88e3b25932462c2492
SHA11bd46d1ed5d8d856fd4212aa6bd4cabaf63bcc12
SHA256a143633be480f4515c1c368af7962d103417dafdfe18a866777e3ac5438e3128
SHA512a3c6c9a95ead6d09ff18f1a4ee661bdd57aed3dd67b0166f306e888d7f8a8d470dbaaea986dbbaec6254695c01a6f32cc4888162aeee4bb540f1d1697cf0770a
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566219b7fae599c2e72a6887ac959cc0f
SHA10c6dcdaf37728cc4711790a924dfef8c2a013fd8
SHA256c486af07fca8565181afa5242779d4643e1f5f674292616ad576bb0489e8e48e
SHA5127025d4909fa4336c7e71c10db186bbc6ba706132f24fb0ecee28abedc49e0004bc4fb0e5fcd6c9d75a27b50f8d657c0d8a0b1d1860429819c084b28ca535e152
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5818eed3a3e0256e17ae57c895d51c698
SHA1588ce5090741d91a5c3ed9a925ebc66ef3deb1ac
SHA25692152b927b528c04aa7f29de0b02f73292eff1f57bc3159ecd502a76b976bc58
SHA512bed64fc896d34f676280e6133fb68c3f951a0518f5a41eeb91d09d964a053558558b2a18e72a6f0e2f06b3b6577eea9bed8e8cdb6a048a63fecf9d95ae3f7239
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9a21ed00baf2f0eb9547ce857fe7908
SHA13f364941d12f79299cf769e381801b1011e9a1a6
SHA256f46a29cff013c5f8c5d25fdcf3ff8114f9c5198bae30814bca509f6d4fcab394
SHA5125e4d53566af4966b81141f163f378c21eea0b82f38677cba5dc9e975343b1eaee35674d32efd8e541c4268e359d7a189b0b79e490e4811ea610d2a17d6b74a1f
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec4f441124e0fc3adcbb35a09166073c
SHA19e2add4cda9be7c3d46b2ac454c9fd4aa96abd1f
SHA25687cfa439dcea39c1aa81123e64b8b2670036d07905b67bf504ead7ad1493d713
SHA512e038b63edd3f13dc9897334c9c976ed59d50f2c8b78255ffe7af80a55578f167d8f4d1f339675f41d89e3b1704de2d5235b6ed99489ab4fc113c12d3231c66e2
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed487b72d6bf414461d1f7eab99128c9
SHA1e43fc01edf6ccfa1ff83fc3152c3457271b5c35d
SHA256f2d0c59b8487f4622240e3268a3745a47b1e98be40075b74338d493b7c20f4f4
SHA51262254a226c8ffe9fcbe1e8e1bacf7abe991a08147b3cb6f5ebbdecab94a0da655eeddb80cce29a2047daba3645216fc9f18941a1f365875a881f253d0df2b356
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e22dd92a77db88aaf10de69b20c3c31
SHA1a9761f497c2cf4cc42e676a010279c0e819bd5ed
SHA25674ec7adc498f87ac76bf331aa2662abd48194ec58a904d8fd8f0c9cb3367f754
SHA512d228929ff74caeade4d040169cd538501e8c8332e2a9ea4a86233fe3e4de750e635b6806122c4173962e2d6cbf348ae359f9ac9b7e1fb7beec36adfd3ddc1e89
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5731e923abcc2c8fdd033cc68d4f79df6
SHA18fce81661ca758cb38f8c7c67b27f7f34c80b654
SHA256e36b43d4289e1a13ac0511444874f789f5545b7cd2da2025a6350496139e8ae6
SHA512936bfcabd7eb7c90ea626552fb70d61b144b9bbc96941e503f55d83f37fce53e80aa20007723ab7f8dde4b1ae74b842804df77832df43e9d50180c037855d124
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d1ae1c759781cd9f26471fc82d082d9
SHA1dfd064f5cf1a6bf91baedb77e04cbdbe82798b89
SHA2567efb1236dfaab0f4f35e6ca5dce8eb393f8f25e276c03849ff9eaef4195ab309
SHA512cbf0112ecdc6fb9ae534b76768fd6423002a96183c3b325215da803d232b1d512a6b4803a90f0abbb4f9d397c67519b82119a2302bedbebdae06b75c9cc67ae1
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57690f77142dc83e8ba39e2e64386c07d
SHA147eba41fb3fad7ddb48f0518078e6592d4aa03b9
SHA256e4650057a337c9be990beb52144d3aaf7549a76078de01834bd4daf709cce72d
SHA512c3cf9cde96732df06702f41ad7da190b01da4e7ec9f4f399b5392c1e9575e9170aa23cdbe71d00a3848c6156bb6dcdf1d6e6110f2851cecb5337238dccecb45a
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0