ateraagent | 5a074d3c7736cbc9ccae728e7dca9d14366c3943b686d62f435bba893283c5c8

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/03/2025, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Security_Procedures_Updated.msi
Size

2.9MB
MD5

352a76e3d2029f2210c603e280f2ffdd
SHA1

8b6fe96636bf90e82e92fa7293b9ec03f0c70084
SHA256

3b087726ebf6de197e6c677407d360171cbb975d7fabaab2825aa2a7266767bd
SHA512

2d253ec7480bec43f05210b4c42b4d14538fb812a9b5459adbbd87b79f80d0f5de292c6204facc4219a34cafd58ef7ba213af2b6fbcac8f01623e3a6dc857d8f
SSDEEP

49152:G+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:G+lUlz9FKbsodq0YaH7ZPxMb8tT

Score

10^/10

ateraagent discovery persistence privilege_escalation rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000016df8-460.dat	family_ateraagent

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	2512	msiexec.exe
5	2512	msiexec.exe
7	2512	msiexec.exe
11	2144	rundll32.exe
12	2144	rundll32.exe
18	1772	rundll32.exe
21	1772	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AgentPackageAgentInformation.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	AteraAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Microsoft.ApplicationInsights.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\System.Buffers.dll	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt	AgentPackageAgentInformation.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\System.Diagnostics.DiagnosticSource.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\CredentialManagement.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\System.Memory.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\System.Runtime.CompilerServices.Unsafe.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState	AteraAgent.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIBAC9.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCC5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCC5.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID6DA.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76ba6a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6DA.tmp-\System.Management.dll	rundll32.exe
File created	C:\Windows\Installer\f76ba69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAC9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD4A.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCC5.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICE30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD4A.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCC5.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDFF.tmp	msiexec.exe
File created	C:\Windows\Installer\f76ba6c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76ba6a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAC9.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD4A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD4A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICDFE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6DA.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD4A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCC5.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICE8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6DA.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIBAC9.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD4A.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBAC9.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCC5.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID6DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6DA.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\f76ba69.msi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
332	AteraAgent.exe
2044	AteraAgent.exe
2704	AgentPackageAgentInformation.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1540	sc.exe

Loads dropped DLL 35 IoCs

pid	Process
1480	MsiExec.exe
292	rundll32.exe
292	rundll32.exe
292	rundll32.exe
292	rundll32.exe
292	rundll32.exe
1480	MsiExec.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
1480	MsiExec.exe
1748	rundll32.exe
1748	rundll32.exe
1748	rundll32.exe
1748	rundll32.exe
1748	rundll32.exe
1480	MsiExec.exe
2736	MsiExec.exe
2736	MsiExec.exe
1480	MsiExec.exe
1772	rundll32.exe
1772	rundll32.exe
1772	rundll32.exe
1772	rundll32.exe
1772	rundll32.exe
1772	rundll32.exe
1772	rundll32.exe
1772	rundll32.exe
1772	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2512	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1924	TaskKill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AteraAgent.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "Security_Procedures_Updated.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	AteraAgent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2816	msiexec.exe
2816	msiexec.exe
2044	AteraAgent.exe
2704	AgentPackageAgentInformation.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe
Token: SeSecurityPrivilege	2816	msiexec.exe
Token: SeCreateTokenPrivilege	2512	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2512	msiexec.exe
Token: SeLockMemoryPrivilege	2512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2512	msiexec.exe
Token: SeMachineAccountPrivilege	2512	msiexec.exe
Token: SeTcbPrivilege	2512	msiexec.exe
Token: SeSecurityPrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeLoadDriverPrivilege	2512	msiexec.exe
Token: SeSystemProfilePrivilege	2512	msiexec.exe
Token: SeSystemtimePrivilege	2512	msiexec.exe
Token: SeProfSingleProcessPrivilege	2512	msiexec.exe
Token: SeIncBasePriorityPrivilege	2512	msiexec.exe
Token: SeCreatePagefilePrivilege	2512	msiexec.exe
Token: SeCreatePermanentPrivilege	2512	msiexec.exe
Token: SeBackupPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeShutdownPrivilege	2512	msiexec.exe
Token: SeDebugPrivilege	2512	msiexec.exe
Token: SeAuditPrivilege	2512	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2512	msiexec.exe
Token: SeChangeNotifyPrivilege	2512	msiexec.exe
Token: SeRemoteShutdownPrivilege	2512	msiexec.exe
Token: SeUndockPrivilege	2512	msiexec.exe
Token: SeSyncAgentPrivilege	2512	msiexec.exe
Token: SeEnableDelegationPrivilege	2512	msiexec.exe
Token: SeManageVolumePrivilege	2512	msiexec.exe
Token: SeImpersonatePrivilege	2512	msiexec.exe
Token: SeCreateGlobalPrivilege	2512	msiexec.exe
Token: SeBackupPrivilege	2892	vssvc.exe
Token: SeRestorePrivilege	2892	vssvc.exe
Token: SeAuditPrivilege	2892	vssvc.exe
Token: SeBackupPrivilege	2816	msiexec.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeRestorePrivilege	576	DrvInst.exe
Token: SeRestorePrivilege	576	DrvInst.exe
Token: SeRestorePrivilege	576	DrvInst.exe
Token: SeRestorePrivilege	576	DrvInst.exe
Token: SeRestorePrivilege	576	DrvInst.exe
Token: SeRestorePrivilege	576	DrvInst.exe
Token: SeRestorePrivilege	576	DrvInst.exe
Token: SeLoadDriverPrivilege	576	DrvInst.exe
Token: SeLoadDriverPrivilege	576	DrvInst.exe
Token: SeLoadDriverPrivilege	576	DrvInst.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe
Token: SeDebugPrivilege	2144	rundll32.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe
Token: SeRestorePrivilege	2816	msiexec.exe
Token: SeTakeOwnershipPrivilege	2816	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2512	msiexec.exe
2512	msiexec.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1480	2816	msiexec.exe	34
PID 2816 wrote to memory of 1480	2816	msiexec.exe	34
PID 2816 wrote to memory of 1480	2816	msiexec.exe	34
PID 2816 wrote to memory of 1480	2816	msiexec.exe	34
PID 2816 wrote to memory of 1480	2816	msiexec.exe	34
PID 2816 wrote to memory of 1480	2816	msiexec.exe	34
PID 2816 wrote to memory of 1480	2816	msiexec.exe	34
PID 1480 wrote to memory of 292	1480	MsiExec.exe	35
PID 1480 wrote to memory of 292	1480	MsiExec.exe	35
PID 1480 wrote to memory of 292	1480	MsiExec.exe	35
PID 1480 wrote to memory of 292	1480	MsiExec.exe	35
PID 1480 wrote to memory of 292	1480	MsiExec.exe	35
PID 1480 wrote to memory of 292	1480	MsiExec.exe	35
PID 1480 wrote to memory of 292	1480	MsiExec.exe	35
PID 1480 wrote to memory of 2144	1480	MsiExec.exe	36
PID 1480 wrote to memory of 2144	1480	MsiExec.exe	36
PID 1480 wrote to memory of 2144	1480	MsiExec.exe	36
PID 1480 wrote to memory of 2144	1480	MsiExec.exe	36
PID 1480 wrote to memory of 2144	1480	MsiExec.exe	36
PID 1480 wrote to memory of 2144	1480	MsiExec.exe	36
PID 1480 wrote to memory of 2144	1480	MsiExec.exe	36
PID 1480 wrote to memory of 1748	1480	MsiExec.exe	38
PID 1480 wrote to memory of 1748	1480	MsiExec.exe	38
PID 1480 wrote to memory of 1748	1480	MsiExec.exe	38
PID 1480 wrote to memory of 1748	1480	MsiExec.exe	38
PID 1480 wrote to memory of 1748	1480	MsiExec.exe	38
PID 1480 wrote to memory of 1748	1480	MsiExec.exe	38
PID 1480 wrote to memory of 1748	1480	MsiExec.exe	38
PID 2816 wrote to memory of 2736	2816	msiexec.exe	40
PID 2816 wrote to memory of 2736	2816	msiexec.exe	40
PID 2816 wrote to memory of 2736	2816	msiexec.exe	40
PID 2816 wrote to memory of 2736	2816	msiexec.exe	40
PID 2816 wrote to memory of 2736	2816	msiexec.exe	40
PID 2816 wrote to memory of 2736	2816	msiexec.exe	40
PID 2816 wrote to memory of 2736	2816	msiexec.exe	40
PID 2736 wrote to memory of 2848	2736	MsiExec.exe	41
PID 2736 wrote to memory of 2848	2736	MsiExec.exe	41
PID 2736 wrote to memory of 2848	2736	MsiExec.exe	41
PID 2736 wrote to memory of 2848	2736	MsiExec.exe	41
PID 2848 wrote to memory of 2748	2848	NET.exe	43
PID 2848 wrote to memory of 2748	2848	NET.exe	43
PID 2848 wrote to memory of 2748	2848	NET.exe	43
PID 2848 wrote to memory of 2748	2848	NET.exe	43
PID 2736 wrote to memory of 1924	2736	MsiExec.exe	44
PID 2736 wrote to memory of 1924	2736	MsiExec.exe	44
PID 2736 wrote to memory of 1924	2736	MsiExec.exe	44
PID 2736 wrote to memory of 1924	2736	MsiExec.exe	44
PID 2816 wrote to memory of 332	2816	msiexec.exe	46
PID 2816 wrote to memory of 332	2816	msiexec.exe	46
PID 2816 wrote to memory of 332	2816	msiexec.exe	46
PID 1480 wrote to memory of 1772	1480	MsiExec.exe	48
PID 1480 wrote to memory of 1772	1480	MsiExec.exe	48
PID 1480 wrote to memory of 1772	1480	MsiExec.exe	48
PID 1480 wrote to memory of 1772	1480	MsiExec.exe	48
PID 1480 wrote to memory of 1772	1480	MsiExec.exe	48
PID 1480 wrote to memory of 1772	1480	MsiExec.exe	48
PID 1480 wrote to memory of 1772	1480	MsiExec.exe	48
PID 2044 wrote to memory of 1540	2044	AteraAgent.exe	49
PID 2044 wrote to memory of 1540	2044	AteraAgent.exe	49
PID 2044 wrote to memory of 1540	2044	AteraAgent.exe	49
PID 2044 wrote to memory of 2704	2044	AteraAgent.exe	51
PID 2044 wrote to memory of 2704	2044	AteraAgent.exe	51
PID 2044 wrote to memory of 2704	2044	AteraAgent.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Security_Procedures_Updated.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89C04EC1A81732DEA417E95EBA1754A7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBAC9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259439428 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:292
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBD4A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259439943 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSICCC5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259443921 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID6DA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259446495 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71EA00B11C0A2946860EF59152241549 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\syswow64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
- - C:\Windows\syswow64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1924
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000R4mReIAJ" /AgentId="a8d6e073-7b26-48d7-a7c4-b88c66d5b814"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005AC" "0000000000000390"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:1540
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" a8d6e073-7b26-48d7-a7c4-b88c66d5b814 "1788902e-b1be-442f-a157-28e439f827a2" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000R4mReIAJ
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76ba6b.rbs

Filesize
8KB

MD5
a91bbb780bb36b2ff037d1597b7c9612

SHA1
4c7b5b9b46c4813d3f4699c0b7fc10a48df1df75

SHA256
b4932f7057ccef11836527fd4ae332cf892b9bbd3db2c97edcedc895a6bda7ba

SHA512
8bca72024b13d40272ad8d20fb20136cca4a15d2f12b5cb406eef34683325408dfcbc4bc134955768baf904536e86eeafdf2e04dded8e281749a2a4e745add32

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog

Filesize
753B

MD5
8298451e4dee214334dd2e22b8996bdc

SHA1
bc429029cc6b42c59c417773ea5df8ae54dbb971

SHA256
6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

SHA512
cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe

Filesize
142KB

MD5
477293f80461713d51a98a24023d45e8

SHA1
e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

SHA256
a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

SHA512
23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config

Filesize
1KB

MD5
b3bb71f9bb4de4236c26578a8fae2dcd

SHA1
1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

SHA256
e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

SHA512
fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll

Filesize
210KB

MD5
c106df1b5b43af3b937ace19d92b42f3

SHA1
7670fc4b6369e3fb705200050618acaa5213637f

SHA256
2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

SHA512
616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll

Filesize
693KB

MD5
2c4d25b7fbd1adfd4471052fa482af72

SHA1
fd6cd773d241b581e3c856f9e6cd06cb31a01407

SHA256
2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

SHA512
f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI

Filesize
12B

MD5
cfce02553c4af9a201345d31962187fc

SHA1
16f0da42cf874c9c4a84d434eebd2dcf5031b553

SHA256
ed104ab4d69e5d34ccdebe12d317c4c8cbb7ddfd60b36f0461db0032a11d288f

SHA512
ece94642b88011429e106aa1b4cea75a606a03647e5dace481969946ba9a0d3b23162c9cb81200d12445fd4910ddc30135866c80b645a82df08e7e374c60a4cc

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe

Filesize
248KB

MD5
bf7f46a78bba38717dc1ccd5a48c9aa2

SHA1
30382066798876dc4e689bfcfad098910a213cda

SHA256
0f0425430b83a340883c9c4318cda20e91c8db1febcf0f1b731ae93f2d119020

SHA512
bbae0e9ce97d5db855799960778425bcd652d7e1507089211be8413fd56698845dc00c19bb4adafe6ea3ff3c00b0ad0a9a111bb00f7f57b1d59ea79b236163ab

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config

Filesize
1021B

MD5
51a41966b950af62998eee5043f543b0

SHA1
d4ce80134834a1f10d50a6cac3ca3a3e80ff1dc2

SHA256
f1461b023e02fac832979ebf9bfa59ee7043885c90fc8ee6f8077f07a1cb7097

SHA512
9c4ba08451116f92036ce24075a641eb5973b740bb876cb8ec7229dae10308364404f175b8abd1f0d6eefa73b9123fa857bf2c3b39577d767831444f99435936

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll

Filesize
693KB

MD5
a336fba63cbca9d841cd3188f59be1cb

SHA1
d486c67f142f8683bca8d5f487602bff599403ee

SHA256
e4ccf5985d2f5006d42cfe002b39651ef0c9f1b8db60453d0f682d6d62cac23f

SHA512
9f0c65170a7105bbbafe1ba69bbbc965c41bd009f8d8642542cc54af7520252307f4be9e09c8a7d0ccb6fee42370d80338ac6e83f993b5dc8a6275777e3cafe9

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt

Filesize
23KB

MD5
45c7a9bbe56c0e92b36d5d699bf4ee11

SHA1
4ff3d9cf01a10aca3040ab3d8c5f66699609d22f

SHA256
3d35d98582f6ac8e453902843f26d9f08e4b51335bcbf5744a4994cb8b0a4952

SHA512
ab80a892445c20b68102587060db25bb94eb328ad47b708ab5c70889fcd4d1f9ff7afb5aa9b007b38f324a85c8c1459ac8f6fa1e6ea26c8aaf408958d26294e7

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll

Filesize
588KB

MD5
17d74c03b6bcbcd88b46fcc58fc79a0d

SHA1
bc0316e11c119806907c058d62513eb8ce32288c

SHA256
13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

SHA512
f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

Download Submit
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt

Filesize
220B

MD5
6828fd047a0cbad936bdf3d3ca662434

SHA1
1051a2074d1313c771935b4459709131c14b206d

SHA256
691e05e97ff975671819c5a0801363cab881254c1949c02ecb25e8ed8c08f5eb

SHA512
30ff50e55e77a4c37349acee45d5ff8159ceef2709f84ec89483d358e7ef1ea86280133efd60e254b00ac1625cc354c12508bbcfa3009cd4dbe93942e6d0bbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
80f90a70878ec6b25f869319098b87aa

SHA1
7b372e277999bcda7000978a3c93e4fe8e7f3a02

SHA256
f9dd9e274e4a0ad2f4be925e701ff81ca174dc3db9beca4a263bcc095390fd5b

SHA512
eb40baec63c4beb9c16535fb627b57f588ceddf84183bf15f5bd1c1e1a0b31bfbdf9e6e0750dae26ed2f29de24a97ea9c2d6a7583372f334de3628af4c4b1b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC

Filesize
727B

MD5
e22c500ac9dc5b818b05e60d9263fca5

SHA1
38b34fdbd3a261ea569f0db574d8c5d34c0436d9

SHA256
24bd916bf9f9413d4e527659e56b953fe1a396cdf2c664e0798c3f520ec348ac

SHA512
17e752f4b5ae3f16455f5b6d0238cec9701e77e61e98c365056af9f52a9ebb2cdf9dc1e5c513858fe02af73a1573eb5270125a116b63d29ba768cc131c6135d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
16d40e6fe7dbda24e4c0011e68de557b

SHA1
ad6ee6b3e37a5769230755269ea7eb79c3ff468e

SHA256
b9e9bad95aee50d6e2ff0c7a88fe83dd97ddda6d9bc63324749721b0a0abaa39

SHA512
ebf04e008422ddc6869c9ade3f6c2c9668818d1f644582aed3b744051cf8480f6654929dfe823f378498b4ec942b705af9756c0b27eb25b047c590f5de9aeb11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
15a1af1502decd95821df3c85d18f4fc

SHA1
53de4b0b50af404ec4b312ecdc167c3e6aaa367a

SHA256
aa057a1a9b8864bfe559dedcdca46c49953617a45de24982c99f7391fafb1a16

SHA512
b0cb66d2716d1f26645abf2da3fd345ea3befcc9c1b3e32b4d7dfbc18666e97bcea191b7d79c5ddff8a546edb3f9da41821de81f71e3c18db66fe6a2174cffe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC

Filesize
412B

MD5
2db0e7049d8877330b1d4b042cfc0f07

SHA1
89f7f77b74f4b8d6b3c15a674449fbf03d1b089c

SHA256
806fae8491eec51e1a15f473ab0dc7ab879ef86ed4501363f43dc8f107eec126

SHA512
89977ea214100a3cb28cecaf941334f0ef90613e204c0ac323f8b4c5d40664d73f6cdf630699342482071920d2aedcffdba7b3c6b6b29833735345402e6f10ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe291dcf118b71d4b825601c82ac4ba0

SHA1
c91f71cdae5910080b7df7c9d3eccb1fd031a32e

SHA256
972d889225796f12ad10f6018ea227ca6ddb1e08b990d97da51c95fa7a72cc6b

SHA512
557b8d51154ea3a58aede1ee99cc0bb1a4bd7d9a3aa9eea804a449c515c9bce58c0c47a143c115711e1a1a0a83c47be994f0bbfb8972c31085e7685a5d022999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19249036d7e8e9a4d0c8b4cbdc528ae7

SHA1
8da487218d4bdf9e183ede2703128da8b8723519

SHA256
3e4eb6efdb05f99686dfc09893ebf6aee756b44fa94dad4f45b1acda601d7b37

SHA512
8b5160391da6f9dbe883322a178bd6656b5b2d9a9d38100729afc4a08c3ada5b4926b72ab6c6ce112596f30768742ae5dd158f975f293145538de7a9f85badfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
555fd8ea71284a5f68d6056a25412717

SHA1
8f47a121dbda6db7cdd9f8e0c59014c076aae27c

SHA256
739cf6f34fb4912f87ff8bb4a7c89407db3ffa9c1e08a9da7444e4bc29484366

SHA512
9068804785a84fcefcc8cba6c9f3a7dc511e6bdf96cce12cb697c4b29d34fadb8a623a508faf1b643734f87bcc4e52d4e24dc1a185eb02210e4769ee23272bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA8A.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Windows\Installer\MSIBAC9.tmp

Filesize
509KB

MD5
88d29734f37bdcffd202eafcdd082f9d

SHA1
823b40d05a1cab06b857ed87451bf683fdd56a5e

SHA256
87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

SHA512
1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

Download Submit
C:\Windows\Installer\MSIBD4A.tmp-\CustomAction.config

Filesize
1KB

MD5
bc17e956cde8dd5425f2b2a68ed919f8

SHA1
5e3736331e9e2f6bf851e3355f31006ccd8caa99

SHA256
e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

SHA512
02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

Download Submit
C:\Windows\Installer\MSIBD4A.tmp-\Newtonsoft.Json.dll

Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
C:\Windows\Installer\MSICDFF.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\f76ba69.msi

Filesize
2.9MB

MD5
352a76e3d2029f2210c603e280f2ffdd

SHA1
8b6fe96636bf90e82e92fa7293b9ec03f0c70084

SHA256
3b087726ebf6de197e6c677407d360171cbb975d7fabaab2825aa2a7266767bd

SHA512
2d253ec7480bec43f05210b4c42b4d14538fb812a9b5459adbbd87b79f80d0f5de292c6204facc4219a34cafd58ef7ba213af2b6fbcac8f01623e3a6dc857d8f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad5be6ccdecb8cd943628739aa93e693

SHA1
e461afbf25f9b658ecbb00d4ac580ddb51fc00bf

SHA256
838c65e7dee726a2fd9bea566aba755a4f78111f60d65ce4ff7e5b174b38816d

SHA512
119df0394c180956f01674a26f8782849c69660defe04b181fa2e5db607305909744f76d3a7251f6a2970c966b5c78e49ed5fa9729178d4e124d2e2933df9043

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e48478a160f868217cfb44ca442e6a91

SHA1
a3010bba3c5208f8d654cbaacd572b29528b29ea

SHA256
c5a8c38176abdd2330c3c7bd22ad3ee8b9d07c8e0aaae81602b497ad197dadea

SHA512
9e880b1dce16ee648252bccf2395326e2da6fd15245201182e84a21e280e09d6aa8aabe24ddc92a037b34b87ddacadfc66c90645cc363d7356c51407bcc6ad6e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db361c01a7c333be1446527d21bbe12

SHA1
13780581f94c1c30db4f184b1d579478138099b2

SHA256
c282bfce69785959bc432b45a4cec1838705bba58738f59398945597390ba359

SHA512
3c7b4806f847476cc499e33197db7a7d990eeed82ff16031bc9149ebec74edb0155968983c2ec9d9d30b1a25795acc1fc68b5932c21f5ac0c3952d489aadc7f8

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
214802121477e9145f625b071e6e9151

SHA1
dc5ec16c5795ea1acbde6e00a3ec19498ab2cfe0

SHA256
d2b66c949bf003c3ddaa74a5199e27070d6ff1240120196e7a221294ca07a5d4

SHA512
c8d84a2ab1c7303fec79eb24cd0a318177c87303762043c94fcaa968d09552e073d7d63b736fee6e4954444a9c4104e3bd473f790b5ed1348b21515021bdf2d7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
895a64b24b368d4455de1599efb50b69

SHA1
d7bcfc6aa44a68c6682ef39edf027e4a195fe901

SHA256
b08f8889ff63bc619c35c5ada274bc7e39380c1b8911c9fd9779d1f98012dedf

SHA512
e2b67bf9bf37ea19e44a5b7472257edccf85b8602152540ee36c348ea29b14381b0795af734a3adab2b0de54eefc6b9be2292fe44e35255e58972a74c6829c49

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9163841570f2fdf7a8b3637a72c65868

SHA1
2996950f03313e88bbf87d1a441bdc6ce05fb60a

SHA256
5b34893e6ba9d03cb928dc500ccb52e1e07d68fb6c6f3c6d786a25498d7a75ed

SHA512
ecd5bd06a79ffa83bcbe4b68fb494f48fe7fd9f9d76c3e8b05f3048a3872f6b79339ad79709c6de954c553f9ebdf069dbe59929a1035e3395ece247b4bc24a3d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb887c0f53d116555db1d1f31b185334

SHA1
3f989f53f14d342d8c054f8a41d6de90ebf76f66

SHA256
874086f9a0f3777ff56b6c06a2d2b15dd95293c1ee2eeda4b5d7d92eacfc7ac0

SHA512
168c92f7df77ae27b380aa07031a877b7e08216cfb93e9fbcfaaa1d6ee2265f50ef3c82a2a0d6836cdb31e7dc935533c9612d493b2f3afb3076f14b8cdb2fcea

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79dac46e7b2007ee3acb459dfef118b4

SHA1
4b18ed21d8659a6fead66115dbe0ed33ec05e470

SHA256
da1edd73838076482f31447a903f8fc249da45214f9fa49ba73223eb24de449c

SHA512
fd5fa3c135f3834cd9260437fd8053be0571a0f7c0fac690bfc301d26f4ec1917d695e9c236c492c474da0b5a8a680d376519c61689258fc444638eea546a2c1

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586d8837d6478d27b71df7889679e77f

SHA1
2e8870ff2795317df261b5b1cf35dfb9bff04c1d

SHA256
b6b0a3a18b0922a3000a15395be59c89cea2cc9766dc00ac2c12ad77031d55de

SHA512
5ecca634ebb6ddfbe03cc673d95cb2d3b6bb08902a47e00b3069373d211f1d4d7146a1c4bff11d133ac7819f4bd54e06d67edd94429f592da0f15355977330dd

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab069dd4108019934bc1284a6384164

SHA1
c84e0f2da6bf1034b8b3c91881e5f1fce4c2469a

SHA256
71ec7c16e5a2aa3c20b17108ce99d95ebdfce267b6f60225f00375d9a4d16946

SHA512
c3125133fe6b00ba6cdd3a4434578f36893855fe0df8780bbc8265618a1d134612f4bd1b5edee74c8c255208564b044238b73e712a283b8c509d0dad6bb8b543

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe00007431422a76433dfd7167a60ac8

SHA1
bcbdf0dd1ed4416e3426c2b4bb17d5a55971c935

SHA256
9002e900a6f4438098138ce8d5b9c79df6c9e70d7568fc59bf3bd689c5fbf38d

SHA512
3178bd1c742390fb9fdad7d5d282a759257439dfb6a2126e00f99c13f958966b124519a9513155df5c874fdf2d2671ea4eea74ed1e9651c264c6bdf0b9028d14

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
155c2c4cfd8b05f30359fa613e8a44b3

SHA1
15e65f7de4f5d5a9b3db192a88140af7643cbf7f

SHA256
d58d2851db43394a7593bdad6d39b474bfdd6ec1ef0969fedc6a529e009e474b

SHA512
c8990eee22bdd3bbc16c4306664ac17a512dae6032931ead32cc483949e9e835f9683ab6aff0e3b248d048f993f68f1c3ed60e027ca3b850b272ef622c895b99

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a8c3bf5f1d250e8a7f8d9b64d214410

SHA1
e9afbdc822136cc9933f4e0fb5fff6f20fb53b20

SHA256
879fe0310614c18153cd9b680b11c6883ac659d434f92976e99ad208fbd203c5

SHA512
a887c563c30a797c3cb68863c708b1a245c32335e24073106a7d29012b8f87add3360e3fb6ad8aa7075c2f6de1692770fc71e8e5a126cbe27d54091ec96f9c05

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0b5b15add50a2ad51ef77f1084638b1

SHA1
6ed5f0a05b5afa680bc60715a73c496e3fcca802

SHA256
a177c3d620fd915d2144d335f1e0a592d9bb0a6d4270db7b5a07135c8255c5e9

SHA512
b8282475c0d373ccefc369da3d9b7a79285fde10707070242580845817edf255879c01cc2b74c09acea923c2ebff7d3a798333107bbd9963dfae5e4d57d751b5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9526285fe5152a9a8d451fd5719354cc

SHA1
36f2b55f20dc397320284767c05e8c3c8df52156

SHA256
9804c1bed778680ec40d2d3999520b7a6db1fcf266e3c5f936a2affa0cef393a

SHA512
7d671d832137d6f1513015e701f82eea13b0855679101de6445e681bfbe2767bbecc5bf417d9cca8b36ba4a619f43815de24784f0ac5fd89a0c7a39dab114fe4

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ba876096e2bbc1d1fc891d0da8a04a1e

SHA1
6ba3cceb2595459835ba710c15bb9ab14d63d8d1

SHA256
8cd5f13899ae7922ce582cc324cc2b3e21824413c86c0a225c077e859df869f6

SHA512
3050474d3d6b104be5906f4fa0dd69abe0b8c7a462738d263e0ab920e8d5b19239be581063382eca4e9645db06d953829ba4715a6e7ae55b8d79ea3dd26cf59a

Download Submit
C:\Windows\Temp\CabE35D.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarE36F.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
\Windows\Installer\MSIBAC9.tmp-\AlphaControlAgentInstallation.dll

Filesize
25KB

MD5
aa1b9c5c685173fad2dabebeb3171f01

SHA1
ed756b1760e563ce888276ff248c734b7dd851fb

SHA256
e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

SHA512
d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

Download Submit
\Windows\Installer\MSIBAC9.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
memory/292-75-0x0000000000800000-0x000000000082E000-memory.dmp

Filesize
184KB

Download
memory/292-79-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Filesize
48KB

Download
memory/332-248-0x0000000001F40000-0x0000000001FD8000-memory.dmp

Filesize
608KB

Download
memory/332-236-0x00000000003A0000-0x00000000003C8000-memory.dmp

Filesize
160KB

Download
memory/1772-312-0x00000000006E0000-0x00000000006EC000-memory.dmp

Filesize
48KB

Download
memory/1772-316-0x0000000002340000-0x00000000023F2000-memory.dmp

Filesize
712KB

Download
memory/1772-308-0x0000000000660000-0x000000000068E000-memory.dmp

Filesize
184KB

Download
memory/2044-1168-0x000000001A2E0000-0x000000001A318000-memory.dmp

Filesize
224KB

Download
memory/2044-296-0x000000001A5D0000-0x000000001A682000-memory.dmp

Filesize
712KB

Download
memory/2144-112-0x0000000004C90000-0x0000000004D42000-memory.dmp

Filesize
712KB

Download
memory/2144-108-0x0000000000B30000-0x0000000000B3C000-memory.dmp

Filesize
48KB

Download
memory/2144-104-0x0000000000440000-0x000000000046E000-memory.dmp

Filesize
184KB

Download
memory/2704-1354-0x0000000000F90000-0x0000000000FD2000-memory.dmp

Filesize
264KB

Download
memory/2704-1357-0x0000000019360000-0x0000000019412000-memory.dmp

Filesize
712KB

Download
memory/2704-1358-0x00000000003F0000-0x0000000000410000-memory.dmp

Filesize
128KB

Download