ateraagent | c5a9d17efdc7297d5d874e7765073258ffa919829da456101bb6076f5476ac26

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2025, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LaudoBombeiro.msi
Size

2.9MB
MD5

be718005b76304765320e6ecc1cfa44b
SHA1

c23cf852232284dfdf3f988d289c1cd13e4bc5b0
SHA256

c5a9d17efdc7297d5d874e7765073258ffa919829da456101bb6076f5476ac26
SHA512

1355fae59e627f91bb534a7e990e3914650e033eb92b8da79489b185db212a4f9808e019142118bb282ee6ea53fc1d5c9de108b09850d613b45b37f411e0019f
SSDEEP

49152:Z+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:Z+lUlz9FKbsodq0YaH7ZPxMb8tT

Score

10^/10

ateraagent discovery execution persistence privilege_escalation rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral2/files/0x0018000000023dcf-226.dat	family_ateraagent

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2996	msiexec.exe
7	2996	msiexec.exe
23	2056	rundll32.exe
28	2840	rundll32.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
88	2708	Process not Found
91	2940	AgentPackageSTRemote.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log	AgentPackageAgentInformation.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageInternalPoller.exe.log	AgentPackageInternalPoller.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageHeartbeat.exe.log	AgentPackageHeartbeat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageMarketplace.exe.log	AgentPackageMarketplace.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageMonitoring.exe.log	AgentPackageMonitoring.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\dynamicfieldscaching.cch	AgentPackageAgentInformation.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\StructureMap.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.DependencyInjection.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\runtimes\win\lib\net8.0\System.ServiceProcess.ServiceController.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Serilog.Sinks.File.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Microsoft.Extensions.Logging.EventSource.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.Mac.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.Logging.EventSource.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Polly.Core.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\ICSharpCode.SharpZipLib.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\TicketingNotifications.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\TicketingTrayTMP.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.ini	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.Http.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Dapper.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\ICSharpCode.SharpZipLib.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\Microsoft.ApplicationInsights.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\t2tWinFormAppBarLib.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\System.ValueTuple.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Microsoft.Extensions.Configuration.Binder.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.ini	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.Diagnostics.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.Diagnostics.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\runtimes\win\lib\net6.0\System.Diagnostics.EventLog.Messages.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.deps.json	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.Linux.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.Hosting.Abstractions.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db	AgentPackageMonitoring.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\Atera.AgentPackages.CommonLib.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.Configuration.Abstractions.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Microsoft.Extensions.Configuration.FileExtensions.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\TicketingPackageExtensions.dll.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\System.Memory.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.InteropServices.RuntimeInformation.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\fr\Microsoft.Win32.TaskScheduler.resources.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\MQTTnet.Extensions.ManagedClient.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.FileProviders.Physical.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Microsoft.Extensions.Configuration.UserSecrets.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\System.Diagnostics.EventLog.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.Logging.Configuration.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Runtime.CompilerServices.Unsafe.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\System.Numerics.Vectors.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Win32.TaskScheduler.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Microsoft.Extensions.FileProviders.Abstractions.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.Configuration.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\log\log.txt	Agent.Package.Availability.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\es\Microsoft.Win32.TaskScheduler.resources.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Microsoft.Extensions.Logging.Abstractions.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Microsoft.Extensions.Configuration.CommandLine.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\System.Runtime.InteropServices.RuntimeInformation.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Serilog.Sinks.File.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\runtimes\win\lib\net8.0\System.Diagnostics.EventLog.Messages.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\servers.cfg.bak	AgentPackageInternalPoller.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\Newtonsoft.Json.dll	AteraAgent.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID837.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD45.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBF1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF1B.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICA37.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E732A0D7-A2F2-4657-AC41-B19742648E45}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF1B.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICA37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID837.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICA37.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD45.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICA37.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICBA2.tmp	msiexec.exe
File created	C:\Windows\Installer\e57bcba.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID837.tmp-\Newtonsoft.Json.dll	rundll32.exe
File created	C:\Windows\Installer\e57bcb8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA37.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID837.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID837.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\e57bcb8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD45.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD45.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICA37.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID837.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD45.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBF1B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBF1B.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF1B.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe

Executes dropped EXE 17 IoCs

pid	Process
4072	AteraAgent.exe
4260	AteraAgent.exe
1140	AgentPackageAgentInformation.exe
3804	AgentPackageAgentInformation.exe
2136	AgentPackageAgentInformation.exe
5040	AteraAgent.exe
2232	AgentPackageMonitoring.exe
3244	AgentPackageAgentInformation.exe
2940	AgentPackageSTRemote.exe
3888	AgentPackageAgentInformation.exe
5116	AgentPackageTicketing.exe
2128	AgentPackageInternalPoller.exe
916	AgentPackageHeartbeat.exe
2024	AgentPackageMarketplace.exe
3148	Agent.Package.Watchdog.exe
2852	Agent.Package.Availability.exe
1292	Agent.Package.Software.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2516	sc.exe
760	sc.exe

Loads dropped DLL 32 IoCs

pid	Process
2760	MsiExec.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
2760	MsiExec.exe
2056	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
2056	rundll32.exe
2760	MsiExec.exe
5008	rundll32.exe
5008	rundll32.exe
5008	rundll32.exe
5008	rundll32.exe
5008	rundll32.exe
2760	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
2760	MsiExec.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2840	rundll32.exe
2232	AgentPackageMonitoring.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
560	powershell.exe
1764	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2996	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3352	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ce8a48ddaceaa4900000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ce8a48dd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ce8a48dd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dce8a48dd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce8a48dd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3192	TaskKill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AgentPackageHeartbeat.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell\open\command\ = "\"C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe\" \"%1\""	AgentPackageTicketing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ait	AgentPackageTicketing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell	AgentPackageTicketing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "LaudoBombeiro.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\ = "URL:ait Protocol"	AgentPackageTicketing.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\URL Protocol	AgentPackageTicketing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\DefaultIcon\ = "C:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageTicketing\\TicketingNotifications.exe,1"	AgentPackageTicketing.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell\open	AgentPackageTicketing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\DefaultIcon	AgentPackageTicketing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ait\shell\open\command	AgentPackageTicketing.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	AteraAgent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
116	msiexec.exe
116	msiexec.exe
4260	AteraAgent.exe
1140	AgentPackageAgentInformation.exe
4260	AteraAgent.exe
3804	AgentPackageAgentInformation.exe
560	powershell.exe
560	powershell.exe
4260	AteraAgent.exe
3244	AgentPackageAgentInformation.exe
3244	AgentPackageAgentInformation.exe
2940	AgentPackageSTRemote.exe
2940	AgentPackageSTRemote.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
3888	AgentPackageAgentInformation.exe
1764	powershell.exe
1764	powershell.exe
1764	powershell.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
5116	AgentPackageTicketing.exe
2128	AgentPackageInternalPoller.exe
2128	AgentPackageInternalPoller.exe
5040	AteraAgent.exe
5040	AteraAgent.exe
2852	Agent.Package.Availability.exe
5116	AgentPackageTicketing.exe
5116	AgentPackageTicketing.exe
5116	AgentPackageTicketing.exe
5116	AgentPackageTicketing.exe
5040	AteraAgent.exe
5040	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2996	msiexec.exe
Token: SeSecurityPrivilege	116	msiexec.exe
Token: SeCreateTokenPrivilege	2996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2996	msiexec.exe
Token: SeLockMemoryPrivilege	2996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2996	msiexec.exe
Token: SeMachineAccountPrivilege	2996	msiexec.exe
Token: SeTcbPrivilege	2996	msiexec.exe
Token: SeSecurityPrivilege	2996	msiexec.exe
Token: SeTakeOwnershipPrivilege	2996	msiexec.exe
Token: SeLoadDriverPrivilege	2996	msiexec.exe
Token: SeSystemProfilePrivilege	2996	msiexec.exe
Token: SeSystemtimePrivilege	2996	msiexec.exe
Token: SeProfSingleProcessPrivilege	2996	msiexec.exe
Token: SeIncBasePriorityPrivilege	2996	msiexec.exe
Token: SeCreatePagefilePrivilege	2996	msiexec.exe
Token: SeCreatePermanentPrivilege	2996	msiexec.exe
Token: SeBackupPrivilege	2996	msiexec.exe
Token: SeRestorePrivilege	2996	msiexec.exe
Token: SeShutdownPrivilege	2996	msiexec.exe
Token: SeDebugPrivilege	2996	msiexec.exe
Token: SeAuditPrivilege	2996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2996	msiexec.exe
Token: SeChangeNotifyPrivilege	2996	msiexec.exe
Token: SeRemoteShutdownPrivilege	2996	msiexec.exe
Token: SeUndockPrivilege	2996	msiexec.exe
Token: SeSyncAgentPrivilege	2996	msiexec.exe
Token: SeEnableDelegationPrivilege	2996	msiexec.exe
Token: SeManageVolumePrivilege	2996	msiexec.exe
Token: SeImpersonatePrivilege	2996	msiexec.exe
Token: SeCreateGlobalPrivilege	2996	msiexec.exe
Token: SeBackupPrivilege	4756	vssvc.exe
Token: SeRestorePrivilege	4756	vssvc.exe
Token: SeAuditPrivilege	4756	vssvc.exe
Token: SeBackupPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeDebugPrivilege	2056	rundll32.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeDebugPrivilege	3192	TaskKill.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe
Token: SeTakeOwnershipPrivilege	116	msiexec.exe
Token: SeRestorePrivilege	116	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2996	msiexec.exe
2996	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4520	116	msiexec.exe	94
PID 116 wrote to memory of 4520	116	msiexec.exe	94
PID 116 wrote to memory of 2760	116	msiexec.exe	96
PID 116 wrote to memory of 2760	116	msiexec.exe	96
PID 116 wrote to memory of 2760	116	msiexec.exe	96
PID 2760 wrote to memory of 4256	2760	MsiExec.exe	97
PID 2760 wrote to memory of 4256	2760	MsiExec.exe	97
PID 2760 wrote to memory of 4256	2760	MsiExec.exe	97
PID 2760 wrote to memory of 2056	2760	MsiExec.exe	98
PID 2760 wrote to memory of 2056	2760	MsiExec.exe	98
PID 2760 wrote to memory of 2056	2760	MsiExec.exe	98
PID 2760 wrote to memory of 5008	2760	MsiExec.exe	101
PID 2760 wrote to memory of 5008	2760	MsiExec.exe	101
PID 2760 wrote to memory of 5008	2760	MsiExec.exe	101
PID 116 wrote to memory of 4832	116	msiexec.exe	104
PID 116 wrote to memory of 4832	116	msiexec.exe	104
PID 116 wrote to memory of 4832	116	msiexec.exe	104
PID 4832 wrote to memory of 1556	4832	MsiExec.exe	105
PID 4832 wrote to memory of 1556	4832	MsiExec.exe	105
PID 4832 wrote to memory of 1556	4832	MsiExec.exe	105
PID 1556 wrote to memory of 2004	1556	NET.exe	107
PID 1556 wrote to memory of 2004	1556	NET.exe	107
PID 1556 wrote to memory of 2004	1556	NET.exe	107
PID 4832 wrote to memory of 3192	4832	MsiExec.exe	108
PID 4832 wrote to memory of 3192	4832	MsiExec.exe	108
PID 4832 wrote to memory of 3192	4832	MsiExec.exe	108
PID 116 wrote to memory of 4072	116	msiexec.exe	110
PID 116 wrote to memory of 4072	116	msiexec.exe	110
PID 2760 wrote to memory of 2840	2760	MsiExec.exe	113
PID 2760 wrote to memory of 2840	2760	MsiExec.exe	113
PID 2760 wrote to memory of 2840	2760	MsiExec.exe	113
PID 4260 wrote to memory of 2516	4260	AteraAgent.exe	114
PID 4260 wrote to memory of 2516	4260	AteraAgent.exe	114
PID 4260 wrote to memory of 1140	4260	AteraAgent.exe	120
PID 4260 wrote to memory of 1140	4260	AteraAgent.exe	120
PID 4260 wrote to memory of 3804	4260	AteraAgent.exe	129
PID 4260 wrote to memory of 3804	4260	AteraAgent.exe	129
PID 3804 wrote to memory of 560	3804	AgentPackageAgentInformation.exe	132
PID 3804 wrote to memory of 560	3804	AgentPackageAgentInformation.exe	132
PID 3804 wrote to memory of 728	3804	AgentPackageAgentInformation.exe	134
PID 3804 wrote to memory of 728	3804	AgentPackageAgentInformation.exe	134
PID 728 wrote to memory of 540	728	cmd.exe	136
PID 728 wrote to memory of 540	728	cmd.exe	136
PID 4260 wrote to memory of 2136	4260	AteraAgent.exe	141
PID 4260 wrote to memory of 2136	4260	AteraAgent.exe	141
PID 5040 wrote to memory of 760	5040	AteraAgent.exe	144
PID 5040 wrote to memory of 760	5040	AteraAgent.exe	144
PID 4260 wrote to memory of 2232	4260	AteraAgent.exe	148
PID 4260 wrote to memory of 2232	4260	AteraAgent.exe	148
PID 5040 wrote to memory of 3244	5040	AteraAgent.exe	155
PID 5040 wrote to memory of 3244	5040	AteraAgent.exe	155
PID 4260 wrote to memory of 2940	4260	AteraAgent.exe	159
PID 4260 wrote to memory of 2940	4260	AteraAgent.exe	159
PID 5040 wrote to memory of 3888	5040	AteraAgent.exe	162
PID 5040 wrote to memory of 3888	5040	AteraAgent.exe	162
PID 3888 wrote to memory of 1764	3888	AgentPackageAgentInformation.exe	165
PID 3888 wrote to memory of 1764	3888	AgentPackageAgentInformation.exe	165
PID 3888 wrote to memory of 1032	3888	AgentPackageAgentInformation.exe	167
PID 3888 wrote to memory of 1032	3888	AgentPackageAgentInformation.exe	167
PID 1032 wrote to memory of 2304	1032	cmd.exe	169
PID 1032 wrote to memory of 2304	1032	cmd.exe	169
PID 5040 wrote to memory of 5116	5040	AteraAgent.exe	172
PID 5040 wrote to memory of 5116	5040	AteraAgent.exe	172
PID 5040 wrote to memory of 2128	5040	AteraAgent.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LaudoBombeiro.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D2EF220CC40DD550DA3AA5298C96D670
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBD45.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631187 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBF1B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631578 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSICA37.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634421 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5008
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID837.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638062 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 579360937AF0CB90D264C92847C2FABF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      System Location Discovery: System Language Discovery
      PID:2004
- - C:\Windows\SysWOW64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000QKxOLIA1" /AgentId="6cb65ce2-b4fe-42b0-835f-7b23919d3e1c"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:4072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "b84720d2-b455-49fc-8e06-486d51fbcbf5" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QKxOLIA1
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1140
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "efd4cfe5-2f95-4f8c-b42b-35b18044ed14" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000QKxOLIA1
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:560
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Windows\system32\cscript.exe
      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
      4⤵
      Modifies data under HKEY_USERS
      PID:540
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "260cd8fd-f690-4948-8cc8-4ba63ed304ef" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000QKxOLIA1
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "8f45afdd-c645-4914-9f07-d5711b58cb60" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000QKxOLIA1
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2232
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "a7aeec44-92b4-4d64-bfe7-23359002ea2e" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOjMsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000QKxOLIA1
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Mzg1M0I4NzctQUFDOS00MEExLTk5NTctQjYxQ0E5M0ZGNDE4fSIgdXNlcmlkPSJ7QjI2N0M5RTQtQjJBOS00QUIyLUEwMEYtQTFFMEVDN0VFQUE1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTcyRjc5RDMtN0ZGQS00Nzk4LUFCMDktQzhCREJGNUMyRDFDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4MzAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTE0Njg3NjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjI2NzM0MzU3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3352

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:760
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "90bedded-6c3b-4568-a4dd-b95cd10d8a09" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QKxOLIA1
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "d24b90fc-173f-4c11-b80c-67bf2fdd10d3" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000QKxOLIA1
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1764
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\system32\cscript.exe
      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
      4⤵
      Modifies data under HKEY_USERS
      PID:2304
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "474099b7-1e65-4edb-90a1-ccb678020094" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000QKxOLIA1
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "90b46048-522f-4fca-9b88-930efa020589" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000QKxOLIA1
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "9b7c526c-2cce-4ea7-9e0c-09500d44db8c" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QKxOLIA1
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:916
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "6cccee38-a633-4fec-a28d-e124f7112e59" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000QKxOLIA1
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  PID:2024
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "5b94710f-e907-4252-8574-7177c881a31d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000QKxOLIA1
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "21601ff1-70be-4330-9d45-53de74a96c9b" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000QKxOLIA1
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2852
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe" 6cb65ce2-b4fe-42b0-835f-7b23919d3e1c "7cb88560-f169-4338-849f-2f20dda9428e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIyZ2V0LWluc3RhbGxlZC1zb2Z0d2FyZVx1MDAyMn0ifQ==" 001Q300000QKxOLIA1
  2⤵
  - Executes dropped EXE
  PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57bcb9.rbs

Filesize
8KB

MD5
cb4619b8ab358d0bb754a4b7a67b5434

SHA1
e74d1aa851bfeb323ffbb4fc0f88e21b39b88a8c

SHA256
97629c90dbca092c8c15ebe199865a5da21d2802da27bfd18a8d50606364cf7a

SHA512
d9aa00fe2fa31d87a308990595467832195c43c3530e70aee2b9126a7b0ff98ff378d9c984a469cb745c309d58c1d186001541d6b2eda5cc5ca358bd3f7879c7

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Filesize
142KB

MD5
477293f80461713d51a98a24023d45e8

SHA1
e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

SHA256
a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

SHA512
23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Filesize
1KB

MD5
b3bb71f9bb4de4236c26578a8fae2dcd

SHA1
1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

SHA256
e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

SHA512
fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

Filesize
210KB

MD5
c106df1b5b43af3b937ace19d92b42f3

SHA1
7670fc4b6369e3fb705200050618acaa5213637f

SHA256
2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

SHA512
616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Filesize
693KB

MD5
2c4d25b7fbd1adfd4471052fa482af72

SHA1
fd6cd773d241b581e3c856f9e6cd06cb31a01407

SHA256
2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

SHA512
f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe

Filesize
146KB

MD5
8d477b63bc5a56ae15314bda8dea7a3a

SHA1
3ca390584cd3e11172a014784e4c968e7cbb18f5

SHA256
9eec91cdd39cbb560ad5b1d063df67088f412da4b851ae41e71304fb8a444293

SHA512
44e3d91ad96b4cb919c06ccb91d3c3e31165b2412e1d78bfbaca0bee6f0c1a3253b3e3ddf19009cebf12c261a0392f6a0b7091cf8aba1d0cc4c1ed61c1b6dc42

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe

Filesize
145KB

MD5
34fb1cc6c04a783aaa6ec8e9786e54f7

SHA1
6c573b0c0f4e0eb1fb0a2628fd199c08b642cbfe

SHA256
f314b3f018b4969637757a885dc9c86fb244946cd3dc079378fdcceb92131d2f

SHA512
d89764f540bb3230b6ea65a042a901a17f0586346c7c96c844f624b16766f30ea4e4bc961b473d3a4d00e32f6d1d582d64e18e19de2db35c38722f5fd422deb9

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe

Filesize
145KB

MD5
2b9beb2fdbc41afc48d68d32ef41dd08

SHA1
4a9ea4cf8e02e34ef2dd0ef849ffc0cd9ea6f91c

SHA256
977d48979e30a146417937d7e11b26334edec2abddfae1369a9c4348e34857b1

SHA512
3e3c3e39ff2df0d1ed769e6c5acba6f7c5d2737d3c426fb4f0e19f3cf6c604707155917584e454a3f208524ed46766b7a3d2d861fa7419f8258c3b6022238e10

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI

Filesize
12B

MD5
1e065e191e89cc811ff49c96fa8fa5e6

SHA1
bc50ff2a20a8b83683583684fcac640a91689ed4

SHA256
d88faf6d47342587ea5fbcaf2ef88fb403f7fcdc08fcab67d4f4f381c237a61e

SHA512
5a710e168316c30ca10f7b126e870621f46cca6200e206a9984d144abd11fea045bc475599b18597bbed1e4f00e832d94576837f643b22ffaee56871629290dd

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Filesize
247KB

MD5
aa5cf64d575b7544eefd77f256c4dc57

SHA1
bd23989db4f9af0aae34d032e817d802c06ca5a9

SHA256
79c5afd94d0ffa3519a90e691a6d47f9c2eec93277f7d369aa34e64b171fc920

SHA512
774aeb5188c536d556a8c7a0cd3dfd9ab22d7bc0ad13353d11c9153232585da352552a69eb967a741372a99db490df355a5a47696b2ea446582c834c963cfeff

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

Filesize
546B

MD5
158fb7d9323c6ce69d4fce11486a40a1

SHA1
29ab26f5728f6ba6f0e5636bf47149bd9851f532

SHA256
5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

SHA512
7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll

Filesize
94KB

MD5
c69c7690482c75a8fc70df2990d7afc6

SHA1
79d72d32a03151823bbf0953d5c2ce6bc2bde4b1

SHA256
580415595e5936d5f3945e9eeee63f6f4dbacd327aa46e2b7625b638715c27f5

SHA512
ed80ade3519345552ca74958efc9c122de840d2844baa08c94400f15168b6fc25377628a55ed12488ea790aaa40bc5bb77b6586de4f1ecd296902bbe36fba4f4

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll

Filesize
688KB

MD5
111e2e63bccead95bb5ffc53c9282070

SHA1
eaae7df21e291aa089bc101b1e265ca202be1225

SHA256
9615fe5fe63c48b13ffd8c9bc76170a9ed1cfea6a3d0901e857a1c6c6edaea76

SHA512
ffc818615fb30e24633c90b8f5a55c100b5f307414ec54e5a2914bb4ea36d3fb3aa6ed0e5815976a2f6d1b7f056e7da1f108a8eed81b458decebe721ad30b920

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe

Filesize
27KB

MD5
797c9554ec56fd72ebb3f6f6bef67fb5

SHA1
40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

SHA256
7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

SHA512
4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe

Filesize
214KB

MD5
01807774f043028ec29982a62fa75941

SHA1
afc25cf6a7a90f908c0a77f2519744f75b3140d4

SHA256
9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

SHA512
33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe

Filesize
37KB

MD5
efb4712c8713cb05eb7fe7d87a83a55a

SHA1
c94d106bba77aecf88540807da89349b50ea5ae7

SHA256
30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

SHA512
3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe

Filesize
397KB

MD5
99f67d47a8dbdee98407885a1ac58e7c

SHA1
3cb9d10a8e6ed1acfa802045aca6e931ba7a8759

SHA256
0aa983060464d62b3da159e533769e8440612e3ec23fb8eff4fc52a0d79cc00e

SHA512
1a0779480bc3e268882d99206f621ea0feb9548df362f1920b793804fbbbf3fc530e263f0307f3cacbc8af54fd503f3f15b967a1464facd273c16bbbb56a27ab

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe

Filesize
70KB

MD5
e9b3a59f67febdd7f8fbe68d71c5d0ab

SHA1
22bd3ec3f8e0be2f317ade9d553acdb3ea11f52e

SHA256
bff4de54dacec104e1e63659857ca99d3e9658dcc09d6e1cbf54dc7b22629cbf

SHA512
00e95ea600777025a30e23c755522b869320ca445ac5bd74f123306457d0793efa338220cba9d064e5d25cc3dcf19d66e4e48d3a1c72d196eeb77fb61e4b0688

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe

Filesize
32KB

MD5
80eb4e033338fa114a4d010e9ce0b195

SHA1
f907ba4231bd21ac056375f23a36be648f5b2ba7

SHA256
b82e5dfecd3118dca11c86bf7829205fe3e5fcf0eeb57e1999e2fd2f9bd63d52

SHA512
26d4096f8c9652ea4e3920dc67144a082e069e22b85504f64f15b47f5106ef1df0601bdd7e0c34f4f534d920a520872847e6d57bc985f6e20636a26e0f7acb20

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Filesize
588KB

MD5
17d74c03b6bcbcd88b46fcc58fc79a0d

SHA1
bc0316e11c119806907c058d62513eb8ce32288c

SHA256
13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

SHA512
f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Filesize
217B

MD5
d163c56201ae70e5dc49bc53a03c2103

SHA1
010b4727aa04e6288cf2950517a93a1309dfd1ab

SHA256
423e1190385db82d7a7001e2b67c3203bfe0facb6a1673fb9bc12ca9c6f55980

SHA512
9103324dc23234304b3bdd6120f05e94857fcceb822c72baf7308ae26eee947680faf67eda0a5c0e80771f0a4227e038d6fcca3b1a26e2a0cfb19b358ac60b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC

Filesize
727B

MD5
03a77a9890bd7185289d5d73a9f98f6e

SHA1
81b7840f5d20d96a8dc5353cdede82dffee080e2

SHA256
65e203755653a53a894dc3c953d8a807745d4f0b3b6d1531971f0b08522df0d4

SHA512
056c25fc9a828a5e548a84946aa196b85a34a6f546f466d718c11a53afd63981da70314a4c761eddef1c6f1bd2d7e9f909a794022c92fcf272c499e76407deef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC

Filesize
412B

MD5
f9cf079a7feb83f6717677b509e97b73

SHA1
59fc218f655e2f6a30fe4ada33b9ded85521e183

SHA256
e0a9c75119490fa0a6c04fea16e3307e77d19215bd6831218e7d04fc212bf5ce

SHA512
fc8435c70f28770722225f927d1a02d985c71210fb739840561035fc5fd1c5a58e2b3905b501fc771042f55dc80106022a7172929d20fdfac9593ff26a56c824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
9bbfe11735bac43a2ed1be18d0655fe2

SHA1
61141928bb248fd6e9cd5084a9db05a9b980fb3a

SHA256
549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

SHA512
a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

Download Submit
C:\Windows\Installer\MSIBD45.tmp

Filesize
509KB

MD5
88d29734f37bdcffd202eafcdd082f9d

SHA1
823b40d05a1cab06b857ed87451bf683fdd56a5e

SHA256
87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

SHA512
1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

Download Submit
C:\Windows\Installer\MSIBD45.tmp-\AlphaControlAgentInstallation.dll

Filesize
25KB

MD5
aa1b9c5c685173fad2dabebeb3171f01

SHA1
ed756b1760e563ce888276ff248c734b7dd851fb

SHA256
e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

SHA512
d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

Download Submit
C:\Windows\Installer\MSIBD45.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIBF1B.tmp-\CustomAction.config

Filesize
1KB

MD5
bc17e956cde8dd5425f2b2a68ed919f8

SHA1
5e3736331e9e2f6bf851e3355f31006ccd8caa99

SHA256
e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

SHA512
02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

Download Submit
C:\Windows\Installer\MSIBF1B.tmp-\Newtonsoft.Json.dll

Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
C:\Windows\Installer\MSICB62.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\e57bcb8.msi

Filesize
2.9MB

MD5
be718005b76304765320e6ecc1cfa44b

SHA1
c23cf852232284dfdf3f988d289c1cd13e4bc5b0

SHA256
c5a9d17efdc7297d5d874e7765073258ffa919829da456101bb6076f5476ac26

SHA512
1355fae59e627f91bb534a7e990e3914650e033eb92b8da79489b185db212a4f9808e019142118bb282ee6ea53fc1d5c9de108b09850d613b45b37f411e0019f

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_vrub0lwz.b5w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
727B

MD5
17c3144b951201b5c7ba287c302e30db

SHA1
aae8469d67066d1def775b7e2a24de2ff312c642

SHA256
347c70bbd5ac08ce5107a28597033c075b518d1404703dfdc2043cc36ab56c00

SHA512
088550c13e80ebf16b4bb542a0a3ba1df2c9d3a98008b293accd1a1aa4019c0917bb970d8b349afd9fb365c892107251d5aea5f16d27bb18c582545ebd64a6c6

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
d7909c7cd997af5e26a89920cd8b320a

SHA1
058e556bd3abd9b117a6a159f1f9baef60ba9bc5

SHA256
45c8301f0b9cd3c3a363ce79b38d3b1488eab1ab81782ec375a16101ed7e740b

SHA512
03c41ce3220fd87e22911ee5a4571bc374eb4f93871c39fd4419b91b4ed110cdcedb6138e652ba7d5937573bee5fa7d18346692c4be779210d31d0d50d3f0256

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Filesize
404B

MD5
3a5079ddea616bea09f0eaecf062cb8c

SHA1
e39e9e3d609205e2a163cf2fcd1739594b089f26

SHA256
d8232111e4d760a6b18f1bfcd17994d3ce8a802e7149997d5b4300d914c67d41

SHA512
cdd9d17c2007b1612341cd3cd4b0e500c5dfcf82de13b7f44ca5c8d56ed81a72f14bc7d96df5ea8e3c7e958be44f2378dd06ce93969d75f46bd14c40f8fc547b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
b0f79c989acf35e2385e185b7dd6cb1c

SHA1
822485203a4de0030521a419f2fe5c171842d329

SHA256
680aaee6f44481ce945aa5086f2edf5239a3ce0af4b63f1af5e91a74cf48fba8

SHA512
61041ea07e373ac88b8b1f00cf6922acc8111f908399eaaea51a1d23c96a068a7f164a9d820a545babb3f51b1fec01ee4f3d2d5f21d1ba986f781f368a68ee3a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log

Filesize
1KB

MD5
9cad061ddf5ad182cfe7879190aeed71

SHA1
cfd292d16d937f95b642527464403b7e5ef6af96

SHA256
b2d273fa926ebf6946e69e8808ad332db42bc65f449748082e088aa732e408ca

SHA512
df517d66358f441a7c4c690cd90e214f18d490e3de767dd76164effaa179b1dd865a0056d68ce3ab6aee55917465c7f39146e7694b1ac475fcc95c280fb29e92

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
a732a548d4368ea8f403cc3164578782

SHA1
d50ca0ae365870fe7d3fff4169a0e8166c1b2989

SHA256
4d33d864abe654a8f77bd5636b30f5bed3d6891b35d6cd801f9a8b26a73c1819

SHA512
b0517489bda8cda993d64fd9eba6ddd5d0f8dea87fdd970f6e8ad3f93c5d62d09380fd555c8a2dac9204e60409ba2404911d1d1192b7b989fd3b17cf64153741

Download Submit
\??\Volume{dd488ace-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{87749309-5d40-49ed-a7bc-0339636b98a2}_OnDiskSnapshotProp

Filesize
6KB

MD5
3c462a30800e49743541b0268955fcd9

SHA1
d3236c1f8973c966a05afcfc3b925795664e715f

SHA256
f2acbf3b0d74827534e6f4cdabfc54a597af5e43c1b1a59bb72b3eb3034a7ea8

SHA512
7c6e37189d7e941a0fa2d81e01b1ad9849fa40c5114e2f48ba3123e71dc5fe899e8c9f9feb1e2302f1b9fbac40d49a59fa4381327fdfb520da593555abe9c98a

Download Submit
memory/916-535-0x0000020C526C0000-0x0000020C52BE8000-memory.dmp

Filesize
5.2MB

Download
memory/916-525-0x0000020C51F70000-0x0000020C52022000-memory.dmp

Filesize
712KB

Download
memory/916-523-0x0000020C38D90000-0x0000020C38D9A000-memory.dmp

Filesize
40KB

Download
memory/916-524-0x0000020C395D0000-0x0000020C395EA000-memory.dmp

Filesize
104KB

Download
memory/1140-267-0x00000287E43D0000-0x00000287E43EC000-memory.dmp

Filesize
112KB

Download
memory/1140-265-0x00000287FCC70000-0x00000287FCD20000-memory.dmp

Filesize
704KB

Download
memory/1140-262-0x00000287E3B30000-0x00000287E3B72000-memory.dmp

Filesize
264KB

Download
memory/2024-559-0x000001A7B0040000-0x000001A7B008A000-memory.dmp

Filesize
296KB

Download
memory/2024-561-0x000001A7B02A0000-0x000001A7B0350000-memory.dmp

Filesize
704KB

Download
memory/2024-560-0x000001A7978F0000-0x000001A79790C000-memory.dmp

Filesize
112KB

Download
memory/2024-558-0x000001A796F80000-0x000001A796F8C000-memory.dmp

Filesize
48KB

Download
memory/2024-562-0x000001A7B0430000-0x000001A7B050C000-memory.dmp

Filesize
880KB

Download
memory/2024-563-0x000001A7B01F0000-0x000001A7B020C000-memory.dmp

Filesize
112KB

Download
memory/2056-66-0x0000000004700000-0x00000000047B2000-memory.dmp

Filesize
712KB

Download
memory/2056-70-0x00000000047C0000-0x0000000004B14000-memory.dmp

Filesize
3.3MB

Download
memory/2056-69-0x0000000004690000-0x00000000046B2000-memory.dmp

Filesize
136KB

Download
memory/2128-496-0x0000028C1CE20000-0x0000028C1CE5A000-memory.dmp

Filesize
232KB

Download
memory/2128-756-0x0000028C35F80000-0x0000028C35F90000-memory.dmp

Filesize
64KB

Download
memory/2128-759-0x0000028C36370000-0x0000028C36398000-memory.dmp

Filesize
160KB

Download
memory/2128-503-0x0000028C35FD0000-0x0000028C36018000-memory.dmp

Filesize
288KB

Download
memory/2128-500-0x0000028C1D710000-0x0000028C1D72C000-memory.dmp

Filesize
112KB

Download
memory/2128-499-0x0000028C36070000-0x0000028C36122000-memory.dmp

Filesize
712KB

Download
memory/2232-332-0x000002429A540000-0x000002429A58A000-memory.dmp

Filesize
296KB

Download
memory/2232-338-0x00000242B3090000-0x00000242B316C000-memory.dmp

Filesize
880KB

Download
memory/2232-333-0x000002429A510000-0x000002429A52C000-memory.dmp

Filesize
112KB

Download
memory/2232-334-0x00000242B2E10000-0x00000242B2E5C000-memory.dmp

Filesize
304KB

Download
memory/2232-335-0x00000242B2E60000-0x00000242B2EA8000-memory.dmp

Filesize
288KB

Download
memory/2232-336-0x000002429A530000-0x000002429A538000-memory.dmp

Filesize
32KB

Download
memory/2232-337-0x000002429A6B0000-0x000002429A6BA000-memory.dmp

Filesize
40KB

Download
memory/2232-347-0x00000242B3320000-0x00000242B335A000-memory.dmp

Filesize
232KB

Download
memory/2232-339-0x00000242B3170000-0x00000242B3222000-memory.dmp

Filesize
712KB

Download
memory/2232-341-0x00000242B2FE0000-0x00000242B2FE8000-memory.dmp

Filesize
32KB

Download
memory/2232-340-0x00000242B2FD0000-0x00000242B2FD8000-memory.dmp

Filesize
32KB

Download
memory/2232-331-0x0000024299C70000-0x0000024299CD8000-memory.dmp

Filesize
416KB

Download
memory/2232-348-0x00000242B3000000-0x00000242B3026000-memory.dmp

Filesize
152KB

Download
memory/2232-346-0x00000242B3030000-0x00000242B305A000-memory.dmp

Filesize
168KB

Download
memory/2232-344-0x00000242B3230000-0x00000242B3298000-memory.dmp

Filesize
416KB

Download
memory/2232-343-0x00000242B2FF0000-0x00000242B2FF8000-memory.dmp

Filesize
32KB

Download
memory/2940-404-0x000002BA420F0000-0x000002BA4210C000-memory.dmp

Filesize
112KB

Download
memory/2940-403-0x000002BA5AA70000-0x000002BA5AB22000-memory.dmp

Filesize
712KB

Download
memory/2940-402-0x000002BA41890000-0x000002BA418A6000-memory.dmp

Filesize
88KB

Download
memory/4072-154-0x000002A293240000-0x000002A293252000-memory.dmp

Filesize
72KB

Download
memory/4072-155-0x000002A2932C0000-0x000002A2932FC000-memory.dmp

Filesize
240KB

Download
memory/4072-138-0x000002A291690000-0x000002A2916B8000-memory.dmp

Filesize
160KB

Download
memory/4072-150-0x000002A2ABD90000-0x000002A2ABE28000-memory.dmp

Filesize
608KB

Download
memory/4256-33-0x0000000002CD0000-0x0000000002CDC000-memory.dmp

Filesize
48KB

Download
memory/4256-29-0x0000000002C80000-0x0000000002CAE000-memory.dmp

Filesize
184KB

Download
memory/4260-233-0x000002574B280000-0x000002574B2B8000-memory.dmp

Filesize
224KB

Download
memory/4260-187-0x000002574AC90000-0x000002574AD42000-memory.dmp

Filesize
712KB

Download
memory/4260-191-0x000002574AD80000-0x000002574ADA2000-memory.dmp

Filesize
136KB

Download
memory/5008-100-0x0000000004990000-0x00000000049F6000-memory.dmp

Filesize
408KB

Download
memory/5116-470-0x000002597E540000-0x000002597E560000-memory.dmp

Filesize
128KB

Download
memory/5116-469-0x000002597EF00000-0x000002597EFB2000-memory.dmp

Filesize
712KB

Download
memory/5116-468-0x000002597E520000-0x000002597E538000-memory.dmp

Filesize
96KB

Download
memory/5116-467-0x000002597DCD0000-0x000002597DCDC000-memory.dmp

Filesize
48KB

Download