Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 18:04
Behavioral task
behavioral1
Sample
z1eCAC2025.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
z1eCAC2025.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
z1eCAC2025.msi
-
Size
2.9MB
-
MD5
30c87bf81a6b9da8c2d2196d4471f056
-
SHA1
a8c45bd3cb66256a07ba8c4047aa88db5c72c50b
-
SHA256
40c90476979303f54df8bf6ac6ba10a252623cf18519b492b77d8988cb6bd216
-
SHA512
066c4c9922994259cdb62d9cbc21fa6e63b1c765a18a1c4e94b1741e60b580ddb132134f13d6ad0f86285c618243ca6849dc5aac92fb8b8be014610a6159bf06
-
SSDEEP
49152:N+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:N+lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023c5c-240.dat family_ateraagent -
Blocklisted process makes network request 4 IoCs
flow pid Process 6 2932 msiexec.exe 8 2932 msiexec.exe 26 2204 rundll32.exe 47 3116 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll msiexec.exe -
Drops file in Windows directory 35 IoCs
description ioc Process File created C:\Windows\Installer\e57e35b.msi msiexec.exe File opened for modification C:\Windows\Installer\e57e35b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE426.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE7F0.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI179.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIE426.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE426.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF522.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF5AF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI179.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE426.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE7F0.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File created C:\Windows\Installer\SourceHash{E732A0D7-A2F2-4657-AC41-B19742648E45} msiexec.exe File opened for modification C:\Windows\Installer\MSIF521.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF69B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI179.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE426.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIE7F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE7F0.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIF2AF.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE7F0.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE7F0.tmp-\System.Management.dll rundll32.exe File created C:\Windows\Installer\e57e35d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI179.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI179.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF2AF.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI179.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF2AF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF2AF.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF2AF.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIE426.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF2AF.tmp-\Newtonsoft.Json.dll rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 3984 AteraAgent.exe 2708 AteraAgent.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3124 sc.exe -
Loads dropped DLL 31 IoCs
pid Process 2876 MsiExec.exe 1492 rundll32.exe 1492 rundll32.exe 1492 rundll32.exe 1492 rundll32.exe 1492 rundll32.exe 2876 MsiExec.exe 2204 rundll32.exe 2204 rundll32.exe 2204 rundll32.exe 2204 rundll32.exe 2204 rundll32.exe 2204 rundll32.exe 2204 rundll32.exe 2876 MsiExec.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 2876 MsiExec.exe 1796 MsiExec.exe 1796 MsiExec.exe 2876 MsiExec.exe 3116 rundll32.exe 3116 rundll32.exe 3116 rundll32.exe 3116 rundll32.exe 3116 rundll32.exe 3116 rundll32.exe 3116 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2932 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001a73a27760024bf60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001a73a2770000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001a73a277000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1a73a277000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001a73a27700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Kills process with taskkill 1 IoCs
pid Process 1312 TaskKill.exe -
Modifies data under HKEY_USERS 55 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "z1eCAC2025.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388" msiexec.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4668 msiexec.exe 4668 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2932 msiexec.exe Token: SeIncreaseQuotaPrivilege 2932 msiexec.exe Token: SeSecurityPrivilege 4668 msiexec.exe Token: SeCreateTokenPrivilege 2932 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2932 msiexec.exe Token: SeLockMemoryPrivilege 2932 msiexec.exe Token: SeIncreaseQuotaPrivilege 2932 msiexec.exe Token: SeMachineAccountPrivilege 2932 msiexec.exe Token: SeTcbPrivilege 2932 msiexec.exe Token: SeSecurityPrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeLoadDriverPrivilege 2932 msiexec.exe Token: SeSystemProfilePrivilege 2932 msiexec.exe Token: SeSystemtimePrivilege 2932 msiexec.exe Token: SeProfSingleProcessPrivilege 2932 msiexec.exe Token: SeIncBasePriorityPrivilege 2932 msiexec.exe Token: SeCreatePagefilePrivilege 2932 msiexec.exe Token: SeCreatePermanentPrivilege 2932 msiexec.exe Token: SeBackupPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeShutdownPrivilege 2932 msiexec.exe Token: SeDebugPrivilege 2932 msiexec.exe Token: SeAuditPrivilege 2932 msiexec.exe Token: SeSystemEnvironmentPrivilege 2932 msiexec.exe Token: SeChangeNotifyPrivilege 2932 msiexec.exe Token: SeRemoteShutdownPrivilege 2932 msiexec.exe Token: SeUndockPrivilege 2932 msiexec.exe Token: SeSyncAgentPrivilege 2932 msiexec.exe Token: SeEnableDelegationPrivilege 2932 msiexec.exe Token: SeManageVolumePrivilege 2932 msiexec.exe Token: SeImpersonatePrivilege 2932 msiexec.exe Token: SeCreateGlobalPrivilege 2932 msiexec.exe Token: SeBackupPrivilege 1924 vssvc.exe Token: SeRestorePrivilege 1924 vssvc.exe Token: SeAuditPrivilege 1924 vssvc.exe Token: SeBackupPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeDebugPrivilege 1312 TaskKill.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2932 msiexec.exe 2932 msiexec.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4668 wrote to memory of 1296 4668 msiexec.exe 94 PID 4668 wrote to memory of 1296 4668 msiexec.exe 94 PID 4668 wrote to memory of 2876 4668 msiexec.exe 96 PID 4668 wrote to memory of 2876 4668 msiexec.exe 96 PID 4668 wrote to memory of 2876 4668 msiexec.exe 96 PID 2876 wrote to memory of 1492 2876 MsiExec.exe 97 PID 2876 wrote to memory of 1492 2876 MsiExec.exe 97 PID 2876 wrote to memory of 1492 2876 MsiExec.exe 97 PID 2876 wrote to memory of 2204 2876 MsiExec.exe 98 PID 2876 wrote to memory of 2204 2876 MsiExec.exe 98 PID 2876 wrote to memory of 2204 2876 MsiExec.exe 98 PID 2876 wrote to memory of 1172 2876 MsiExec.exe 100 PID 2876 wrote to memory of 1172 2876 MsiExec.exe 100 PID 2876 wrote to memory of 1172 2876 MsiExec.exe 100 PID 4668 wrote to memory of 1796 4668 msiexec.exe 105 PID 4668 wrote to memory of 1796 4668 msiexec.exe 105 PID 4668 wrote to memory of 1796 4668 msiexec.exe 105 PID 1796 wrote to memory of 1152 1796 MsiExec.exe 106 PID 1796 wrote to memory of 1152 1796 MsiExec.exe 106 PID 1796 wrote to memory of 1152 1796 MsiExec.exe 106 PID 1152 wrote to memory of 976 1152 NET.exe 108 PID 1152 wrote to memory of 976 1152 NET.exe 108 PID 1152 wrote to memory of 976 1152 NET.exe 108 PID 1796 wrote to memory of 1312 1796 MsiExec.exe 109 PID 1796 wrote to memory of 1312 1796 MsiExec.exe 109 PID 1796 wrote to memory of 1312 1796 MsiExec.exe 109 PID 4668 wrote to memory of 3984 4668 msiexec.exe 112 PID 4668 wrote to memory of 3984 4668 msiexec.exe 112 PID 2876 wrote to memory of 3116 2876 MsiExec.exe 117 PID 2876 wrote to memory of 3116 2876 MsiExec.exe 117 PID 2876 wrote to memory of 3116 2876 MsiExec.exe 117 PID 2708 wrote to memory of 3124 2708 AteraAgent.exe 118 PID 2708 wrote to memory of 3124 2708 AteraAgent.exe 118 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\z1eCAC2025.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2932
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1296
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D57C622155748AFE2FAA8E7D294DF77B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE426.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240641343 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE7F0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642078 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF2AF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240644812 11 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1172
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI179.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648578 33 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3116
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BCA450DF98AB2FDBFAF235BD184FB634 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:976
-
-
-
C:\Windows\SysWOW64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000PPiXTIA1" /AgentId="630eb188-fe06-4612-99fc-459e9ef621f5"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3984
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:3124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD509026562cba442cece5fc8219dc1785c
SHA15041cc94d6a1643c184453b12d6bad61252528f9
SHA256b6a740f16411dd2fb6e206d5e47635cb15fbfe3133f8a82c29a131f1b7239894
SHA512058a28496ba4f706cef825669bf01c76102f10bba444a65fb1bceb595afbd8ba4c8a750ffd729d5bf22688b590ec15a94c51026dbd5262f15adecaf6391b4426
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
230B
MD57f31f44e7c0aa9f8e94c512b5f1fc42f
SHA15466ec1274e9da364b9b724578a8b28c36c2f3e4
SHA2565652f9bcff6f66773ada9c5697f70b7e0442855bb3d6567fca5ba32bf73d09b3
SHA5124e5e923a5a5cd3f67d09dfdd23a2b1bc0a51e2b123b2962996fe9c39851a31313657a3a90294008193fbd14d3f43e1cfa3ad0addb4c4e824eb41d5c427bad41e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD541496eaec47272bc95bb0a2ff717dcbb
SHA16a80c926fcb5097a2b9cb44b44426cc34a56c3a4
SHA256a205e3357e1c87894c1725a526ea734f7dd97d0813a0b79d296f7ea083105614
SHA51230c2d43a40136ae6d88a79406b18f17b6fcde440d59130a92b9bd2f21af69e7b1c0b73d875f8bfd7503f69916540d7aefb205646a43bfa4b6f5fdaa552a4b9ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize727B
MD5d67fdd580bd145b76a8f83dd774ab70d
SHA112915b1143c9e9dac224c2ea04c9f72fa5740604
SHA256f67e7df704b8bef35c0a8a2262748acf50d6535fdcfeb5491df175f17887b4aa
SHA512d772faf89a1399692c7d38cb70f2c56b3574f93fcad82f33259523ea8f3789c5433d2d3130bc643757f5fb1afc9f986bba33971bcb189f7e7da3eba148ddf8e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD516c24216150e1a905e10b2e8d548347c
SHA15c4368666496e27bd6d6bd0d8f272cb4ffb49782
SHA256d2a211d804241dbd3bb351b41b439f024aa630aab63ccba213147264d5da8a64
SHA512f06d505c516c76a3d4a16d908d7603cebb6c78ea58b75d1d5b44a252a0866a80968786b00b85ac23045921e8f561b64ea4be00793ea27c770da4e4c3ede65af8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD5aec7461a3cc93e07882f847ac4abef30
SHA19e97887c5ea2ad48fa95884493bb3586f0c774d7
SHA256dbf965c68a21a0afad35e94dc5a3881689b752edca145d983e08bac9576e4251
SHA512339c1f1429945e519a1103e5414c9e55c0f35c5f9bc71c287ae7dbb00eeb89404349ff04e68145980e5beba4341e6f1716b0c2219a5ef689ba748d73ed447ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD54049c9dd7d85dc46c0330b145be998e4
SHA10023eab42dfb14668dc5f88124349428ba63002e
SHA256d640c565813680e7c37cd42248491c8727499319b17f74314a4a13b73e44f654
SHA5125960f0fe84fef1730f20899e2177bf3c2f4dd0d31d3ae2575b8d3a972cd45553c026dd07b009d40842aa59407c623b8cb18f0c2c19f8345224c4cc06b1ad11cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5ec25f6f02cbd78885c812cb14f9fa5da
SHA1380b4cbbc73bb25dba6bcfa8246af1f2c2adc2db
SHA256e6e8c6b1885a52b72fa538d702da8c0bcb35834ce0d09871803f52d1c7a1672a
SHA5123789face23ded0146ccd5f7413be9f470674e08bd18bb2d73d68f9e6a56aab36ac97be7f66e642a12d99c17a34555ad01dd0c8eab0e4427bf83c8c815e233ee9
-
Filesize
651B
MD59bbfe11735bac43a2ed1be18d0655fe2
SHA161141928bb248fd6e9cd5084a9db05a9b980fb3a
SHA256549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
SHA512a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
2.9MB
MD530c87bf81a6b9da8c2d2196d4471f056
SHA1a8c45bd3cb66256a07ba8c4047aa88db5c72c50b
SHA25640c90476979303f54df8bf6ac6ba10a252623cf18519b492b77d8988cb6bd216
SHA512066c4c9922994259cdb62d9cbc21fa6e63b1c765a18a1c4e94b1741e60b580ddb132134f13d6ad0f86285c618243ca6849dc5aac92fb8b8be014610a6159bf06
-
Filesize
24.1MB
MD5a44516cf9c39ed0d8fd630981ebc8cfc
SHA1b6ce17eb69719cdc0715fb47b250344742126da0
SHA25625f560537b17065dfc402aedd2d01a888d573ada283031dc8a3ce79e9a35cc88
SHA51272c11e2db2c191a302ac0c36e8e30251d800fb86a3c39c5128f75311322deefd8d0276571fdb071abda8c7fd4efc790ed5408b13483711fe689625a117122889
-
\??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{dc218008-2931-4328-ae07-3fd92179be72}_OnDiskSnapshotProp
Filesize6KB
MD5dc2393b7338ac9d76673909b353024bf
SHA1186aa0e28c8efc4f6df988b3d1eeadaf79c0681b
SHA2566d0d54c53e75664a19d791e64bbec05090fc22246f87f9565a363bb9dd16be55
SHA512f978246a5d344644cb6452c671e140b54f3451cf0f7fe8faa8ec6ce4df3f061f4ac90c2ae4018c5492e3ddef0b4ed782c0703f297a19a19028449513b9a6d13b