File name:

invite.msi

Full analysis: https://app.any.run/tasks/fdab0ecb-d6a3-4e3b-8311-0ed1efb3d02f
Verdict: Malicious activity
Analysis date: July 23, 2025, 18:11:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
atera
rmm-tool
splashtop
auto-reg
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AteraAgent, Author: Atera networks, Keywords: Installer, Comments: This installer database contains the logic and data required to install AteraAgent., Template: Intel;1033, Revision Number: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}, Create Time/Date: Wed Feb 28 10:52:02 2024, Last Saved Time/Date: Wed Feb 28 10:52:02 2024, Number of Pages: 200, Number of Words: 6, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

8E7DF6C9149CC65749A4C32422EB81BB

SHA1:

C13F3AB9934CD49CAB27CD3236B74C88B23E56F5

SHA256:

ACEB4781B886FF5617CAB3760E228AFBDFC9938625CBC29BE2E926ED0102AE3C

SSDEEP:

98304:IIZTffzvns6eLKLdpRwznfsJb+7J7ERXndiWaKzPtSjXmbABY/lT8vjkZBvrePVv:t3XP9No

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • msiexec.exe (PID: 828)
      • net.exe (PID: 3836)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5556)
      • powershell.exe (PID: 4944)

    • Changes powershell execution policy (Bypass)

      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 7488)

    • ATERA mutex has been found

      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageMonitoring.exe (PID: 2536)

    • Changes the autorun value in the registry

      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6140)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2492)
      • msiexec.exe (PID: 7116)
      • AteraAgent.exe (PID: 3460)
      • AteraAgent.exe (PID: 4676)
      • 8-0-11.exe (PID: 2612)
      • 8-0-11.exe (PID: 6292)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4036)
      • AteraAgent.exe (PID: 3460)
      • AteraAgent.exe (PID: 4676)
      • SRService.exe (PID: 7440)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 2588)
      • rundll32.exe (PID: 4160)
      • rundll32.exe (PID: 2276)
      • rundll32.exe (PID: 1212)
      • AteraAgent.exe (PID: 3460)
      • csc.exe (PID: 7420)
      • SplashtopStreamer.exe (PID: 7648)
      • PreVerCheck.exe (PID: 7708)
      • SetupUtil.exe (PID: 7568)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageTicketing.exe (PID: 7752)
      • csc.exe (PID: 3576)
      • 8-0-11.exe (PID: 2612)
      • 8-0-11.exe (PID: 6292)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7116)

    • Reads security settings of Internet Explorer

      • AteraAgent.exe (PID: 1712)
      • AteraAgent.exe (PID: 3460)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • SplashtopStreamer.exe (PID: 7648)
      • SetupUtil.exe (PID: 7568)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • 8-0-11.exe (PID: 6292)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)

    • ATERAAGENT has been detected

      • AteraAgent.exe (PID: 3460)
      • AteraAgent.exe (PID: 1712)
      • AteraAgent.exe (PID: 4676)

    • Reads the date of Windows installation

      • AteraAgent.exe (PID: 3460)
      • AteraAgent.exe (PID: 4676)

    • Uses TASKKILL.EXE to kill process

      • msiexec.exe (PID: 828)
      • cmd.exe (PID: 7356)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 4708)
      • cmd.exe (PID: 7460)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 8044)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 7236)
      • cmd.exe (PID: 5992)

    • Potential Corporate Privacy Violation

      • rundll32.exe (PID: 2276)
      • rundll32.exe (PID: 1212)
      • AteraAgent.exe (PID: 3460)
      • AgentPackageAgentInformation.exe (PID: 5352)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageMonitoring.exe (PID: 7228)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageADRemote.exe (PID: 5968)
      • AgentPackageTicketing.exe (PID: 7752)
      • AgentPackageSTRemote.exe (PID: 6736)
      • AgentPackageMonitoring.exe (PID: 2536)

    • Starts SC.EXE for service management

      • AteraAgent.exe (PID: 3460)
      • AteraAgent.exe (PID: 4676)

    • Restarts service on failure

      • sc.exe (PID: 3112)
      • sc.exe (PID: 5476)

    • Starts POWERSHELL.EXE for commands execution

      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 7488)

    • The process bypasses the loading of PowerShell profile settings

      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 7488)

    • The process hides Powershell's copyright startup banner

      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 7488)

    • The process executes Powershell scripts

      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 7488)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7420)
      • csc.exe (PID: 3576)

    • Starts CMD.EXE for commands execution

      • AgentPackageAgentInformation.exe (PID: 5532)
      • msiexec.exe (PID: 7780)
      • SetupUtil.exe (PID: 7568)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageAgentInformation.exe (PID: 7488)

    • The process executes VB scripts

      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 2312)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Gets a collection of all available drive names (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Gets the drive type (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 7576)
      • cscript.exe (PID: 4084)

    • Searches for installed software

      • AgentPackageAgentInformation.exe (PID: 5532)
      • 8-0-11.exe (PID: 6292)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6140)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6900)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 7116)
      • AteraAgent.exe (PID: 4676)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7116)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 7780)
      • SRService.exe (PID: 7496)

    • Starts a Microsoft application from unusual location

      • 8-0-11.exe (PID: 6292)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)

    • Starts itself from another location

      • 8-0-11.exe (PID: 6292)

    • Creates a software uninstall entry

      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6140)

    • Application launched itself

      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6900)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 4460)

  • INFO

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2492)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2492)

    • Checks proxy server information

      • msiexec.exe (PID: 2492)
      • rundll32.exe (PID: 2276)
      • rundll32.exe (PID: 1212)
      • slui.exe (PID: 8168)

    • Reads the software policy settings

      • msiexec.exe (PID: 2492)
      • msiexec.exe (PID: 7116)
      • rundll32.exe (PID: 2276)
      • AteraAgent.exe (PID: 1712)
      • rundll32.exe (PID: 1212)
      • AteraAgent.exe (PID: 3460)
      • AgentPackageAgentInformation.exe (PID: 5352)
      • AgentPackageAgentInformation.exe (PID: 2032)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageSTRemote.exe (PID: 6820)
      • AgentPackageMonitoring.exe (PID: 7228)
      • cscript.exe (PID: 7576)
      • msiexec.exe (PID: 7780)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • SRManager.exe (PID: 3908)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageHeartbeat.exe (PID: 7304)
      • AgentPackageMarketplace.exe (PID: 3932)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageADRemote.exe (PID: 5968)
      • AgentPackageUpgradeAgent.exe (PID: 8076)
      • AgentPackageTicketing.exe (PID: 7752)
      • cscript.exe (PID: 4084)
      • AgentPackageMonitoring.exe (PID: 2536)
      • AgentPackageSTRemote.exe (PID: 6736)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • AgentPackageHeartbeat.exe (PID: 2632)
      • slui.exe (PID: 8168)

    • Checks supported languages

      • msiexec.exe (PID: 7116)
      • msiexec.exe (PID: 6488)
      • msiexec.exe (PID: 828)
      • AteraAgent.exe (PID: 1712)
      • AteraAgent.exe (PID: 3460)
      • AgentPackageAgentInformation.exe (PID: 5352)
      • AgentPackageAgentInformation.exe (PID: 2032)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 5968)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageSTRemote.exe (PID: 6820)
      • AgentPackageMonitoring.exe (PID: 7228)
      • csc.exe (PID: 7420)
      • cvtres.exe (PID: 7440)
      • SplashtopStreamer.exe (PID: 7648)
      • PreVerCheck.exe (PID: 7708)
      • msiexec.exe (PID: 7780)
      • _is7054.exe (PID: 8020)
      • _is7054.exe (PID: 8056)
      • _is7054.exe (PID: 8176)
      • _is7054.exe (PID: 8096)
      • _is7054.exe (PID: 8136)
      • _is7054.exe (PID: 6228)
      • _is7054.exe (PID: 4680)
      • _is7054.exe (PID: 7336)
      • _is7054.exe (PID: 4216)
      • _is7054.exe (PID: 7276)
      • _is79BB.exe (PID: 7396)
      • _is79BB.exe (PID: 5372)
      • _is79BB.exe (PID: 6980)
      • _is79BB.exe (PID: 6352)
      • _is79BB.exe (PID: 7620)
      • _is79BB.exe (PID: 7532)
      • _is79BB.exe (PID: 8072)
      • _is79BB.exe (PID: 8092)
      • _is79BB.exe (PID: 8096)
      • _is8F96.exe (PID: 7300)
      • _is8F96.exe (PID: 7284)
      • _is79BB.exe (PID: 8012)
      • _is8F96.exe (PID: 7292)
      • _is8F96.exe (PID: 7252)
      • _is8F96.exe (PID: 7420)
      • _is8F96.exe (PID: 4520)
      • _is8F96.exe (PID: 7248)
      • _is8F96.exe (PID: 4320)
      • _is8F96.exe (PID: 7536)
      • _is8F96.exe (PID: 7472)
      • SetupUtil.exe (PID: 7612)
      • SetupUtil.exe (PID: 7676)
      • SetupUtil.exe (PID: 7568)
      • SRSelfSignCertUtil.exe (PID: 7520)
      • _isA0ED.exe (PID: 7400)
      • _isA0ED.exe (PID: 7344)
      • _isA0ED.exe (PID: 7260)
      • _isA0ED.exe (PID: 7468)
      • _isA0ED.exe (PID: 2972)
      • _isA0ED.exe (PID: 5252)
      • _isA0ED.exe (PID: 4216)
      • _isA0ED.exe (PID: 7456)
      • _isA0ED.exe (PID: 4684)
      • SRService.exe (PID: 7496)
      • _isA459.exe (PID: 8052)
      • _isA459.exe (PID: 8080)
      • _isA459.exe (PID: 6412)
      • _isA459.exe (PID: 7812)
      • _isA0ED.exe (PID: 7220)
      • _isA459.exe (PID: 5928)
      • _isA459.exe (PID: 7504)
      • _isA459.exe (PID: 3800)
      • _isA459.exe (PID: 6332)
      • _isA459.exe (PID: 7008)
      • SRService.exe (PID: 7256)
      • _isA459.exe (PID: 2628)
      • SRService.exe (PID: 7440)
      • SRServer.exe (PID: 7876)
      • SRManager.exe (PID: 3908)
      • SRAgent.exe (PID: 5400)
      • SRAppPB.exe (PID: 7404)
      • SRFeature.exe (PID: 8072)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • AgentPackageHeartbeat.exe (PID: 7304)
      • SRUtility.exe (PID: 4012)
      • BdEpSDK.exe (PID: 536)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageMarketplace.exe (PID: 3932)
      • AgentPackageTicketing.exe (PID: 7752)
      • AgentPackageSystemTools.exe (PID: 7272)
      • AgentPackageMonitoring.exe (PID: 2536)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageUpgradeAgent.exe (PID: 8076)
      • AgentPackageADRemote.exe (PID: 5968)
      • Agent.Package.Watchdog.exe (PID: 7204)
      • AgentPackageOsUpdates.exe (PID: 2848)
      • Agent.Package.Software.exe (PID: 2232)
      • Agent.Package.Availability.exe (PID: 7184)
      • csc.exe (PID: 3576)
      • cvtres.exe (PID: 7372)
      • 8-0-11.exe (PID: 6292)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • 8-0-11.exe (PID: 2612)
      • msiexec.exe (PID: 7896)
      • AgentPackageSTRemote.exe (PID: 6736)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6900)
      • SRUtility.exe (PID: 6304)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6140)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 4460)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)
      • SRVirtualDisplay.exe (PID: 7724)
      • msiexec.exe (PID: 7272)
      • msiexec.exe (PID: 5712)
      • msiexec.exe (PID: 6220)
      • msiexec.exe (PID: 7264)
      • dotnet.exe (PID: 1944)
      • msiexec.exe (PID: 3460)
      • wifiNetwork.ext.exe (PID: 856)
      • osqueryi.exe (PID: 3736)
      • lockscreen.ext.exe (PID: 6820)
      • dotnet.exe (PID: 2992)
      • AgentPackageHeartbeat.exe (PID: 2632)

    • Reads the computer name

      • msiexec.exe (PID: 7116)
      • msiexec.exe (PID: 6488)
      • msiexec.exe (PID: 828)
      • AteraAgent.exe (PID: 1712)
      • AteraAgent.exe (PID: 3460)
      • AgentPackageAgentInformation.exe (PID: 2032)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 5968)
      • AgentPackageAgentInformation.exe (PID: 5352)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageSTRemote.exe (PID: 6820)
      • AgentPackageMonitoring.exe (PID: 7228)
      • SplashtopStreamer.exe (PID: 7648)
      • msiexec.exe (PID: 7780)
      • _is7054.exe (PID: 8176)
      • _is7054.exe (PID: 8020)
      • _is7054.exe (PID: 8056)
      • _is7054.exe (PID: 8136)
      • _is7054.exe (PID: 8096)
      • _is7054.exe (PID: 7336)
      • _is7054.exe (PID: 7276)
      • _is7054.exe (PID: 4216)
      • _is7054.exe (PID: 6228)
      • _is7054.exe (PID: 4680)
      • _is79BB.exe (PID: 7396)
      • _is79BB.exe (PID: 7620)
      • _is79BB.exe (PID: 5372)
      • _is79BB.exe (PID: 6980)
      • _is79BB.exe (PID: 6352)
      • _is79BB.exe (PID: 8012)
      • _is79BB.exe (PID: 7532)
      • _is79BB.exe (PID: 8072)
      • _is8F96.exe (PID: 7300)
      • _is79BB.exe (PID: 8092)
      • _is79BB.exe (PID: 8096)
      • _is8F96.exe (PID: 7292)
      • _is8F96.exe (PID: 7284)
      • _is8F96.exe (PID: 7252)
      • _is8F96.exe (PID: 7420)
      • _is8F96.exe (PID: 4320)
      • _is8F96.exe (PID: 7248)
      • _is8F96.exe (PID: 4520)
      • _is8F96.exe (PID: 7536)
      • _is8F96.exe (PID: 7472)
      • SetupUtil.exe (PID: 7568)
      • SRSelfSignCertUtil.exe (PID: 7520)
      • _isA0ED.exe (PID: 7400)
      • _isA0ED.exe (PID: 7344)
      • _isA0ED.exe (PID: 7456)
      • _isA0ED.exe (PID: 7260)
      • _isA0ED.exe (PID: 7468)
      • _isA0ED.exe (PID: 2972)
      • _isA0ED.exe (PID: 4216)
      • _isA0ED.exe (PID: 5252)
      • _isA0ED.exe (PID: 7220)
      • SRService.exe (PID: 7496)
      • _isA459.exe (PID: 8052)
      • _isA459.exe (PID: 6412)
      • _isA459.exe (PID: 8080)
      • _isA0ED.exe (PID: 4684)
      • _isA459.exe (PID: 5928)
      • _isA459.exe (PID: 6332)
      • _isA459.exe (PID: 3800)
      • SRService.exe (PID: 7256)
      • _isA459.exe (PID: 7812)
      • _isA459.exe (PID: 2628)
      • _isA459.exe (PID: 7504)
      • _isA459.exe (PID: 7008)
      • SRManager.exe (PID: 3908)
      • SRServer.exe (PID: 7876)
      • SRService.exe (PID: 7440)
      • SRAgent.exe (PID: 5400)
      • SRAppPB.exe (PID: 7404)
      • SRFeature.exe (PID: 8072)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • AgentPackageHeartbeat.exe (PID: 7304)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageMarketplace.exe (PID: 3932)
      • AgentPackageMonitoring.exe (PID: 2536)
      • AgentPackageTicketing.exe (PID: 7752)
      • AgentPackageADRemote.exe (PID: 5968)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageSystemTools.exe (PID: 7272)
      • Agent.Package.Availability.exe (PID: 7184)
      • AgentPackageOsUpdates.exe (PID: 2848)
      • AgentPackageUpgradeAgent.exe (PID: 8076)
      • Agent.Package.Watchdog.exe (PID: 7204)
      • Agent.Package.Software.exe (PID: 2232)
      • 8-0-11.exe (PID: 2612)
      • 8-0-11.exe (PID: 6292)
      • AgentPackageSTRemote.exe (PID: 6736)
      • msiexec.exe (PID: 7896)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6140)
      • msiexec.exe (PID: 7272)
      • msiexec.exe (PID: 6220)
      • SRVirtualDisplay.exe (PID: 7724)
      • msiexec.exe (PID: 5712)
      • msiexec.exe (PID: 7264)
      • msiexec.exe (PID: 3460)
      • lockscreen.ext.exe (PID: 6820)
      • wifiNetwork.ext.exe (PID: 856)
      • AgentPackageHeartbeat.exe (PID: 2632)
      • osqueryi.exe (PID: 3736)

    • Manages system restore points

      • SrTasks.exe (PID: 4124)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7116)
      • AteraAgent.exe (PID: 1712)
      • AteraAgent.exe (PID: 3460)
      • AgentPackageAgentInformation.exe (PID: 5352)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 5968)
      • AgentPackageAgentInformation.exe (PID: 2032)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageSTRemote.exe (PID: 6820)
      • AgentPackageMonitoring.exe (PID: 7228)
      • csc.exe (PID: 7420)
      • msiexec.exe (PID: 7780)
      • SRSelfSignCertUtil.exe (PID: 7520)
      • SRManager.exe (PID: 3908)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageMarketplace.exe (PID: 3932)
      • AgentPackageHeartbeat.exe (PID: 7304)
      • AgentPackageSystemTools.exe (PID: 7272)
      • AgentPackageMonitoring.exe (PID: 2536)
      • AgentPackageTicketing.exe (PID: 7752)
      • AgentPackageADRemote.exe (PID: 5968)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageUpgradeAgent.exe (PID: 8076)
      • AgentPackageOsUpdates.exe (PID: 2848)
      • csc.exe (PID: 3576)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • AgentPackageSTRemote.exe (PID: 6736)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6140)
      • AgentPackageHeartbeat.exe (PID: 2632)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7116)
      • msiexec.exe (PID: 7780)

    • The sample compiled with english language support

      • rundll32.exe (PID: 2276)
      • rundll32.exe (PID: 2588)
      • rundll32.exe (PID: 4160)
      • rundll32.exe (PID: 1212)
      • AteraAgent.exe (PID: 3460)
      • SplashtopStreamer.exe (PID: 7648)
      • PreVerCheck.exe (PID: 7708)
      • msiexec.exe (PID: 7116)
      • msiexec.exe (PID: 7780)
      • SetupUtil.exe (PID: 7568)
      • AteraAgent.exe (PID: 4676)
      • 8-0-11.exe (PID: 2612)
      • 8-0-11.exe (PID: 6292)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)

    • Create files in a temporary directory

      • rundll32.exe (PID: 2588)
      • rundll32.exe (PID: 4160)
      • rundll32.exe (PID: 2276)
      • rundll32.exe (PID: 1212)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)

    • Disables trace logs

      • rundll32.exe (PID: 2276)
      • AteraAgent.exe (PID: 3460)
      • rundll32.exe (PID: 1212)
      • AgentPackageAgentInformation.exe (PID: 2032)
      • AgentPackageAgentInformation.exe (PID: 5352)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageSTRemote.exe (PID: 6820)
      • AgentPackageMonitoring.exe (PID: 7228)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageHeartbeat.exe (PID: 7304)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageMarketplace.exe (PID: 3932)
      • AgentPackageADRemote.exe (PID: 5968)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageUpgradeAgent.exe (PID: 8076)
      • AgentPackageTicketing.exe (PID: 7752)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • AgentPackageMonitoring.exe (PID: 2536)
      • AgentPackageSTRemote.exe (PID: 6736)
      • AgentPackageHeartbeat.exe (PID: 2632)

    • Reads Environment values

      • AteraAgent.exe (PID: 1712)
      • AteraAgent.exe (PID: 3460)
      • AgentPackageAgentInformation.exe (PID: 2032)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • AgentPackageAgentInformation.exe (PID: 5968)
      • AgentPackageAgentInformation.exe (PID: 5352)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageSTRemote.exe (PID: 6820)
      • AgentPackageMonitoring.exe (PID: 7228)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • AgentPackageHeartbeat.exe (PID: 7304)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageMarketplace.exe (PID: 3932)
      • AgentPackageMonitoring.exe (PID: 2536)
      • AgentPackageTicketing.exe (PID: 7752)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageSystemTools.exe (PID: 7272)
      • AgentPackageADRemote.exe (PID: 5968)
      • AgentPackageUpgradeAgent.exe (PID: 8076)
      • AgentPackageOsUpdates.exe (PID: 2848)
      • SRManager.exe (PID: 3908)
      • AgentPackageSTRemote.exe (PID: 6736)
      • AgentPackageHeartbeat.exe (PID: 2632)

    • Creates files in the program directory

      • AteraAgent.exe (PID: 1712)
      • AteraAgent.exe (PID: 3460)
      • AgentPackageSTRemote.exe (PID: 6820)
      • AgentPackageMonitoring.exe (PID: 7228)
      • AgentPackageAgentInformation.exe (PID: 5532)
      • SetupUtil.exe (PID: 7568)
      • SRSelfSignCertUtil.exe (PID: 7520)
      • SRService.exe (PID: 7496)
      • SRManager.exe (PID: 3908)
      • SRAgent.exe (PID: 5400)
      • AteraAgent.exe (PID: 4676)
      • AgentPackageInternalPoller.exe (PID: 7560)
      • AgentPackageSystemTools.exe (PID: 7272)
      • AgentPackageMonitoring.exe (PID: 2536)
      • AgentPackageRuntimeInstaller.exe (PID: 5600)
      • AgentPackageTicketing.exe (PID: 7752)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • SRVirtualDisplay.exe (PID: 7724)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7116)

    • SPLASHTOP has been detected

      • AgentPackageSTRemote.exe (PID: 6820)
      • msiexec.exe (PID: 7116)
      • msiexec.exe (PID: 7780)
      • SetupUtil.exe (PID: 7612)
      • SetupUtil.exe (PID: 7612)
      • SetupUtil.exe (PID: 7676)
      • SetupUtil.exe (PID: 7676)
      • msiexec.exe (PID: 7780)
      • conhost.exe (PID: 8080)
      • SetupUtil.exe (PID: 7568)
      • cmd.exe (PID: 7668)
      • conhost.exe (PID: 3940)
      • cmd.exe (PID: 8040)
      • SRSelfSignCertUtil.exe (PID: 7520)
      • conhost.exe (PID: 7472)
      • SRService.exe (PID: 7496)
      • SRService.exe (PID: 7256)
      • conhost.exe (PID: 6504)
      • SRService.exe (PID: 7440)
      • SRManager.exe (PID: 3908)
      • PreVerCheck.exe (PID: 7708)
      • SRManager.exe (PID: 3908)
      • SRServer.exe (PID: 7876)
      • SRService.exe (PID: 7440)
      • SRAgent.exe (PID: 5400)
      • SRAppPB.exe (PID: 7404)
      • SRAppPB.exe (PID: 7404)
      • SRFeature.exe (PID: 8072)
      • SRFeature.exe (PID: 8072)
      • SRServer.exe (PID: 7876)
      • SRAgent.exe (PID: 5400)
      • conhost.exe (PID: 8080)
      • SRUtility.exe (PID: 4012)
      • AgentPackageSTRemote.exe (PID: 6820)
      • SRUtility.exe (PID: 4012)
      • BdEpSDK.exe (PID: 536)
      • conhost.exe (PID: 620)
      • AgentPackageAgentInformation.exe (PID: 7488)
      • SRUtility.exe (PID: 6304)
      • conhost.exe (PID: 1976)
      • SRUtility.exe (PID: 6304)
      • AgentPackageSTRemote.exe (PID: 6736)
      • AgentPackageSTRemote.exe (PID: 6736)
      • SRVirtualDisplay.exe (PID: 7724)
      • SRVirtualDisplay.exe (PID: 7724)
      • conhost.exe (PID: 3460)
      • lockscreen.ext.exe (PID: 6820)
      • wifiNetwork.ext.exe (PID: 856)
      • osqueryi.exe (PID: 3736)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5556)
      • powershell.exe (PID: 4944)

    • The sample compiled with chinese language support

      • msiexec.exe (PID: 7116)

    • Reads product name

      • SRManager.exe (PID: 3908)

    • Launching a file from a Registry key

      • dotnet-runtime-8.0.11-win-x64.exe (PID: 8020)
      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6140)

    • Manual execution by a user

      • dotnet-runtime-8.0.11-win-x64.exe (PID: 6900)

    • Process checks computer location settings

      • dotnet-runtime-8.0.11-win-x64.exe (PID: 7388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: AteraAgent
Author: Atera networks
Keywords: Installer
Comments: This installer database contains the logic and data required to install AteraAgent.
Template: Intel;1033
RevisionNumber: {721AD955-79FD-4019-BBF5-9DCC4C1175BB}
CreateDate: 2024:02:28 10:52:02
ModifyDate: 2024:02:28 10:52:02
Pages: 200
Words: 6
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
364
Monitored processes
218
Malicious processes
16
Suspicious processes
10

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe msiexec.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs THREAT ateraagent.exe THREAT ateraagent.exe rundll32.exe sc.exe no specs conhost.exe no specs agentpackageagentinformation.exe conhost.exe no specs agentpackageagentinformation.exe conhost.exe no specs agentpackageagentinformation.exe conhost.exe no specs agentpackageagentinformation.exe no specs conhost.exe no specs THREAT ateraagent.exe sc.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs agentpackagestremote.exe conhost.exe no specs agentpackagemonitoring.exe conhost.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe splashtopstreamer.exe prevercheck.exe msiexec.exe no specs msiexec.exe _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs _is7054.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is79bb.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs _is8f96.exe no specs setuputil.exe no specs setuputil.exe no specs setuputil.exe cmd.exe no specs conhost.exe no specs slui.exe cmd.exe no specs conhost.exe no specs srselfsigncertutil.exe _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs _isa0ed.exe no specs srservice.exe no specs conhost.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs _isa459.exe no specs srservice.exe no specs conhost.exe no specs srservice.exe no specs srmanager.exe srserver.exe agentpackageagentinformation.exe conhost.exe no specs sragent.exe no specs srapppb.exe no specs srfeature.exe srutility.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs agentpackageheartbeat.exe conhost.exe no specs THREAT agentpackageinternalpoller.exe conhost.exe no specs bdepsdk.exe no specs conhost.exe no specs agentpackagemarketplace.exe conhost.exe no specs THREAT agentpackagemonitoring.exe conhost.exe no specs agentpackageticketing.exe conhost.exe no specs agentpackagesystemtools.exe no specs conhost.exe no specs agentpackageadremote.exe conhost.exe no specs agentpackageruntimeinstaller.exe conhost.exe no specs agentpackageupgradeagent.exe conhost.exe no specs agent.package.availability.exe agent.package.watchdog.exe conhost.exe no specs conhost.exe no specs agentpackageosupdates.exe no specs conhost.exe no specs agent.package.software.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs 8-0-11.exe 8-0-11.exe dotnet-runtime-8.0.11-win-x64.exe msiexec.exe no specs agentpackagestremote.exe conhost.exe no specs srutility.exe no specs conhost.exe no specs dotnet-runtime-8.0.11-win-x64.exe no specs dotnet-runtime-8.0.11-win-x64.exe no specs dotnet-runtime-8.0.11-win-x64.exe dotnet-runtime-8.0.11-win-x64.exe msiexec.exe no specs msiexec.exe no specs srvirtualdisplay.exe no specs msiexec.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs msiexec.exe no specs dotnet.exe no specs conhost.exe no specs osqueryi.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs lockscreen.ext.exe no specs wifinetwork.ext.exe no specs dotnet.exe no specs conhost.exe no specs agentpackageheartbeat.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -vC:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe—SRAgent.exe
User:
SYSTEM
Company:
Splashtop Inc.
Integrity Level:
SYSTEM
Description:
SplashtopR Streamer BdEpSDK
Exit code:
4294967294
Version:
1.0.0.8
Modules
Images
c:\program files (x86)\splashtop\splashtop remote\server\bdepsdk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—BdEpSDK.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
828C:\Windows\syswow64\MsiExec.exe -Embedding 28078809A429B34D815AEAEDFC24BC6B E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
856"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\extensions\wifiNetwork.ext.exe" --socket "\\.\pipe\shell.em" --timeout 3 --interval 3 C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\extensions\wifiNetwork.ext.exe—osqueryi.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Splashtop® Streamer
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\splashtop\splashtop remote\server\extensions\wifinetwork.ext.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
1100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AgentPackageAgentInformation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1212rundll32.exe "C:\WINDOWS\Installer\MSI1A4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1645156 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEndC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1480\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1644C:\WINDOWS\system32\net1 STOP AteraAgentC:\Windows\SysWOW64\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1712"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="mecherd@comcast.net" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000V0uLJIAZ" /AgentId="59a41b90-871a-4584-a74e-8277ee47f4e6"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
msiexec.exe
User:
admin
Company:
ATERA Networks Ltd.
Integrity Level:
MEDIUM
Description:
AteraAgent
Exit code:
0
Version:
1.8.7.2
Modules
Images
c:\program files (x86)\atera networks\ateraagent\ateraagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1944"C:\Program Files\dotnet\dotnet" --list-runtimesC:\Program Files\dotnet\dotnet.exe—AgentPackageRuntimeInstaller.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
.NET Host
Exit code:
0
Version:
8,0,1124,51707 @Commit: 9cb3b725e3ad2b57ddc9fb2dd48d2d17056
Modules
Images
c:\program files\dotnet\dotnet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\dotnet\host\fxr\8.0.11\hostfxr.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
97 549
Read events
95 712
Write events
1 717
Delete events
120

Modification events

(PID) Process:(7116) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000004F90D31FDFBDB01CC1B000030080000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CDA21E31FDFBDB01C40F00004C090000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CDA21E31FDFBDB01C40F00005C1B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000CDA21E31FDFBDB01C40F00005C110000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4036) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000F7052131FDFBDB01C40F0000FC160000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7116) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000F6B00730FDFBDB01CC1B000030080000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7116) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000F6B00730FDFBDB01CC1B000030080000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7116) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000084762B30FDFBDB01CC1B000030080000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7116) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000084762B30FDFBDB01CC1B000030080000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7116) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000084762B30FDFBDB01CC1B000030080000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
873
Suspicious files
199
Text files
240
Unknown types
98

Dropped files

PID
Process
Filename
Type
7116msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2492msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:C1478631EA3CBE8A63BBD2871D3401F8
SHA256:7B2F4FDF948A4925EBC14FDC11DE7224861DA0320F91AF0591F0330768B6BD40
2492msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:B2EAE2317CD7BA66BE26131ADB7C33D7
SHA256:DCBEF6EE3E34A19B3F1B3E20010E6D6A984014CE82B4FFED83920AA43C14275D
7116msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{aa252e01-0dc7-4261-8e3d-0395f6f6170d}_OnDiskSnapshotPropbinary
MD5:F75E776CFEE44299DF1764133B84FF6F
SHA256:FE823E97F470EE4F190ECC822193FE15A219B3B269F104170B80A2EDF4DF7136
4160rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI565.tmp-\CustomAction.configxml
MD5:BC17E956CDE8DD5425F2B2A68ED919F8
SHA256:E4FF538599C2D8E898D7F90CCF74081192D5AFA8040E6B6C180F3AA0F46AD2C5
7116msiexec.exeC:\Windows\Installer\190313.msiexecutable
MD5:8E7DF6C9149CC65749A4C32422EB81BB
SHA256:ACEB4781B886FF5617CAB3760E228AFBDFC9938625CBC29BE2E926ED0102AE3C
2492msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FCder
MD5:FDEDED4D8C48844F5BFD24C08800D287
SHA256:38568EB07C0EABC02538D5EF4B69658E8F98AAE77E92F123B20C4D8813C15CF5
2492msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FCbinary
MD5:F26E0854FA253B4BFE8737C646D0E44E
SHA256:CEDD003E97CE694FE8BE6A758B6EE767E4EF84EEE617180AA871F07D3A6BE90D
2492msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141der
MD5:6C480D681261FCBCBB0C397430A3998C
SHA256:68ADECE02DA1DFB4B3ABF7200A04855A5253027361B606D268F71C79A2EBE646
4160rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI565.tmp-\AlphaControlAgentInstallation.dllexecutable
MD5:AA1B9C5C685173FAD2DABEBEB3171F01
SHA256:E44A6582CD3F84F4255D3C230E0A2C284E0CFFA0CA5E62E4D749E089555494C7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
88
DNS requests
41
Threats
49

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2492
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAnTy%2FhDMohv9omwS69%2Fdow%3D
unknown
—
—
whitelisted
2492
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
2492
msiexec.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
4912
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1712
AteraAgent.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
1712
AteraAgent.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
1712
AteraAgent.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAooSZl45YmN9AojjrilUug%3D
unknown
—
—
whitelisted
2716
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2168
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2492
msiexec.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4912
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4912
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.2
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.74
  • 20.190.160.14
  • 20.190.160.130
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.11
  • 23.216.77.15
  • 23.216.77.22
  • 23.216.77.21
  • 23.216.77.13
  • 23.216.77.19
  • 23.216.77.10
  • 23.216.77.20
  • 23.55.110.193
  • 23.55.110.211
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
agent-api.atera.com
  • 40.119.152.241
whitelisted
ps.pndsn.com
  • 35.157.63.227
  • 35.157.63.229
unknown
ps.atera.com
  • 13.35.58.7
  • 13.35.58.124
  • 13.35.58.59
  • 13.35.58.104
whitelisted

Threats

PID
Process
Class
Message
2276
rundll32.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
1212
rundll32.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
1212
rundll32.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
3460
AteraAgent.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
3460
AteraAgent.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
5352
AgentPackageAgentInformation.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
3460
AteraAgent.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
3460
AteraAgent.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
3460
AteraAgent.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
3460
AteraAgent.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Possible Atera Remote Access Software Domain observed in TLS SNI (agent-api .atera .com)
Process
Message
AgentPackageMonitoring.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x64\SQLite.Interop.dll"...
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUtility::OSInfo] OS 10.0(19045) x64:1 (Last=0)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::FindHeader] Name:C:\WINDOWS\TEMP\SplashtopStreamer.exe (Last=0)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::FindHeader] Sign Size:10376 (Last=0)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::FindHeader] Header offset:434176 (Last=183)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::UnPackFiles] FreeSpace:232982425600 FileSize:63187968 (Last=0)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::UnPackFiles] (1/5)UnPack file name:C:\WINDOWS\TEMP\unpack\setup.msi (63187968) (Last=0)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::UnPackFiles] UnPack count:1 len:63187968 File:(null) (Last=0)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::UnPackFiles] FreeSpace:232919207936 FileSize:15 (Last=183)
SplashtopStreamer.exe
[7648]2025-07-23 18:11:59 [CUnPack::UnPackFiles] (2/5)UnPack file name:C:\WINDOWS\TEMP\unpack\run.bat (15) (Last=122)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
invite.msi