Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 15:01
Behavioral task
behavioral1
Sample
z65NF-E.msi
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
z65NF-E.msi
Resource
win10v2004-20241007-en
General
-
Target
z65NF-E.msi
-
Size
2.9MB
-
MD5
7c2346e58afd0cc0337fc935cd41d9c4
-
SHA1
32189bee035e465d2df8bb15c5d168f8eff6f187
-
SHA256
9219d0815a0320d65356c84003ea6d80935ebf855d2b7fbda79c4f38057a1e78
-
SHA512
b7267d28ec63ce3b3a2bd247094bf1a4cc8891549a4d43f8875ba1e37f97f3a1a6bddcbc8f9be009fc12a3836dd9d759394ec5a38ef87c8425990d42ce3cb9e2
-
SSDEEP
49152:M+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:M+lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
resource yara_rule behavioral1/files/0x00340000000194e9-407.dat family_ateraagent -
Blocklisted process makes network request 7 IoCs
flow pid Process 3 2680 msiexec.exe 5 2680 msiexec.exe 7 2680 msiexec.exe 11 2336 rundll32.exe 12 2336 rundll32.exe 18 1744 rundll32.exe 20 1744 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416 AteraAgent.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416 AteraAgent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll msiexec.exe -
Drops file in Windows directory 37 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI67D3.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI479D.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5CA5.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5CA5.tmp-\System.Management.dll rundll32.exe File created C:\Windows\Installer\f77470f.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5E4B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5CA5.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5E5C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5EFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI67D3.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI67D3.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI479D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI479D.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5CA5.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI67D3.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f77470e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5CA5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5CA5.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI67D3.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI479D.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f774711.msi msiexec.exe File opened for modification C:\Windows\Installer\f77470f.ipi msiexec.exe File opened for modification C:\Windows\Installer\f77470e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI479D.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI5E8D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI67D3.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI479D.tmp-\AlphaControlAgentInstallation.dll rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 2548 AteraAgent.exe 1568 AteraAgent.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 904 sc.exe -
Loads dropped DLL 35 IoCs
pid Process 1416 MsiExec.exe 2004 rundll32.exe 2004 rundll32.exe 2004 rundll32.exe 2004 rundll32.exe 2004 rundll32.exe 1416 MsiExec.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 1416 MsiExec.exe 1016 rundll32.exe 1016 rundll32.exe 1016 rundll32.exe 1016 rundll32.exe 1016 rundll32.exe 1416 MsiExec.exe 3036 MsiExec.exe 3036 MsiExec.exe 1416 MsiExec.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe 1744 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2680 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Kills process with taskkill 1 IoCs
pid Process 2764 TaskKill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AteraAgent.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "z65NF-E.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd AteraAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A AteraAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 AteraAgent.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2648 msiexec.exe 2648 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2680 msiexec.exe Token: SeIncreaseQuotaPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeSecurityPrivilege 2648 msiexec.exe Token: SeCreateTokenPrivilege 2680 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2680 msiexec.exe Token: SeLockMemoryPrivilege 2680 msiexec.exe Token: SeIncreaseQuotaPrivilege 2680 msiexec.exe Token: SeMachineAccountPrivilege 2680 msiexec.exe Token: SeTcbPrivilege 2680 msiexec.exe Token: SeSecurityPrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeLoadDriverPrivilege 2680 msiexec.exe Token: SeSystemProfilePrivilege 2680 msiexec.exe Token: SeSystemtimePrivilege 2680 msiexec.exe Token: SeProfSingleProcessPrivilege 2680 msiexec.exe Token: SeIncBasePriorityPrivilege 2680 msiexec.exe Token: SeCreatePagefilePrivilege 2680 msiexec.exe Token: SeCreatePermanentPrivilege 2680 msiexec.exe Token: SeBackupPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeShutdownPrivilege 2680 msiexec.exe Token: SeDebugPrivilege 2680 msiexec.exe Token: SeAuditPrivilege 2680 msiexec.exe Token: SeSystemEnvironmentPrivilege 2680 msiexec.exe Token: SeChangeNotifyPrivilege 2680 msiexec.exe Token: SeRemoteShutdownPrivilege 2680 msiexec.exe Token: SeUndockPrivilege 2680 msiexec.exe Token: SeSyncAgentPrivilege 2680 msiexec.exe Token: SeEnableDelegationPrivilege 2680 msiexec.exe Token: SeManageVolumePrivilege 2680 msiexec.exe Token: SeImpersonatePrivilege 2680 msiexec.exe Token: SeCreateGlobalPrivilege 2680 msiexec.exe Token: SeBackupPrivilege 2388 vssvc.exe Token: SeRestorePrivilege 2388 vssvc.exe Token: SeAuditPrivilege 2388 vssvc.exe Token: SeBackupPrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2856 DrvInst.exe Token: SeRestorePrivilege 2856 DrvInst.exe Token: SeRestorePrivilege 2856 DrvInst.exe Token: SeRestorePrivilege 2856 DrvInst.exe Token: SeRestorePrivilege 2856 DrvInst.exe Token: SeRestorePrivilege 2856 DrvInst.exe Token: SeRestorePrivilege 2856 DrvInst.exe Token: SeLoadDriverPrivilege 2856 DrvInst.exe Token: SeLoadDriverPrivilege 2856 DrvInst.exe Token: SeLoadDriverPrivilege 2856 DrvInst.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeDebugPrivilege 2336 rundll32.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe Token: SeRestorePrivilege 2648 msiexec.exe Token: SeTakeOwnershipPrivilege 2648 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2680 msiexec.exe 2680 msiexec.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1416 2648 msiexec.exe 34 PID 2648 wrote to memory of 1416 2648 msiexec.exe 34 PID 2648 wrote to memory of 1416 2648 msiexec.exe 34 PID 2648 wrote to memory of 1416 2648 msiexec.exe 34 PID 2648 wrote to memory of 1416 2648 msiexec.exe 34 PID 2648 wrote to memory of 1416 2648 msiexec.exe 34 PID 2648 wrote to memory of 1416 2648 msiexec.exe 34 PID 1416 wrote to memory of 2004 1416 MsiExec.exe 35 PID 1416 wrote to memory of 2004 1416 MsiExec.exe 35 PID 1416 wrote to memory of 2004 1416 MsiExec.exe 35 PID 1416 wrote to memory of 2004 1416 MsiExec.exe 35 PID 1416 wrote to memory of 2004 1416 MsiExec.exe 35 PID 1416 wrote to memory of 2004 1416 MsiExec.exe 35 PID 1416 wrote to memory of 2004 1416 MsiExec.exe 35 PID 1416 wrote to memory of 2336 1416 MsiExec.exe 36 PID 1416 wrote to memory of 2336 1416 MsiExec.exe 36 PID 1416 wrote to memory of 2336 1416 MsiExec.exe 36 PID 1416 wrote to memory of 2336 1416 MsiExec.exe 36 PID 1416 wrote to memory of 2336 1416 MsiExec.exe 36 PID 1416 wrote to memory of 2336 1416 MsiExec.exe 36 PID 1416 wrote to memory of 2336 1416 MsiExec.exe 36 PID 1416 wrote to memory of 1016 1416 MsiExec.exe 37 PID 1416 wrote to memory of 1016 1416 MsiExec.exe 37 PID 1416 wrote to memory of 1016 1416 MsiExec.exe 37 PID 1416 wrote to memory of 1016 1416 MsiExec.exe 37 PID 1416 wrote to memory of 1016 1416 MsiExec.exe 37 PID 1416 wrote to memory of 1016 1416 MsiExec.exe 37 PID 1416 wrote to memory of 1016 1416 MsiExec.exe 37 PID 2648 wrote to memory of 3036 2648 msiexec.exe 39 PID 2648 wrote to memory of 3036 2648 msiexec.exe 39 PID 2648 wrote to memory of 3036 2648 msiexec.exe 39 PID 2648 wrote to memory of 3036 2648 msiexec.exe 39 PID 2648 wrote to memory of 3036 2648 msiexec.exe 39 PID 2648 wrote to memory of 3036 2648 msiexec.exe 39 PID 2648 wrote to memory of 3036 2648 msiexec.exe 39 PID 3036 wrote to memory of 2688 3036 MsiExec.exe 40 PID 3036 wrote to memory of 2688 3036 MsiExec.exe 40 PID 3036 wrote to memory of 2688 3036 MsiExec.exe 40 PID 3036 wrote to memory of 2688 3036 MsiExec.exe 40 PID 2688 wrote to memory of 2588 2688 NET.exe 42 PID 2688 wrote to memory of 2588 2688 NET.exe 42 PID 2688 wrote to memory of 2588 2688 NET.exe 42 PID 2688 wrote to memory of 2588 2688 NET.exe 42 PID 3036 wrote to memory of 2764 3036 MsiExec.exe 43 PID 3036 wrote to memory of 2764 3036 MsiExec.exe 43 PID 3036 wrote to memory of 2764 3036 MsiExec.exe 43 PID 3036 wrote to memory of 2764 3036 MsiExec.exe 43 PID 2648 wrote to memory of 2548 2648 msiexec.exe 45 PID 2648 wrote to memory of 2548 2648 msiexec.exe 45 PID 2648 wrote to memory of 2548 2648 msiexec.exe 45 PID 1416 wrote to memory of 1744 1416 MsiExec.exe 47 PID 1416 wrote to memory of 1744 1416 MsiExec.exe 47 PID 1416 wrote to memory of 1744 1416 MsiExec.exe 47 PID 1416 wrote to memory of 1744 1416 MsiExec.exe 47 PID 1416 wrote to memory of 1744 1416 MsiExec.exe 47 PID 1416 wrote to memory of 1744 1416 MsiExec.exe 47 PID 1416 wrote to memory of 1744 1416 MsiExec.exe 47 PID 1568 wrote to memory of 904 1568 AteraAgent.exe 48 PID 1568 wrote to memory of 904 1568 AteraAgent.exe 48 PID 1568 wrote to memory of 904 1568 AteraAgent.exe 48 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\z65NF-E.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2680
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DD0A7A11CC1A5E138C0A9155211D8222⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI479D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259475542 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2004
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4AC9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259476228 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI5CA5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259480768 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1016
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI67D3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259483607 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1744
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D0D929CE8CC0E92746357827AADC9914 M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\syswow64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:2588
-
-
-
C:\Windows\syswow64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2764
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000Pps1uIAB" /AgentId="eb03b5dc-f81d-4237-a174-2f50141db787"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2548
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003F0" "0000000000000564"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:904
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b796f609c827092c73162d1b93c9080d
SHA1fee144dcf61df2b0481286578aa15ee8a678d9c2
SHA256a75fb3d62f0fd9a35aecf0f52e4befdc659dea31662c9e166b42dfc5c772cb6d
SHA51226254e4e5d3f766a6f7a11cd1bb4c4908522c58c7c26f7e1b410ac9c3f9c9b44e96f7ce6c7ddd7ac4d657715d093050903b5d70cc7a6efb52364fc734bdf0e62
-
Filesize
753B
MD58298451e4dee214334dd2e22b8996bdc
SHA1bc429029cc6b42c59c417773ea5df8ae54dbb971
SHA2566fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25
SHA512cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
225B
MD56f95062490ff7f5ae722a39017c0c3be
SHA181fb7a0b202b52ae4110d13493c5d63c01d459f1
SHA256fb09f0668407d1be6eade54f9182859d320bfabb0e2d725be7a9aa9ee02fbcf1
SHA5121da2798b9918a6cb65e64b2ad6627db4f8cdd6beebc3c6bc15978b95954c8deaf31f76c3b2cdd036163baaa62bd28c2b637f0dacb266fec2ee83adae489cee30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5b37eee2552522d51b5d8045e6397c56a
SHA1df7cede952d9088326533e0675f9af3a0412cb2e
SHA2562f47246e72e3f6cc3e5172cc555fbf2bf4a018653a8b0f7ef36a437a149c2c88
SHA512189c7961e872c9001c5decf65113076adb7b3b76a43d047d34308b61082e0b59aa90182c3f53e87432233e731259bb590a0ef18f3ab173da7212d9b5ba701a97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize727B
MD5e10202b6ab0b7420d6e690fb0b5f855d
SHA13a9f90af05c5e932c67aef0beb35464e99713991
SHA2561063967df0b5d68609eb4da57043fce6fcde597f420e401ac009ee5378db88f6
SHA51223bb38b05986566e73d59db162a4d8b1f9aa0396aa996f0f675f9dd29ec0835e930b1346d1315119a82903aa8db7318c5da164cd5cb26c847991c1c1ea05eee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5b56ef82c98008d1730d873e5b1216f0d
SHA17932ff198c39e5ca5d46d513e22c7907e8282fd4
SHA256b7a65caf0de8c757ba1d28eae861fcbd0e5bdf53fea7af1d25260edcd523eaf5
SHA512aebf1a3c7d6b4a5b18aca73b073a15d00b0a3ae1de756e827e85833a6d96ca78e13778577869be4cb0f6d10cfb6a1409205920030fb4ed0fe45c14446d4e9a60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD55d7889cfff52ea2def160bc9219796ce
SHA1344575c8a737f311ca912c76db7bd1c36efcddc1
SHA2569e810543b6a674aaaa211248f78da413c6b75174d16c047a07f94ca7399970bd
SHA51228335fe19e9228894db82ddd57b173256107944fed5ce209a7e86fefdaded388f0944c6e5e3b9fffdc2e374dcba74b209c71f9eca4d13f14871c351a2400f3ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD50e879195270c17f65c7383df76390375
SHA1eee33b0dc07b9542e5cbf0ce27422765ad1fd4d8
SHA2565d7b80c4010b0c61b3d478a2d058d252e370c7d0ba171a8e0bfd07516af9ec2f
SHA5127a466d167bc1464605c82673c90b2c53d9dddb5d2730ea8d2e577fcb3d877c72c28f9eb631a6cdb67e1449a2a63307e4f23bbd5dd67cc86ffd96a9fa2d49906b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591a27db884eaac6acfcc7a8d1acf4252
SHA1bea2880cc22a9d6d50d91740725895e95a013e9b
SHA2567147db0c9ad1d0d95bea5de85e98e428ba6a82ba015204640517a73dad95ad6c
SHA5128c825ac93a565a61015108197546c77e1d9c98184b902ad7d3f7481bf6586cb5fea58cf0f333040e06291a0d79ee5dad406023c17df7c022e6c6b2cf2cf0e026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d52e5f87d182d5eb9536eefd83624607
SHA19516dc65934995e82fa09437202c165a56825886
SHA25687054e18e625238939347aefe3c7f289825b150d166882c6842395bd118e244d
SHA5120a09e64fdf5f1468e5ea50967e7c2ec6747212736e06746dd0359d27a4bd05eb567dbe396e0041a442677e50596c0c7483021148d84287e0195fe6dce6647c89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD5518f2f039da5dc0e84f1fb72b755f919
SHA1ade74539919ca7b26eb3c48f45ec218df80bd6bc
SHA25633ba3c40731224385270a48af500abf142dfdeb873ccdb0fc289e6cd9828bed0
SHA5125595a8882369974d6f591ba8c4c7380a827ad4376ac8b033bd39a307f000c7a36c2c0290014e63a1923341127eb1a471b458415a1bc7d325de3670914d9a26c9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
2.9MB
MD57c2346e58afd0cc0337fc935cd41d9c4
SHA132189bee035e465d2df8bb15c5d168f8eff6f187
SHA2569219d0815a0320d65356c84003ea6d80935ebf855d2b7fbda79c4f38057a1e78
SHA512b7267d28ec63ce3b3a2bd247094bf1a4cc8891549a4d43f8875ba1e37f97f3a1a6bddcbc8f9be009fc12a3836dd9d759394ec5a38ef87c8425990d42ce3cb9e2
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555099376a4be42cb04632f8b6caaf7de
SHA1c0dd4d67d8e58246260d2124323d46f81081f3d4
SHA25669027ce332e30e683da9e5610f88754f93d559c1d9678083e2c45f2f4e0f01ee
SHA51265d023e703c5e7e8ab566d21e8582aa19b1d52892a1a443746e00b86b6afcd7dd35db620e09a7d7cd88e1b426efcf4cfaeee79f4b7abbd55394429ee5010e183
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a00d5c034c3ecbc9b6b80a4fe4950a29
SHA16f4547138cff12d3545e8986adb382dd613b311a
SHA2564213c98e32e05d8895192d7fd6fdb04e8b6bc6f985c6dfdad363b3e7314f43aa
SHA5127167b24f855532fd99abf7482c0a08db04f2507c9667f452aeaaaa22c63597f489ca1df690da6d6f8af30eaf89ee00ae5f9f78cc02aed6b066fa99fc19ebe3c0
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587c8d47b8c9b99c59aa2e96c0f934beb
SHA1e5eaecc4283c80c48c490a7057907372c3ef0ab3
SHA2560d6e04cd8db13c5a74752a1f1d634c0c4c0f12a84949abdae1af189ff4c944e1
SHA51217e504e0acfd2d2fcce8312d240a70f8e1583a91b6150825249d3f5dccddf54e593098fdce7e58ec17c4319866ae1c8ee41dea0272881b1c6772046b58720530
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56051fd95e8b95279b57337af997736fd
SHA10958f51b0bac596201b0368fd0c5d8879627bb07
SHA256d2fd916f2f2719e62f0aa4030cf159b1a81b888aff96b4f576ca9f311afe179e
SHA512ca6f65356df2eeb0c2caafea603a16259b2ba3137343fa47eb735bd353fd7f8a23e6602fafb0cfb028e17aed8e29980a0bcab19bd23b79d03c6fd29b6d9880b7
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b4e7a69c2327e72f41206a777e15b2d
SHA109620d31f71a7d49c672e2d7296ee763331e8360
SHA2567afa7550de53c3502f662b720b6f06304bcb36f484763a1230320ae9671f0c14
SHA512b5ccd92bf9f7dc0dc36b37f27edaa0f6db83887a56e60f8785b89c802f04342467a2664ff6f52142a97a0132784dd706ed29bf9359e7abc4902ae5c9d06145c1
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e37d903e5350724f4343b738d619ad0
SHA1d972853ad2a9771ab612d2582ab0242e9e6ac1b3
SHA25679fa1c015c83fe4cf4ff35e1d8311f0b2c3518c8b5f9b581d4a3948bbe4b6c62
SHA512d5915ec71438c0790bc3af4e37aa8ef24ec7ee0e4d359da413516b3596c9d9a7171014b847cb0b498a88014fb0e77ad3905af9e86dac7fc3a54053cf71c9abae
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f451648ba203602f3e436957d1e329d9
SHA16bf1b2662d708aad2c9137e622962baf6bdf5028
SHA256beea9af1d7e02e7695698aaaab30dcaba493f95a1af0cf1878686fea93c4edce
SHA5125e21b22ec0256de324e4a77d63a7895ac0f298913923911870fffdcf1fdc2a7003b65cee89b51d8d4c2187e7c4138486ff829089c914efe86cf89e84bc06a76e
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594a90f797cfcd4f8b4a341b49a45bee3
SHA1158b44671412c9cef20a9a204a3a4869a031ab5f
SHA256c415795e806d6800d2f95bc81f1d803d8ebffaa6c18e360730373ffb0c56e7f8
SHA512b9d423ae978639c1ef0c9b8fbf218e0cd5a96163f451d2ddee519501fa672fbf5c3c1b9b827f301f4128858801f8727749a5e7431f88395c2fcbc2deff7cda41
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524ac2ae77e8a2d648b7619f9b3d6a284
SHA1ff91f01b7345693c6a8dc5255bb348ea04e178b9
SHA256aa8260b2a5e17269a570c020353e7cb6bff40f8bf1ff1d7b4f7437e244733a41
SHA512a870b2eb7247d6341ca7665c6bb5f98b43e9b359515c84b28efb244ccc85b0a8e97af47310a93dd3f0ef4374194db8f601baa521a871978e9cfbfc8fcfecc160
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d184ac18a9ae40bcb4c0b27c37541f6
SHA1ff6452bed4df719e44c1f5054b67b0cac98562f1
SHA2566dc4a7de64c03e58d9b5618d614304c37b6b883ca11154ac0d3c6a8a926a48f6
SHA512f69c20b130a47029af8cc2cfc6862a2854737fde475ae6f897e9ef71f407151164bf6ffc535c323553311124041bf62c6d504edba4f7bdb9190b30316ae1a847
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD50a6f7bfa582f612265defbbd4c246d79
SHA1852b328fbaabf3b7109eb084523ad4071333309d
SHA256fc2628bb5b13395c37566227b9e7ccdb0cae39b70495fcb0cefdec27b7b3f98b
SHA512d3602ec5fc2af8907fba90ac5cb97ade8b5896f022e26dcc2ae1db080692c2d053a557bcfd6dc143a8f6a3de2b63559ba893ec5af7d6be4ce4a4ee64a94024cc
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1