Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 15:01

General

  • Target

    z65NF-E.msi

  • Size

    2.9MB

  • MD5

    7c2346e58afd0cc0337fc935cd41d9c4

  • SHA1

    32189bee035e465d2df8bb15c5d168f8eff6f187

  • SHA256

    9219d0815a0320d65356c84003ea6d80935ebf855d2b7fbda79c4f38057a1e78

  • SHA512

    b7267d28ec63ce3b3a2bd247094bf1a4cc8891549a4d43f8875ba1e37f97f3a1a6bddcbc8f9be009fc12a3836dd9d759394ec5a38ef87c8425990d42ce3cb9e2

  • SSDEEP

    49152:M+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:M+lUlz9FKbsodq0YaH7ZPxMb8tT

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

  • Ateraagent family
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 13 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 37 IoCs
  • Executes dropped EXE 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\z65NF-E.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2680
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7DD0A7A11CC1A5E138C0A9155211D822
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1416
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI479D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259475542 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2004
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4AC9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259476228 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2336
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI5CA5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259480768 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1016
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI67D3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259483607 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1744
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D0D929CE8CC0E92746357827AADC9914 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\syswow64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2588
      • C:\Windows\syswow64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:2764
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000Pps1uIAB" /AgentId="eb03b5dc-f81d-4237-a174-2f50141db787"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:2548
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2388
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003F0" "0000000000000564"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2856
  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
      2⤵
      • Launches sc.exe
      PID:904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f774710.rbs

    Filesize

    8KB

    MD5

    b796f609c827092c73162d1b93c9080d

    SHA1

    fee144dcf61df2b0481286578aa15ee8a678d9c2

    SHA256

    a75fb3d62f0fd9a35aecf0f52e4befdc659dea31662c9e166b42dfc5c772cb6d

    SHA512

    26254e4e5d3f766a6f7a11cd1bb4c4908522c58c7c26f7e1b410ac9c3f9c9b44e96f7ce6c7ddd7ac4d657715d093050903b5d70cc7a6efb52364fc734bdf0e62

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

    Filesize

    753B

    MD5

    8298451e4dee214334dd2e22b8996bdc

    SHA1

    bc429029cc6b42c59c417773ea5df8ae54dbb971

    SHA256

    6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

    SHA512

    cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

    Filesize

    142KB

    MD5

    477293f80461713d51a98a24023d45e8

    SHA1

    e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

    SHA256

    a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

    SHA512

    23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

    Filesize

    1KB

    MD5

    b3bb71f9bb4de4236c26578a8fae2dcd

    SHA1

    1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

    SHA256

    e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

    SHA512

    fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

    Filesize

    693KB

    MD5

    2c4d25b7fbd1adfd4471052fa482af72

    SHA1

    fd6cd773d241b581e3c856f9e6cd06cb31a01407

    SHA256

    2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

    SHA512

    f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

    Filesize

    588KB

    MD5

    17d74c03b6bcbcd88b46fcc58fc79a0d

    SHA1

    bc0316e11c119806907c058d62513eb8ce32288c

    SHA256

    13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

    SHA512

    f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

  • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

    Filesize

    225B

    MD5

    6f95062490ff7f5ae722a39017c0c3be

    SHA1

    81fb7a0b202b52ae4110d13493c5d63c01d459f1

    SHA256

    fb09f0668407d1be6eade54f9182859d320bfabb0e2d725be7a9aa9ee02fbcf1

    SHA512

    1da2798b9918a6cb65e64b2ad6627db4f8cdd6beebc3c6bc15978b95954c8deaf31f76c3b2cdd036163baaa62bd28c2b637f0dacb266fec2ee83adae489cee30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    471B

    MD5

    b37eee2552522d51b5d8045e6397c56a

    SHA1

    df7cede952d9088326533e0675f9af3a0412cb2e

    SHA256

    2f47246e72e3f6cc3e5172cc555fbf2bf4a018653a8b0f7ef36a437a149c2c88

    SHA512

    189c7961e872c9001c5decf65113076adb7b3b76a43d047d34308b61082e0b59aa90182c3f53e87432233e731259bb590a0ef18f3ab173da7212d9b5ba701a97

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

    Filesize

    727B

    MD5

    e10202b6ab0b7420d6e690fb0b5f855d

    SHA1

    3a9f90af05c5e932c67aef0beb35464e99713991

    SHA256

    1063967df0b5d68609eb4da57043fce6fcde597f420e401ac009ee5378db88f6

    SHA512

    23bb38b05986566e73d59db162a4d8b1f9aa0396aa996f0f675f9dd29ec0835e930b1346d1315119a82903aa8db7318c5da164cd5cb26c847991c1c1ea05eee7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    727B

    MD5

    b56ef82c98008d1730d873e5b1216f0d

    SHA1

    7932ff198c39e5ca5d46d513e22c7907e8282fd4

    SHA256

    b7a65caf0de8c757ba1d28eae861fcbd0e5bdf53fea7af1d25260edcd523eaf5

    SHA512

    aebf1a3c7d6b4a5b18aca73b073a15d00b0a3ae1de756e827e85833a6d96ca78e13778577869be4cb0f6d10cfb6a1409205920030fb4ed0fe45c14446d4e9a60

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    400B

    MD5

    5d7889cfff52ea2def160bc9219796ce

    SHA1

    344575c8a737f311ca912c76db7bd1c36efcddc1

    SHA256

    9e810543b6a674aaaa211248f78da413c6b75174d16c047a07f94ca7399970bd

    SHA512

    28335fe19e9228894db82ddd57b173256107944fed5ce209a7e86fefdaded388f0944c6e5e3b9fffdc2e374dcba74b209c71f9eca4d13f14871c351a2400f3ad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

    Filesize

    404B

    MD5

    0e879195270c17f65c7383df76390375

    SHA1

    eee33b0dc07b9542e5cbf0ce27422765ad1fd4d8

    SHA256

    5d7b80c4010b0c61b3d478a2d058d252e370c7d0ba171a8e0bfd07516af9ec2f

    SHA512

    7a466d167bc1464605c82673c90b2c53d9dddb5d2730ea8d2e577fcb3d877c72c28f9eb631a6cdb67e1449a2a63307e4f23bbd5dd67cc86ffd96a9fa2d49906b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    91a27db884eaac6acfcc7a8d1acf4252

    SHA1

    bea2880cc22a9d6d50d91740725895e95a013e9b

    SHA256

    7147db0c9ad1d0d95bea5de85e98e428ba6a82ba015204640517a73dad95ad6c

    SHA512

    8c825ac93a565a61015108197546c77e1d9c98184b902ad7d3f7481bf6586cb5fea58cf0f333040e06291a0d79ee5dad406023c17df7c022e6c6b2cf2cf0e026

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d52e5f87d182d5eb9536eefd83624607

    SHA1

    9516dc65934995e82fa09437202c165a56825886

    SHA256

    87054e18e625238939347aefe3c7f289825b150d166882c6842395bd118e244d

    SHA512

    0a09e64fdf5f1468e5ea50967e7c2ec6747212736e06746dd0359d27a4bd05eb567dbe396e0041a442677e50596c0c7483021148d84287e0195fe6dce6647c89

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    412B

    MD5

    518f2f039da5dc0e84f1fb72b755f919

    SHA1

    ade74539919ca7b26eb3c48f45ec218df80bd6bc

    SHA256

    33ba3c40731224385270a48af500abf142dfdeb873ccdb0fc289e6cd9828bed0

    SHA512

    5595a8882369974d6f591ba8c4c7380a827ad4376ac8b033bd39a307f000c7a36c2c0290014e63a1923341127eb1a471b458415a1bc7d325de3670914d9a26c9

  • C:\Users\Admin\AppData\Local\Temp\Cab27DD.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar28BB.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\Installer\MSI479D.tmp

    Filesize

    509KB

    MD5

    88d29734f37bdcffd202eafcdd082f9d

    SHA1

    823b40d05a1cab06b857ed87451bf683fdd56a5e

    SHA256

    87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

    SHA512

    1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

  • C:\Windows\Installer\MSI4AC9.tmp-\CustomAction.config

    Filesize

    1KB

    MD5

    bc17e956cde8dd5425f2b2a68ed919f8

    SHA1

    5e3736331e9e2f6bf851e3355f31006ccd8caa99

    SHA256

    e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

    SHA512

    02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

  • C:\Windows\Installer\MSI4AC9.tmp-\Newtonsoft.Json.dll

    Filesize

    695KB

    MD5

    715a1fbee4665e99e859eda667fe8034

    SHA1

    e13c6e4210043c4976dcdc447ea2b32854f70cc6

    SHA256

    c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

    SHA512

    bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

  • C:\Windows\Installer\MSI5E5C.tmp

    Filesize

    211KB

    MD5

    a3ae5d86ecf38db9427359ea37a5f646

    SHA1

    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

    SHA256

    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

    SHA512

    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

  • C:\Windows\Installer\f77470e.msi

    Filesize

    2.9MB

    MD5

    7c2346e58afd0cc0337fc935cd41d9c4

    SHA1

    32189bee035e465d2df8bb15c5d168f8eff6f187

    SHA256

    9219d0815a0320d65356c84003ea6d80935ebf855d2b7fbda79c4f38057a1e78

    SHA512

    b7267d28ec63ce3b3a2bd247094bf1a4cc8891549a4d43f8875ba1e37f97f3a1a6bddcbc8f9be009fc12a3836dd9d759394ec5a38ef87c8425990d42ce3cb9e2

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    55099376a4be42cb04632f8b6caaf7de

    SHA1

    c0dd4d67d8e58246260d2124323d46f81081f3d4

    SHA256

    69027ce332e30e683da9e5610f88754f93d559c1d9678083e2c45f2f4e0f01ee

    SHA512

    65d023e703c5e7e8ab566d21e8582aa19b1d52892a1a443746e00b86b6afcd7dd35db620e09a7d7cd88e1b426efcf4cfaeee79f4b7abbd55394429ee5010e183

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a00d5c034c3ecbc9b6b80a4fe4950a29

    SHA1

    6f4547138cff12d3545e8986adb382dd613b311a

    SHA256

    4213c98e32e05d8895192d7fd6fdb04e8b6bc6f985c6dfdad363b3e7314f43aa

    SHA512

    7167b24f855532fd99abf7482c0a08db04f2507c9667f452aeaaaa22c63597f489ca1df690da6d6f8af30eaf89ee00ae5f9f78cc02aed6b066fa99fc19ebe3c0

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    87c8d47b8c9b99c59aa2e96c0f934beb

    SHA1

    e5eaecc4283c80c48c490a7057907372c3ef0ab3

    SHA256

    0d6e04cd8db13c5a74752a1f1d634c0c4c0f12a84949abdae1af189ff4c944e1

    SHA512

    17e504e0acfd2d2fcce8312d240a70f8e1583a91b6150825249d3f5dccddf54e593098fdce7e58ec17c4319866ae1c8ee41dea0272881b1c6772046b58720530

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6051fd95e8b95279b57337af997736fd

    SHA1

    0958f51b0bac596201b0368fd0c5d8879627bb07

    SHA256

    d2fd916f2f2719e62f0aa4030cf159b1a81b888aff96b4f576ca9f311afe179e

    SHA512

    ca6f65356df2eeb0c2caafea603a16259b2ba3137343fa47eb735bd353fd7f8a23e6602fafb0cfb028e17aed8e29980a0bcab19bd23b79d03c6fd29b6d9880b7

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8b4e7a69c2327e72f41206a777e15b2d

    SHA1

    09620d31f71a7d49c672e2d7296ee763331e8360

    SHA256

    7afa7550de53c3502f662b720b6f06304bcb36f484763a1230320ae9671f0c14

    SHA512

    b5ccd92bf9f7dc0dc36b37f27edaa0f6db83887a56e60f8785b89c802f04342467a2664ff6f52142a97a0132784dd706ed29bf9359e7abc4902ae5c9d06145c1

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e37d903e5350724f4343b738d619ad0

    SHA1

    d972853ad2a9771ab612d2582ab0242e9e6ac1b3

    SHA256

    79fa1c015c83fe4cf4ff35e1d8311f0b2c3518c8b5f9b581d4a3948bbe4b6c62

    SHA512

    d5915ec71438c0790bc3af4e37aa8ef24ec7ee0e4d359da413516b3596c9d9a7171014b847cb0b498a88014fb0e77ad3905af9e86dac7fc3a54053cf71c9abae

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f451648ba203602f3e436957d1e329d9

    SHA1

    6bf1b2662d708aad2c9137e622962baf6bdf5028

    SHA256

    beea9af1d7e02e7695698aaaab30dcaba493f95a1af0cf1878686fea93c4edce

    SHA512

    5e21b22ec0256de324e4a77d63a7895ac0f298913923911870fffdcf1fdc2a7003b65cee89b51d8d4c2187e7c4138486ff829089c914efe86cf89e84bc06a76e

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    94a90f797cfcd4f8b4a341b49a45bee3

    SHA1

    158b44671412c9cef20a9a204a3a4869a031ab5f

    SHA256

    c415795e806d6800d2f95bc81f1d803d8ebffaa6c18e360730373ffb0c56e7f8

    SHA512

    b9d423ae978639c1ef0c9b8fbf218e0cd5a96163f451d2ddee519501fa672fbf5c3c1b9b827f301f4128858801f8727749a5e7431f88395c2fcbc2deff7cda41

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    24ac2ae77e8a2d648b7619f9b3d6a284

    SHA1

    ff91f01b7345693c6a8dc5255bb348ea04e178b9

    SHA256

    aa8260b2a5e17269a570c020353e7cb6bff40f8bf1ff1d7b4f7437e244733a41

    SHA512

    a870b2eb7247d6341ca7665c6bb5f98b43e9b359515c84b28efb244ccc85b0a8e97af47310a93dd3f0ef4374194db8f601baa521a871978e9cfbfc8fcfecc160

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1d184ac18a9ae40bcb4c0b27c37541f6

    SHA1

    ff6452bed4df719e44c1f5054b67b0cac98562f1

    SHA256

    6dc4a7de64c03e58d9b5618d614304c37b6b883ca11154ac0d3c6a8a926a48f6

    SHA512

    f69c20b130a47029af8cc2cfc6862a2854737fde475ae6f897e9ef71f407151164bf6ffc535c323553311124041bf62c6d504edba4f7bdb9190b30316ae1a847

  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    0a6f7bfa582f612265defbbd4c246d79

    SHA1

    852b328fbaabf3b7109eb084523ad4071333309d

    SHA256

    fc2628bb5b13395c37566227b9e7ccdb0cae39b70495fcb0cefdec27b7b3f98b

    SHA512

    d3602ec5fc2af8907fba90ac5cb97ade8b5896f022e26dcc2ae1db080692c2d053a557bcfd6dc143a8f6a3de2b63559ba893ec5af7d6be4ce4a4ee64a94024cc

  • C:\Windows\Temp\Cab74E2.tmp

    Filesize

    29KB

    MD5

    d59a6b36c5a94916241a3ead50222b6f

    SHA1

    e274e9486d318c383bc4b9812844ba56f0cff3c6

    SHA256

    a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

    SHA512

    17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

  • C:\Windows\Temp\Tar74F4.tmp

    Filesize

    81KB

    MD5

    b13f51572f55a2d31ed9f266d581e9ea

    SHA1

    7eef3111b878e159e520f34410ad87adecf0ca92

    SHA256

    725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

    SHA512

    f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

  • \Windows\Installer\MSI479D.tmp-\AlphaControlAgentInstallation.dll

    Filesize

    25KB

    MD5

    aa1b9c5c685173fad2dabebeb3171f01

    SHA1

    ed756b1760e563ce888276ff248c734b7dd851fb

    SHA256

    e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

    SHA512

    d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

  • \Windows\Installer\MSI479D.tmp-\Microsoft.Deployment.WindowsInstaller.dll

    Filesize

    179KB

    MD5

    1a5caea6734fdd07caa514c3f3fb75da

    SHA1

    f070ac0d91bd337d7952abd1ddf19a737b94510c

    SHA256

    cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

    SHA512

    a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

  • memory/1568-301-0x0000000019CA0000-0x0000000019D52000-memory.dmp

    Filesize

    712KB

  • memory/1744-313-0x00000000049D0000-0x0000000004A82000-memory.dmp

    Filesize

    712KB

  • memory/1744-309-0x00000000007B0000-0x00000000007BC000-memory.dmp

    Filesize

    48KB

  • memory/1744-305-0x0000000000370000-0x000000000039E000-memory.dmp

    Filesize

    184KB

  • memory/2004-72-0x0000000000820000-0x000000000084E000-memory.dmp

    Filesize

    184KB

  • memory/2004-76-0x0000000000850000-0x000000000085C000-memory.dmp

    Filesize

    48KB

  • memory/2336-105-0x00000000020B0000-0x00000000020BC000-memory.dmp

    Filesize

    48KB

  • memory/2336-101-0x0000000000840000-0x000000000086E000-memory.dmp

    Filesize

    184KB

  • memory/2336-109-0x0000000004D30000-0x0000000004DE2000-memory.dmp

    Filesize

    712KB

  • memory/2548-233-0x0000000000F90000-0x0000000000FB8000-memory.dmp

    Filesize

    160KB

  • memory/2548-245-0x00000000004A0000-0x0000000000538000-memory.dmp

    Filesize

    608KB