ateraagent | 768eaad977f0e47869a05f653895ef1c14b3c83905a91e2b8dc56b718e056de6

Analysis

max time kernel
123s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15/02/2025, 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pdf946946.msi
Size

2.9MB
MD5

8b6b0ec93209591b6f987b27b150f803
SHA1

dd64e5c25c9237b6a52f68dcc6a5777c83c5fef3
SHA256

768eaad977f0e47869a05f653895ef1c14b3c83905a91e2b8dc56b718e056de6
SHA512

0e892754f982114ab1d99bef288123563543c1010289f312f9b9e8c3abd8845c907ef665dc60dd744b3c840fe11c4546c1bee5bcbebeb67469cda4e3409e0a39
SSDEEP

49152:++1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:++lUlz9FKbsodq0YaH7ZPxMb8tT

Score

10^/10

ateraagent discovery persistence privilege_escalation rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000194a3-668.dat	family_ateraagent

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	2368	msiexec.exe
5	2368	msiexec.exe
7	2368	msiexec.exe
11	2256	rundll32.exe
20	2256	rundll32.exe
22	2256	rundll32.exe
28	2060	rundll32.exe
30	2060	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AgentPackageAgentInformation.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt	AgentPackageAgentInformation.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini	AteraAgent.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI23F7.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI23F7.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2B96.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI76E9.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI23F7.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2B96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76E9.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9191.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2B96.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\f7722fc.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76E9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI76E9.tmp-\System.Management.dll	rundll32.exe
File created	C:\Windows\Installer\f7722fe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9191.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI23F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23F7.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2B96.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI76E9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7C46.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9191.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9191.tmp-\System.Management.dll	rundll32.exe
File created	C:\Windows\Installer\f7722fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7722fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B96.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\f7722fc.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E9B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9191.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI23F7.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI76E9.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2B96.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7D14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9191.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe

Executes dropped EXE 3 IoCs

pid	Process
1028	AteraAgent.exe
1364	AteraAgent.exe
2408	AgentPackageAgentInformation.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2264	sc.exe

Loads dropped DLL 35 IoCs

pid	Process
1944	MsiExec.exe
3004	rundll32.exe
3004	rundll32.exe
3004	rundll32.exe
3004	rundll32.exe
3004	rundll32.exe
1944	MsiExec.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
1944	MsiExec.exe
2480	rundll32.exe
2480	rundll32.exe
2480	rundll32.exe
2480	rundll32.exe
2480	rundll32.exe
1944	MsiExec.exe
1292	MsiExec.exe
1292	MsiExec.exe
1944	MsiExec.exe
2060	rundll32.exe
2060	rundll32.exe
2060	rundll32.exe
2060	rundll32.exe
2060	rundll32.exe
2060	rundll32.exe
2060	rundll32.exe
2060	rundll32.exe
2060	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2368	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1716	TaskKill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AteraAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AgentPackageAgentInformation.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AteraAgent.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "pdf946946.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2780	msiexec.exe
2780	msiexec.exe
1364	AteraAgent.exe
2408	AgentPackageAgentInformation.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2368	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeCreateTokenPrivilege	2368	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2368	msiexec.exe
Token: SeLockMemoryPrivilege	2368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2368	msiexec.exe
Token: SeMachineAccountPrivilege	2368	msiexec.exe
Token: SeTcbPrivilege	2368	msiexec.exe
Token: SeSecurityPrivilege	2368	msiexec.exe
Token: SeTakeOwnershipPrivilege	2368	msiexec.exe
Token: SeLoadDriverPrivilege	2368	msiexec.exe
Token: SeSystemProfilePrivilege	2368	msiexec.exe
Token: SeSystemtimePrivilege	2368	msiexec.exe
Token: SeProfSingleProcessPrivilege	2368	msiexec.exe
Token: SeIncBasePriorityPrivilege	2368	msiexec.exe
Token: SeCreatePagefilePrivilege	2368	msiexec.exe
Token: SeCreatePermanentPrivilege	2368	msiexec.exe
Token: SeBackupPrivilege	2368	msiexec.exe
Token: SeRestorePrivilege	2368	msiexec.exe
Token: SeShutdownPrivilege	2368	msiexec.exe
Token: SeDebugPrivilege	2368	msiexec.exe
Token: SeAuditPrivilege	2368	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2368	msiexec.exe
Token: SeChangeNotifyPrivilege	2368	msiexec.exe
Token: SeRemoteShutdownPrivilege	2368	msiexec.exe
Token: SeUndockPrivilege	2368	msiexec.exe
Token: SeSyncAgentPrivilege	2368	msiexec.exe
Token: SeEnableDelegationPrivilege	2368	msiexec.exe
Token: SeManageVolumePrivilege	2368	msiexec.exe
Token: SeImpersonatePrivilege	2368	msiexec.exe
Token: SeCreateGlobalPrivilege	2368	msiexec.exe
Token: SeBackupPrivilege	2808	vssvc.exe
Token: SeRestorePrivilege	2808	vssvc.exe
Token: SeAuditPrivilege	2808	vssvc.exe
Token: SeBackupPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	1700	DrvInst.exe
Token: SeRestorePrivilege	1700	DrvInst.exe
Token: SeRestorePrivilege	1700	DrvInst.exe
Token: SeRestorePrivilege	1700	DrvInst.exe
Token: SeRestorePrivilege	1700	DrvInst.exe
Token: SeRestorePrivilege	1700	DrvInst.exe
Token: SeRestorePrivilege	1700	DrvInst.exe
Token: SeLoadDriverPrivilege	1700	DrvInst.exe
Token: SeLoadDriverPrivilege	1700	DrvInst.exe
Token: SeLoadDriverPrivilege	1700	DrvInst.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2368	msiexec.exe
2368	msiexec.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1944	2780	msiexec.exe	35
PID 2780 wrote to memory of 1944	2780	msiexec.exe	35
PID 2780 wrote to memory of 1944	2780	msiexec.exe	35
PID 2780 wrote to memory of 1944	2780	msiexec.exe	35
PID 2780 wrote to memory of 1944	2780	msiexec.exe	35
PID 2780 wrote to memory of 1944	2780	msiexec.exe	35
PID 2780 wrote to memory of 1944	2780	msiexec.exe	35
PID 1944 wrote to memory of 3004	1944	MsiExec.exe	36
PID 1944 wrote to memory of 3004	1944	MsiExec.exe	36
PID 1944 wrote to memory of 3004	1944	MsiExec.exe	36
PID 1944 wrote to memory of 3004	1944	MsiExec.exe	36
PID 1944 wrote to memory of 3004	1944	MsiExec.exe	36
PID 1944 wrote to memory of 3004	1944	MsiExec.exe	36
PID 1944 wrote to memory of 3004	1944	MsiExec.exe	36
PID 1944 wrote to memory of 2256	1944	MsiExec.exe	37
PID 1944 wrote to memory of 2256	1944	MsiExec.exe	37
PID 1944 wrote to memory of 2256	1944	MsiExec.exe	37
PID 1944 wrote to memory of 2256	1944	MsiExec.exe	37
PID 1944 wrote to memory of 2256	1944	MsiExec.exe	37
PID 1944 wrote to memory of 2256	1944	MsiExec.exe	37
PID 1944 wrote to memory of 2256	1944	MsiExec.exe	37
PID 1944 wrote to memory of 2480	1944	MsiExec.exe	38
PID 1944 wrote to memory of 2480	1944	MsiExec.exe	38
PID 1944 wrote to memory of 2480	1944	MsiExec.exe	38
PID 1944 wrote to memory of 2480	1944	MsiExec.exe	38
PID 1944 wrote to memory of 2480	1944	MsiExec.exe	38
PID 1944 wrote to memory of 2480	1944	MsiExec.exe	38
PID 1944 wrote to memory of 2480	1944	MsiExec.exe	38
PID 2780 wrote to memory of 1292	2780	msiexec.exe	40
PID 2780 wrote to memory of 1292	2780	msiexec.exe	40
PID 2780 wrote to memory of 1292	2780	msiexec.exe	40
PID 2780 wrote to memory of 1292	2780	msiexec.exe	40
PID 2780 wrote to memory of 1292	2780	msiexec.exe	40
PID 2780 wrote to memory of 1292	2780	msiexec.exe	40
PID 2780 wrote to memory of 1292	2780	msiexec.exe	40
PID 1292 wrote to memory of 2340	1292	MsiExec.exe	41
PID 1292 wrote to memory of 2340	1292	MsiExec.exe	41
PID 1292 wrote to memory of 2340	1292	MsiExec.exe	41
PID 1292 wrote to memory of 2340	1292	MsiExec.exe	41
PID 2340 wrote to memory of 1808	2340	NET.exe	43
PID 2340 wrote to memory of 1808	2340	NET.exe	43
PID 2340 wrote to memory of 1808	2340	NET.exe	43
PID 2340 wrote to memory of 1808	2340	NET.exe	43
PID 1292 wrote to memory of 1716	1292	MsiExec.exe	44
PID 1292 wrote to memory of 1716	1292	MsiExec.exe	44
PID 1292 wrote to memory of 1716	1292	MsiExec.exe	44
PID 1292 wrote to memory of 1716	1292	MsiExec.exe	44
PID 2780 wrote to memory of 1028	2780	msiexec.exe	46
PID 2780 wrote to memory of 1028	2780	msiexec.exe	46
PID 2780 wrote to memory of 1028	2780	msiexec.exe	46
PID 1944 wrote to memory of 2060	1944	MsiExec.exe	48
PID 1944 wrote to memory of 2060	1944	MsiExec.exe	48
PID 1944 wrote to memory of 2060	1944	MsiExec.exe	48
PID 1944 wrote to memory of 2060	1944	MsiExec.exe	48
PID 1944 wrote to memory of 2060	1944	MsiExec.exe	48
PID 1944 wrote to memory of 2060	1944	MsiExec.exe	48
PID 1944 wrote to memory of 2060	1944	MsiExec.exe	48
PID 1364 wrote to memory of 2264	1364	AteraAgent.exe	49
PID 1364 wrote to memory of 2264	1364	AteraAgent.exe	49
PID 1364 wrote to memory of 2264	1364	AteraAgent.exe	49
PID 1364 wrote to memory of 2408	1364	AteraAgent.exe	51
PID 1364 wrote to memory of 2408	1364	AteraAgent.exe	51
PID 1364 wrote to memory of 2408	1364	AteraAgent.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\pdf946946.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6ADC134B6038EDD862E5E86D9275133
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI23F7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259466588 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3004
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2B96.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259468210 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI76E9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259487632 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9191.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259494309 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2060
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 572453E9DCC24E1754C7F805C070A4F3 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\syswow64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      System Location Discovery: System Language Discovery
      PID:1808
- - C:\Windows\syswow64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1716
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000QMzFeIAL" /AgentId="ec218848-9bec-41f9-984b-38b7fb511089"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005EC" "00000000000005E8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:2264
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" ec218848-9bec-41f9-984b-38b7fb511089 "740fa124-8230-4385-9b0c-0fe335ff4501" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QMzFeIAL
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7722fd.rbs

Filesize
8KB

MD5
a7e83d17c0e10cf3b2bc83637acc06e7

SHA1
3a69f1d274294cd814c1d4aad737e5bb42628289

SHA256
c1319a220b11cd453cc7bf9e9f594e0efe86bdc01b586f3cb08ee0c19b14520c

SHA512
b8283ed2309c3181606351ca6f4a970228c07113b0ef4eb6dcd38afb76316db85fe5cfb3ddad5092e7e22dea55518adeeaa31874db542b8a131365b27d57c70f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

Filesize
753B

MD5
8298451e4dee214334dd2e22b8996bdc

SHA1
bc429029cc6b42c59c417773ea5df8ae54dbb971

SHA256
6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

SHA512
cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Filesize
142KB

MD5
477293f80461713d51a98a24023d45e8

SHA1
e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

SHA256
a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

SHA512
23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Filesize
1KB

MD5
b3bb71f9bb4de4236c26578a8fae2dcd

SHA1
1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

SHA256
e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

SHA512
fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

Filesize
210KB

MD5
c106df1b5b43af3b937ace19d92b42f3

SHA1
7670fc4b6369e3fb705200050618acaa5213637f

SHA256
2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

SHA512
616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Filesize
693KB

MD5
2c4d25b7fbd1adfd4471052fa482af72

SHA1
fd6cd773d241b581e3c856f9e6cd06cb31a01407

SHA256
2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

SHA512
f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Filesize
247KB

MD5
aa5cf64d575b7544eefd77f256c4dc57

SHA1
bd23989db4f9af0aae34d032e817d802c06ca5a9

SHA256
79c5afd94d0ffa3519a90e691a6d47f9c2eec93277f7d369aa34e64b171fc920

SHA512
774aeb5188c536d556a8c7a0cd3dfd9ab22d7bc0ad13353d11c9153232585da352552a69eb967a741372a99db490df355a5a47696b2ea446582c834c963cfeff

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

Filesize
546B

MD5
158fb7d9323c6ce69d4fce11486a40a1

SHA1
29ab26f5728f6ba6f0e5636bf47149bd9851f532

SHA256
5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

SHA512
7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt

Filesize
23KB

MD5
c3612935274e8f46d5000ef0f719cd37

SHA1
0c00ce68cd2daac80ddb5d3153f299aa467f3ac8

SHA256
09939cc3988df211a323cc6c9a918a63d0206b9fdb90d12250789b0c62ed64e8

SHA512
de61a0f99279be3c042e47269a6a12482796d2b3aa283684ef61eea911340d3bebf6d911370a1f99778ffe7ec879ec3b0c6466f356a718da78ad4acd7c7fe847

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Filesize
588KB

MD5
17d74c03b6bcbcd88b46fcc58fc79a0d

SHA1
bc0316e11c119806907c058d62513eb8ce32288c

SHA256
13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

SHA512
f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Filesize
215B

MD5
5d838504e7e5ec9d7647f5205bc0e0ce

SHA1
89425bfc0eebdf09ce972c4c9e811e2154f22ba3

SHA256
355691d0464fe2e48161ce8350e14cfc0b8651faf7467ee7a4bdb29de9acc372

SHA512
38546ee9de951341af561275125f2d26c17b9ef28b830aa45c84379134b1515af164692dcaec56a8a338fee65ccb540b38b1bc65e05213ff92f6f3efa24507c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
5a6ad86366d524d0c97575a793f9341a

SHA1
37c1d9a31181095aa815c91b174e7556dab24b06

SHA256
a8b872392b38fa5ab1b500a3c6636bace1beb21fe017a7a85cc018e643e82191

SHA512
a88fb5809703642704b333a68f5757fee28f0e42d387aea880a3382a2f320a32db0e5ab55a692b4d992df8ee52752646bb733b89042e80b496f5c5424168da0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC

Filesize
727B

MD5
6498b81e536259e376affad98816dc4e

SHA1
4ce492a3d6b47b663ec9a111e6c9c600fe78d742

SHA256
4d59e8fd0e13f77745e95f28527c1fde5e9dc217c4eba4bc3d708d9311386b9c

SHA512
fdb75f84b07bd773895081d2e98bbd14efbcd052ec8746b297056ad728e4bbf01693499a19999c0a89b6b6abf63aa8a8c38637dc48c23665dcc4e391fe818903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
d39eae67869deeb84112085d89c9ed81

SHA1
2e96a6861bf3f56538522bb855f0cdc614e6bfb8

SHA256
34b726e85a86b363eab542888911a131e5bade3b5fab69ae747d4395f76c2462

SHA512
9d2348d0fdc1d50ee85be71f231c742ac0063145d0d57c88e0b5a62c13fd2c950be16b308a15f1fe7b699a2a54acff2cbe9a01562331656c0593b3caa2023490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
573f07c974db47c1ab33a828e89977a5

SHA1
072a7311b81e5c42d86417de1b380dae99dab397

SHA256
e8da41434aeb14805d07595d994602294dfa72cd49e81cdea420c49a5c74dfae

SHA512
70713aa4a6b047d242843bfafeb4f4bed3a986008d968e6dd9f51a399668a0ab1ef46cb18585e0b94b263f5baa2af66f5307978f57fa3f2bd1989df5fee15a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC

Filesize
412B

MD5
6f32ad2cc7ac8a89ce95422bafae3fc7

SHA1
3602a73810bfbd39a6c24a4236e8fafe93a352ef

SHA256
4277d40d123f99c87b0192577b567b6c5230b0f2df603a6f2aa4f5c6c7990ce3

SHA512
6d6960b88d7b56f4a8c8837f8bd68e2a14c5f488bdd1170e6118a6e7e6651f9298f94ebb25ce998c0905648c773e1d650567744c9de5844a4a7499e413a5aba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57075338bfe05dc61eb265dbe2492b3c

SHA1
1f60a6729451dbf466036018a5aa67d9c1c68ad2

SHA256
e9c18623c39b4d2a7971bc30ce0473e0bc60233eec898b5320e35e35d5e59f9b

SHA512
1cd7f5f3cc298884ce7babf5ce8cfdd5138f6c1002206dcc144f98949e2e409d258b3b09f8a09db7b5f904292eb249226c8861e72f7d011aaa78ea39b8dfee1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49566dd18a1c7836c9f1f11d102a9c09

SHA1
0c650dcb9e8f7abb1f79e06df64d4722c22677ec

SHA256
25f22829bd89fd6988e835423272c8da5d48751f9157aa0010afa556638851ef

SHA512
fd25b700b46ffef72c51bd6a4d6f57e46a99a9e7aad159476ad1a751b4a416c139b28808850f286dd321d6273a7cd682f0e68460b0878eb6736bb1961e972c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
07003e0fe5751c00c25154da8ca0779b

SHA1
9a7afeeac5208870ca93e61197218f107b0d70d2

SHA256
95d788d8e5c481851fd51de25dd8b50df56c122d90d59e4778d10d05312438ad

SHA512
f69433fcab8a4ff1ad2e33564f3230c599ac8fba0e728a1fafc12c829d73f373957943b000e9cde3969e1b02fe6e6c8e2eb7939a48bf556e8d8ed94f1bae13c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ed6f1fa11455e2156e2dec2291f5ea7c

SHA1
9ff73e09992509ddf1c3d20fd468a31ddbf8655b

SHA256
851c300486814308383fa3b9adef3ad507d78bd8367b01427c0aa9a3758c649b

SHA512
2a769a877258cc46847b5cc2776c4de31c6f9aaac9724a9c44d45d62487813c72558b2294783ea898e946bd5d61d83a1ad1b76d3289a6e10b274bce464a307fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB21.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSI2B96.tmp-\CustomAction.config

Filesize
1KB

MD5
bc17e956cde8dd5425f2b2a68ed919f8

SHA1
5e3736331e9e2f6bf851e3355f31006ccd8caa99

SHA256
e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

SHA512
02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

Download Submit
C:\Windows\Installer\MSI2B96.tmp-\Newtonsoft.Json.dll

Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
C:\Windows\Installer\MSI7C57.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\f7722fb.msi

Filesize
2.9MB

MD5
8b6b0ec93209591b6f987b27b150f803

SHA1
dd64e5c25c9237b6a52f68dcc6a5777c83c5fef3

SHA256
768eaad977f0e47869a05f653895ef1c14b3c83905a91e2b8dc56b718e056de6

SHA512
0e892754f982114ab1d99bef288123563543c1010289f312f9b9e8c3abd8845c907ef665dc60dd744b3c840fe11c4546c1bee5bcbebeb67469cda4e3409e0a39

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53718a53e29b27c931a7777034befc9a

SHA1
e4d8f6ed37488a3b0d8dcc4fd13b07a939d11bef

SHA256
8c547f0cc98f7c932dd942b7668733fd61920b3a8ebc04f9f27308e62472561f

SHA512
fd27170532465859685180d19873f169ebdf5861c33cbc8607719084b91adc1bd470fb09ab58b74a1fc2894102d3627fabf028fb10e5b82e78c313915a95d153

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2cf19b3eb9bed618b5f1eed4858aea8

SHA1
13d839c3e4fcceb1688e141c149e77055ff8264b

SHA256
6065e274b311cca6536eeebcb0210e4b89f9a06fbf99776ff119ec77b9eb6685

SHA512
1d4dafc36bee74696c3eeed1f15e85309a7c0aa2d5dbef446308c1e952ee69c45e84102b62248ca11fbbe510be7304c7c7a95f5919300cea1d06b9692d4d4385

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61a43e14c0bf5df349427b54b15b6736

SHA1
6b0a78713d7fc6327c132f6ab17625daa20da03a

SHA256
87cf88e2c2e0b042cee6330d6703c0c031fa2a7de639bc6b35d0506768d29c0f

SHA512
346e67606afcbc4d74d9e922f7e6043fafc01e57ec53c91d40724288271e98d01e561211290f28ffec9f2a33adc470e03a36e14dfe891f48b557e829974ca72e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28288099a0b7c18e4611f7f3c017a11e

SHA1
8fce8776fbd5016c9254a457406f7478d5060b98

SHA256
c61d805962f52732ae8ab7fece7954f1e365fc93a59a4bfd00196e9897f97114

SHA512
e1d41d3b9228c2a4128d733f292d3858b070201415790aae95023e3349b7565ff5db43b47483aa3e8fe91ad0a715bb45b631322f10cae820013d1387cc4b6ce3

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab47eee7199c025915bc812fb2c51ad4

SHA1
cc5f0a678f9627decf15ccc18da978f5076328bb

SHA256
adcaf7ba2397d9eca99b5ef62cb4845b263fe968c772163aa5f94d365ebb6bbb

SHA512
cf19139b7c0b0de65c6e575abac06fb37f4ebc2aa6d4fc380dbf319ce2abe99fce2047ea56e8fa3abaa385ef6d2aa378c606454373c7faf2597cdf7587cd2755

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8924f2f2a7bb23c37e7413d76dcda47b

SHA1
930e4b66eaa6b713d096ddd9512184e7e0b55fb3

SHA256
74793ed86e042ace3938d4dd71b030f64e30c28ba39e409f9fa1cbe27369b44c

SHA512
c71bc1608daef62069e5fff7a2015a59526abc2703424f82405dc09999eb1913ffbdb4b3c0ecfee6559fbbdb8eb0fb4235e743e467096b407f38e584d7eb6f79

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4600a78698cef8d5c5ff511e866ebc5c

SHA1
4bc3695850805669c31e348e6817636ae6aefa10

SHA256
ff7b738eef236d8ec81ea7c514a8a1579ce34af005e44748246ce092c84f4950

SHA512
c6707876d8c90e141257f7fa7306e7063448850702596313f1f6a1d22257fd7c1cf828493c2cb9ece7ad52dbc26289964ca938dbae7a3d472baecb51f156d76b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13b1e1fd29769631297b7284856e51ed

SHA1
b26c1a414fef834337f7c3345135174cdfd2d1a2

SHA256
9c99d1cfff3cc490a30989bde3add687a6824ef20e6b9d5e0a52127940e5cc2b

SHA512
0a9f3a8e17896d73375377f13928726bd88d4f8267d2b855ee217953bbd4b311f46eba2f31e4d2906468e2487a8c4f4b6b716a46bc5c8a6125d9f7b483bdf4b7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ae8f4fc0594ff37b9f3f430f7ba08a

SHA1
660618a43b90724071544432987ce3beeec5c740

SHA256
63a0898ed3ea6e4d53c4b9d91bf31a91ee95f8e69c880ff99bd504e3d6ced6c9

SHA512
6923c1244df53e70dccf6372e1873bc2c0cf053b24cc54b1ba490d53d7d263e9ac0f141e3867db4d5f7b4979998f95f9ee14dc7f06df57fd897f4e643a8a423a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76308d66a8bff85dd690a566baf87cb7

SHA1
deaf522c3c6609adc8a5159ba8e97ba72407c69b

SHA256
4bcd85ee416e972bd359f7db5b4cc31f125faeb8966861ba11643c6f0a785903

SHA512
d2e21818a9f675424172a5ef4e1b5a97a127df7f5c4095f0421d0af2ba2e44b0a2a44e97b2ac1dcc547d3330cbacb865669ee78f91fe13e00bb6ebe9a92bf865

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c7ef23420fa98d9038c36a3083f6568

SHA1
fa3733ba108bc833fb601b30fa4349aa250398d4

SHA256
5cc8d8a97b315839e14221ecfab91c3a80c052ca3598fbb611c5eac01c6cd2e1

SHA512
01b29fd734bdf11771904255e49531381d3ebbab28cab205064a5a58169b4390d4573eeb1b5a6d3c6c833ed7c16113eee4a416df9392ea323cc2a1e63ffacb14

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eeb9a5cd2876f022630b1a5edd1e628

SHA1
d7f4816a243798300e45235820e9ef5a41216695

SHA256
e31279f76714b064d9132fd981990de1b7009e5591df25d78c233bf07868f480

SHA512
f749fd754dad251956ff0ebcbd7f91161abcb9efe9a8809d94d37b4d0754445f85806cb75891c645c8198d2f4cda873d0aea383507b5fbd38ba3a47396f6afdc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
199b5f4f3a3e7472211a67eb82a37d50

SHA1
409848d9054323f6e8e5d16fd6b778466ca5b2f8

SHA256
92868ccf3ed89f6ff619d6fdb8a98e3f499fb0b5a02f88c4b2aa0491f02e1c09

SHA512
b22f44d858c12faa19e9dd77e19ab54439c68ffd6df3b2a11383cc312f31a60cfb0443941488d76869f432c57125fd57be93daa6ab12bc6446337199278570a7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2e9f86aa95e68c52f04c67b60f45fb8

SHA1
0732d27ee9cd162867167fdbaf9da49d0463ce17

SHA256
6d8d7946bc16e28ff504025c1d71f64bd22c71d82a12f1df03f2484409b84dcf

SHA512
3d5923b5b367bb2504a3e39cb656c4c56dfd3e6190f01952b3cc90f6f58faf645c139b0678918c50d584a3eeff490baaa94c071d55107ec7e279489c5811e783

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e7b7194674d73b53013d8f4c42eed55

SHA1
53f9dc4798377de1d9686ca67ed06eb522d6ae4d

SHA256
a0cc3cbc92cebfd4df36f2c2ff1e4b8672dbcb131459f60488b8c07eda7f21fb

SHA512
eff8ce67ea0ab8c881e158de5a5871793459d24389d5a3759542b71cc5815cdce50511be18989888475a58024e12d81d98305f1a8cbe70afe9a383b163e4f063

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b180b8fb53fe57b22697a971234a889f

SHA1
573d47858050e82f8b230355dd0dc28eaac77b54

SHA256
36002d0339f2fed0b0aebcfe2e81d1824559e03e92d83f1cbf93293f3f5c1f34

SHA512
76091d2773836d99013fe11ceac3c86340c7f4367932a4ba1b474964105bfe9f2d75ff4d8c599c064632911c08e95f3aa77eb7a78361ef216a4d0e711b1eb823

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc51736668409d8a290e89dca0149daa

SHA1
aa8a7bb1cf4340b422c6cc37aacd87316226ba0b

SHA256
e9cc4bb6e548230a10d6132028cf36fc66a25c332dbb37048583474588e17a31

SHA512
9690ebf3df2c53136626ce2c53d88a067186ec37e09d5768b1fb23e0b8e291c08fdfd02347970f905fc3dc4a0c599b6d643f357c08ff41f402bf54874a6cb8fc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1f18399c8def74d6efd1014228213126

SHA1
1b3e3addbef79eb16b8da589a84363a5fd04aad3

SHA256
f0d312fcc38e0e7c1caf1ff5cda9736ea9c52ef292bd632a57a7a3dc33eca72e

SHA512
5177f84761c249ee308d3a5e1e2fe17719e62c694c0bdf9bfbcc0b86832f77fb7acf08baaec3a090d31d950c510b2b283b75dada7f07cbd06309a54260c98a77

Download Submit
C:\Windows\Temp\CabA2B5.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarA2C8.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
\Windows\Installer\MSI23F7.tmp

Filesize
509KB

MD5
88d29734f37bdcffd202eafcdd082f9d

SHA1
823b40d05a1cab06b857ed87451bf683fdd56a5e

SHA256
87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

SHA512
1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

Download Submit
\Windows\Installer\MSI23F7.tmp-\AlphaControlAgentInstallation.dll

Filesize
25KB

MD5
aa1b9c5c685173fad2dabebeb3171f01

SHA1
ed756b1760e563ce888276ff248c734b7dd851fb

SHA256
e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

SHA512
d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

Download Submit
\Windows\Installer\MSI23F7.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
memory/1028-246-0x0000000000020000-0x0000000000048000-memory.dmp

Filesize
160KB

Download
memory/1028-258-0x000000001A5A0000-0x000000001A638000-memory.dmp

Filesize
608KB

Download
memory/1364-1305-0x000000001A3C0000-0x000000001A3F8000-memory.dmp

Filesize
224KB

Download
memory/1364-311-0x0000000019E90000-0x0000000019F42000-memory.dmp

Filesize
712KB

Download
memory/2060-318-0x0000000000430000-0x000000000045E000-memory.dmp

Filesize
184KB

Download
memory/2060-326-0x00000000045B0000-0x0000000004662000-memory.dmp

Filesize
712KB

Download
memory/2060-322-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2256-109-0x00000000049A0000-0x0000000004A52000-memory.dmp

Filesize
712KB

Download
memory/2256-105-0x0000000001DF0000-0x0000000001DFC000-memory.dmp

Filesize
48KB

Download
memory/2256-101-0x0000000001DB0000-0x0000000001DDE000-memory.dmp

Filesize
184KB

Download
memory/2408-1534-0x0000000000A90000-0x0000000000AD2000-memory.dmp

Filesize
264KB

Download
memory/2408-1535-0x0000000000CA0000-0x0000000000D50000-memory.dmp

Filesize
704KB

Download
memory/2408-1536-0x0000000000500000-0x000000000051C000-memory.dmp

Filesize
112KB

Download
memory/3004-76-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/3004-72-0x00000000009E0000-0x0000000000A0E000-memory.dmp

Filesize
184KB

Download