Analysis
-
max time kernel
89s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-de -
resource tags
arch:x64arch:x86image:win10v2004-20250129-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
11/02/2025, 18:14
Behavioral task
behavioral1
Sample
d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a.msi
Resource
win7-20240903-de
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a.msi
Resource
win10v2004-20250129-de
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a.msi
-
Size
2.9MB
-
MD5
9a70f71e961db28a61f88b5a401cc6b9
-
SHA1
afc84d322954f1c543a24f354885a2a9938a9118
-
SHA256
d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a
-
SHA512
b9747e78e6b03631093ac57a3bd6a7c8ab1f2ee724589db1fd9e282ef5f3be81e0499652977567f815bcf26d1f3fa3470e7b59890986ced94043b8c0d37da209
-
SSDEEP
49152:++1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:++lUlz9FKbsodq0YaH7ZPxMb8tT
Malware Config
Signatures
-
AteraAgent
AteraAgent is a remote monitoring and management tool.
-
Ateraagent family
-
Detects AteraAgent 1 IoCs
resource yara_rule behavioral2/files/0x0007000000000034-250.dat family_ateraagent -
Blocklisted process makes network request 4 IoCs
flow pid Process 4 4056 msiexec.exe 6 4056 msiexec.exe 25 4068 rundll32.exe 70 3668 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe File opened for modification C:\Windows\system32\InstallUtil.InstallLog AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 AteraAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944 AteraAgent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll msiexec.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState AteraAgent.exe File opened for modification C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt AteraAgent.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll msiexec.exe File created C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll msiexec.exe -
Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB9BC.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB3DC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB3DC.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIBF5A.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB9BC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB9BC.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB3DC.tmp-\System.Management.dll rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB6CD.tmp-\Newtonsoft.Json.dll rundll32.exe File created C:\Windows\Installer\e57b623.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBF5A.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\e57b621.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB3DC.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBF5A.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIB6CD.tmp-\System.Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB9BC.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIB5B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB641.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBF5A.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBF5A.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB9BC.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB6CD.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIB9BC.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB3DC.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB565.tmp msiexec.exe File created C:\Windows\Installer\e57b621.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB3DC.tmp-\AlphaControlAgentInstallation.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBF5A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6CD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6CD.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\SourceHash{E732A0D7-A2F2-4657-AC41-B19742648E45} msiexec.exe File opened for modification C:\Windows\Installer\MSIB564.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6CD.tmp-\AlphaControlAgentInstallation.dll rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 4808 AteraAgent.exe 1760 AteraAgent.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1956 sc.exe -
Loads dropped DLL 31 IoCs
pid Process 1292 MsiExec.exe 700 rundll32.exe 700 rundll32.exe 700 rundll32.exe 700 rundll32.exe 700 rundll32.exe 1292 MsiExec.exe 4068 rundll32.exe 4068 rundll32.exe 4068 rundll32.exe 4068 rundll32.exe 4068 rundll32.exe 4068 rundll32.exe 4068 rundll32.exe 1292 MsiExec.exe 4396 rundll32.exe 4396 rundll32.exe 4396 rundll32.exe 4396 rundll32.exe 4396 rundll32.exe 1292 MsiExec.exe 1392 MsiExec.exe 1392 MsiExec.exe 1292 MsiExec.exe 3668 rundll32.exe 3668 rundll32.exe 3668 rundll32.exe 3668 rundll32.exe 3668 rundll32.exe 3668 rundll32.exe 3668 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4056 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002010d5335a65183a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002010d5330000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002010d533000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2010d533000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002010d53300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Kills process with taskkill 1 IoCs
pid Process 1944 TaskKill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs AteraAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AteraAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs AteraAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" AteraAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs AteraAgent.exe -
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4316 msiexec.exe 4316 msiexec.exe 1760 AteraAgent.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4056 msiexec.exe Token: SeIncreaseQuotaPrivilege 4056 msiexec.exe Token: SeSecurityPrivilege 4316 msiexec.exe Token: SeCreateTokenPrivilege 4056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4056 msiexec.exe Token: SeLockMemoryPrivilege 4056 msiexec.exe Token: SeIncreaseQuotaPrivilege 4056 msiexec.exe Token: SeMachineAccountPrivilege 4056 msiexec.exe Token: SeTcbPrivilege 4056 msiexec.exe Token: SeSecurityPrivilege 4056 msiexec.exe Token: SeTakeOwnershipPrivilege 4056 msiexec.exe Token: SeLoadDriverPrivilege 4056 msiexec.exe Token: SeSystemProfilePrivilege 4056 msiexec.exe Token: SeSystemtimePrivilege 4056 msiexec.exe Token: SeProfSingleProcessPrivilege 4056 msiexec.exe Token: SeIncBasePriorityPrivilege 4056 msiexec.exe Token: SeCreatePagefilePrivilege 4056 msiexec.exe Token: SeCreatePermanentPrivilege 4056 msiexec.exe Token: SeBackupPrivilege 4056 msiexec.exe Token: SeRestorePrivilege 4056 msiexec.exe Token: SeShutdownPrivilege 4056 msiexec.exe Token: SeDebugPrivilege 4056 msiexec.exe Token: SeAuditPrivilege 4056 msiexec.exe Token: SeSystemEnvironmentPrivilege 4056 msiexec.exe Token: SeChangeNotifyPrivilege 4056 msiexec.exe Token: SeRemoteShutdownPrivilege 4056 msiexec.exe Token: SeUndockPrivilege 4056 msiexec.exe Token: SeSyncAgentPrivilege 4056 msiexec.exe Token: SeEnableDelegationPrivilege 4056 msiexec.exe Token: SeManageVolumePrivilege 4056 msiexec.exe Token: SeImpersonatePrivilege 4056 msiexec.exe Token: SeCreateGlobalPrivilege 4056 msiexec.exe Token: SeBackupPrivilege 4468 vssvc.exe Token: SeRestorePrivilege 4468 vssvc.exe Token: SeAuditPrivilege 4468 vssvc.exe Token: SeBackupPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 4068 rundll32.exe Token: SeBackupPrivilege 1848 srtasks.exe Token: SeRestorePrivilege 1848 srtasks.exe Token: SeSecurityPrivilege 1848 srtasks.exe Token: SeTakeOwnershipPrivilege 1848 srtasks.exe Token: SeBackupPrivilege 1848 srtasks.exe Token: SeRestorePrivilege 1848 srtasks.exe Token: SeSecurityPrivilege 1848 srtasks.exe Token: SeTakeOwnershipPrivilege 1848 srtasks.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 1944 TaskKill.exe Token: SeRestorePrivilege 4316 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4056 msiexec.exe 4056 msiexec.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4316 wrote to memory of 1848 4316 msiexec.exe 92 PID 4316 wrote to memory of 1848 4316 msiexec.exe 92 PID 4316 wrote to memory of 1292 4316 msiexec.exe 94 PID 4316 wrote to memory of 1292 4316 msiexec.exe 94 PID 4316 wrote to memory of 1292 4316 msiexec.exe 94 PID 1292 wrote to memory of 700 1292 MsiExec.exe 95 PID 1292 wrote to memory of 700 1292 MsiExec.exe 95 PID 1292 wrote to memory of 700 1292 MsiExec.exe 95 PID 1292 wrote to memory of 4068 1292 MsiExec.exe 97 PID 1292 wrote to memory of 4068 1292 MsiExec.exe 97 PID 1292 wrote to memory of 4068 1292 MsiExec.exe 97 PID 1292 wrote to memory of 4396 1292 MsiExec.exe 117 PID 1292 wrote to memory of 4396 1292 MsiExec.exe 117 PID 1292 wrote to memory of 4396 1292 MsiExec.exe 117 PID 4316 wrote to memory of 1392 4316 msiexec.exe 118 PID 4316 wrote to memory of 1392 4316 msiexec.exe 118 PID 4316 wrote to memory of 1392 4316 msiexec.exe 118 PID 1392 wrote to memory of 4668 1392 MsiExec.exe 119 PID 1392 wrote to memory of 4668 1392 MsiExec.exe 119 PID 1392 wrote to memory of 4668 1392 MsiExec.exe 119 PID 4668 wrote to memory of 4952 4668 NET.exe 121 PID 4668 wrote to memory of 4952 4668 NET.exe 121 PID 4668 wrote to memory of 4952 4668 NET.exe 121 PID 1392 wrote to memory of 1944 1392 MsiExec.exe 122 PID 1392 wrote to memory of 1944 1392 MsiExec.exe 122 PID 1392 wrote to memory of 1944 1392 MsiExec.exe 122 PID 4316 wrote to memory of 4808 4316 msiexec.exe 124 PID 4316 wrote to memory of 4808 4316 msiexec.exe 124 PID 1292 wrote to memory of 3668 1292 MsiExec.exe 126 PID 1292 wrote to memory of 3668 1292 MsiExec.exe 126 PID 1292 wrote to memory of 3668 1292 MsiExec.exe 126 PID 1760 wrote to memory of 1956 1760 AteraAgent.exe 127 PID 1760 wrote to memory of 1956 1760 AteraAgent.exe 127 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4056
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 291B05C1CF338F8AFB72896FBB8BB3E62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB6CD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240629703 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:700
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB9BC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240630234 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB3DC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240694250 11 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4396
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIBF5A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240697187 33 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3668
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7B1D3D34ADB205302995C073F1724284 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\NET.exe"NET" STOP AteraAgent3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP AteraAgent4⤵
- System Location Discovery: System Language Discovery
PID:4952
-
-
-
C:\Windows\SysWOW64\TaskKill.exe"TaskKill.exe" /f /im AteraAgent.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000QGcbqIAD" /AgentId="05bd7e2f-661e-463a-a793-8ebdcd7bb22b"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4808
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
- Launches sc.exe
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD53bfbfc76d564dc0f6cb1c028b98fbc3e
SHA1b1abe112ba580a8abba78caeb367407638887398
SHA256e9dde01b6ed0ad86bc05c358d6e438191ebefed87485d2c824e64131b599a9f0
SHA5127882c1b9281c2cdd2ffdcfca325066a5fb623b41df159ffac51f9d9f1ff2aa9c3294201ea6127270c24638646f0950778eb103f6311dea98f152b5b1069bd727
-
Filesize
142KB
MD5477293f80461713d51a98a24023d45e8
SHA1e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA256a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
SHA51223f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
-
Filesize
1KB
MD5b3bb71f9bb4de4236c26578a8fae2dcd
SHA11ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA256e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
SHA512fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
-
Filesize
693KB
MD52c4d25b7fbd1adfd4471052fa482af72
SHA1fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA2562a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
SHA512f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
-
Filesize
588KB
MD517d74c03b6bcbcd88b46fcc58fc79a0d
SHA1bc0316e11c119806907c058d62513eb8ce32288c
SHA25613774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
SHA512f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
-
Filesize
213B
MD53c58be7b18ffd5ed66051eac68a2779c
SHA194b9501263aeaec2554ee45fc427bb1b8e536cc9
SHA256ae407ae4f11febc316fc4932738619fcf73613149d879857e02755a8cf117ca8
SHA5126eea67a4d3925e87e36551b695bdfa23292eb3683c288c0491bc86d3c388112e9c780becd2507f9ee7b7b93d2893e1505512c3661eba12d3ad726594f3fe0b43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD5e242e879ac7e69a50d90b031da6dd7be
SHA1664aedee6aed13e5ffb04b2e55027b62a1dca424
SHA256117ea178466c2511e2a5f8aa6ba60aa395e33d47ca8a7778d7126b172b4bc7ed
SHA512252515fab4dbefe9a820ce3c972a5596a017ffc94bdaec9bf1cba97debe9d516949f19936ac50a604d4f6822b0254e740dd52f53482101ae39be9a20875387b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize727B
MD517c3144b951201b5c7ba287c302e30db
SHA1aae8469d67066d1def775b7e2a24de2ff312c642
SHA256347c70bbd5ac08ce5107a28597033c075b518d1404703dfdc2043cc36ab56c00
SHA512088550c13e80ebf16b4bb542a0a3ba1df2c9d3a98008b293accd1a1aa4019c0917bb970d8b349afd9fb365c892107251d5aea5f16d27bb18c582545ebd64a6c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5d7909c7cd997af5e26a89920cd8b320a
SHA1058e556bd3abd9b117a6a159f1f9baef60ba9bc5
SHA25645c8301f0b9cd3c3a363ce79b38d3b1488eab1ab81782ec375a16101ed7e740b
SHA51203c41ce3220fd87e22911ee5a4571bc374eb4f93871c39fd4419b91b4ed110cdcedb6138e652ba7d5937573bee5fa7d18346692c4be779210d31d0d50d3f0256
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD5a7aff5a58e2f8b54584281e5e822695f
SHA19cda648ffd6f402df28f52229812a150a11a1228
SHA25622c2ed06756130f7113225a974cf9064a762619cb6a84a8c777d040d1283fa28
SHA512a6fe070386d4aaa075ab5ba47004922f5c60ac6568004e41aa0444f3e8c0272ffe7c1809d56c88a6300a6308d58c49a340f88dd44ae63578810af201ebddc2a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Filesize404B
MD5e5530cdd3d671771080f6e69502d0d0e
SHA1cb4339a69c8615dafa839d1d3e09d8739855c017
SHA25655e35c1e7502bff6078aef1de55d3587cbc7add866fab16ab16461baacbc67ef
SHA512abcec25983913518dfbcdcd004a8763ed745d7dc322c383fbf941c87e7b359e502e529b385498c09a44b7847910a4754e7e53164a51fa57344970d68ef214281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD521ce893256b526732ccac284e29a20e8
SHA109dded9d0c4fe041b0cfa77f6198741780764b4b
SHA2565d535124128664fb7ec2cbad299d33ac46ded3a5ed568014c36ed072056cafc7
SHA512c0b34c53d8f52247b51847d37c3718fad3ee34deb49807a42c278c50bf10963aa08ec7c634bee6ffc359d651ce87a2418d461f3199577f9f5a181eec2e8f999f
-
Filesize
651B
MD59bbfe11735bac43a2ed1be18d0655fe2
SHA161141928bb248fd6e9cd5084a9db05a9b980fb3a
SHA256549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
SHA512a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
509KB
MD588d29734f37bdcffd202eafcdd082f9d
SHA1823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA25687c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
SHA5121343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
-
Filesize
25KB
MD5aa1b9c5c685173fad2dabebeb3171f01
SHA1ed756b1760e563ce888276ff248c734b7dd851fb
SHA256e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
SHA512d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
-
Filesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
Filesize
1KB
MD5bc17e956cde8dd5425f2b2a68ed919f8
SHA15e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA256e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
SHA51202090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
-
Filesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
Filesize
2.9MB
MD59a70f71e961db28a61f88b5a401cc6b9
SHA1afc84d322954f1c543a24f354885a2a9938a9118
SHA256d86cd0522385c94d127a8a687fcde9bbfe2f025d061b050458b03a75e908a97a
SHA512b9747e78e6b03631093ac57a3bd6a7c8ab1f2ee724589db1fd9e282ef5f3be81e0499652977567f815bcf26d1f3fa3470e7b59890986ced94043b8c0d37da209
-
Filesize
24.1MB
MD52463626af3b6bb27f7b1b6c3d333661c
SHA149a2bdc078bc9040361ebefd60b2c4f3292b5833
SHA2560e62c9675a1b04f99e59242f2eed6de85ffd81aa68cc1e05b3de97c4142241e6
SHA512c668f19c2706ebcefa4637aadf25899504222aba865d6938cc2134a6510bd642e270c0853ab7140a7ddbac01ac6938e63096a1b50bdbcaa28c81861c2ede1435
-
\??\Volume{33d51020-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b54c5757-c23f-440e-ac39-7bc9b0ea2d2b}_OnDiskSnapshotProp
Filesize6KB
MD54a42ccac199036b498c865ae3b4a3757
SHA1774ff3b97225e456bf073936c97841600e2139de
SHA256b9533ade942b8d8f73931536cb4510827861c84716634f6aff5a4e51931166d8
SHA5120986eaec833f57f58d5d07a8c8cbd64b1dcde3c1090ede15064286c43df4f1ed4333a2507fd2f7ae91f6e026b5fda9cc68ae601a8119c8f31389cb9772cdfacc