Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
600s - max time network
479s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Adobe Plugin Update.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
600 seconds
Behavioral task
behavioral2
Sample
Adobe Plugin Update.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
600 seconds
General
- Target Adobe Plugin Update.exe
- Size 76.4MB
- Sample260804-yncvbsga83
- SHA256 7422d3c1c4c458f4c7fd44e9ff2c4f7969711f250772ccd6bc36d156a29ed46c
- MD5 20953c981a64a48c3781cfcd4ec1c500
- SHA1 b8de4d9b1141e02c4b23378440856cf09fc3313d
- SHA512 44e7f61934b5e515edf8bddc396e8455c1a2b22b13e82be42e8d4ae2182a31728be7fbb51a8875053751c95f6b066c92751f10c4b400b6e7bfab731d1f082cee
- SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpp:9iLVelepClAy6uw3W0BEROh2nvvj
- TLSH T1B208011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3848 FWAInstallMonitor.exe - Loads dropped DLL 6 IoCs
pid Process 1064 MsiExec.exe 1064 MsiExec.exe 1064 MsiExec.exe 1064 MsiExec.exe 1064 MsiExec.exe 1064 MsiExec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe Plugin Update.exe\" -r" Adobe Plugin Update.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe Plugin Update.exe\" -r" Adobe Plugin Update.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\J: Msiexec.exe File opened (read-only) \??\K: Msiexec.exe File opened (read-only) \??\T: Msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: Msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: Msiexec.exe File opened (read-only) \??\J: Msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: Msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\I: Msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: Msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: Msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\T: Msiexec.exe File opened (read-only) \??\U: Msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\I: Msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\U: Msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\D: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: Msiexec.exe File opened (read-only) \??\D: Msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: Msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5920ad.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI259F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2AD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2B11.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DB1.tmp msiexec.exe File opened for modification C:\Windows\Products.ini Adobe Plugin Update.exe File created C:\Windows\Installer\e5920ad.msi msiexec.exe File opened for modification C:\Windows\Products.ini Adobe Plugin Update.exe File opened for modification C:\Windows\Installer\MSI2E01.tmp msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe Plugin Update.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWAInstallMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe Plugin Update.exe - Kills process with taskkill 1 IoCs
pid Process 608 taskkill.exe - Modifies registry class 33 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "2BACF2D928D34CE4BD188E5DF87372D9" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status Adobe Plugin Update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA} Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "2BACF2D928D34CE4BD188E5DF87372D9" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo Adobe Plugin Update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true" Adobe Plugin Update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/" Adobe Plugin Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy Adobe Plugin Update.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4640 Msiexec.exe Token: SeIncreaseQuotaPrivilege 4640 Msiexec.exe Token: SeSecurityPrivilege 4764 msiexec.exe Token: SeCreateTokenPrivilege 4640 Msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4640 Msiexec.exe Token: SeLockMemoryPrivilege 4640 Msiexec.exe Token: SeIncreaseQuotaPrivilege 4640 Msiexec.exe Token: SeMachineAccountPrivilege 4640 Msiexec.exe Token: SeTcbPrivilege 4640 Msiexec.exe Token: SeSecurityPrivilege 4640 Msiexec.exe Token: SeTakeOwnershipPrivilege 4640 Msiexec.exe Token: SeLoadDriverPrivilege 4640 Msiexec.exe Token: SeSystemProfilePrivilege 4640 Msiexec.exe Token: SeSystemtimePrivilege 4640 Msiexec.exe Token: SeProfSingleProcessPrivilege 4640 Msiexec.exe Token: SeIncBasePriorityPrivilege 4640 Msiexec.exe Token: SeCreatePagefilePrivilege 4640 Msiexec.exe Token: SeCreatePermanentPrivilege 4640 Msiexec.exe Token: SeBackupPrivilege 4640 Msiexec.exe Token: SeRestorePrivilege 4640 Msiexec.exe Token: SeShutdownPrivilege 4640 Msiexec.exe Token: SeDebugPrivilege 4640 Msiexec.exe Token: SeAuditPrivilege 4640 Msiexec.exe Token: SeSystemEnvironmentPrivilege 4640 Msiexec.exe Token: SeChangeNotifyPrivilege 4640 Msiexec.exe Token: SeRemoteShutdownPrivilege 4640 Msiexec.exe Token: SeUndockPrivilege 4640 Msiexec.exe Token: SeSyncAgentPrivilege 4640 Msiexec.exe Token: SeEnableDelegationPrivilege 4640 Msiexec.exe Token: SeManageVolumePrivilege 4640 Msiexec.exe Token: SeImpersonatePrivilege 4640 Msiexec.exe Token: SeCreateGlobalPrivilege 4640 Msiexec.exe Token: SeRestorePrivilege 4764 msiexec.exe Token: SeTakeOwnershipPrivilege 4764 msiexec.exe Token: SeRestorePrivilege 4764 msiexec.exe Token: SeTakeOwnershipPrivilege 4764 msiexec.exe Token: SeRestorePrivilege 4764 msiexec.exe Token: SeTakeOwnershipPrivilege 4764 msiexec.exe Token: SeRestorePrivilege 4764 msiexec.exe Token: SeTakeOwnershipPrivilege 4764 msiexec.exe Token: SeRestorePrivilege 4764 msiexec.exe Token: SeTakeOwnershipPrivilege 4764 msiexec.exe Token: SeIncreaseQuotaPrivilege 1064 MsiExec.exe Token: SeSecurityPrivilege 1064 MsiExec.exe Token: SeTakeOwnershipPrivilege 1064 MsiExec.exe Token: SeLoadDriverPrivilege 1064 MsiExec.exe Token: SeSystemProfilePrivilege 1064 MsiExec.exe Token: SeSystemtimePrivilege 1064 MsiExec.exe Token: SeProfSingleProcessPrivilege 1064 MsiExec.exe Token: SeIncBasePriorityPrivilege 1064 MsiExec.exe Token: SeCreatePagefilePrivilege 1064 MsiExec.exe Token: SeBackupPrivilege 1064 MsiExec.exe Token: SeRestorePrivilege 1064 MsiExec.exe Token: SeShutdownPrivilege 1064 MsiExec.exe Token: SeDebugPrivilege 1064 MsiExec.exe Token: SeSystemEnvironmentPrivilege 1064 MsiExec.exe Token: SeRemoteShutdownPrivilege 1064 MsiExec.exe Token: SeUndockPrivilege 1064 MsiExec.exe Token: SeManageVolumePrivilege 1064 MsiExec.exe Token: 33 1064 MsiExec.exe Token: 34 1064 MsiExec.exe Token: 35 1064 MsiExec.exe Token: 36 1064 MsiExec.exe Token: SeRestorePrivilege 4764 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4640 Msiexec.exe 4764 msiexec.exe 1064 MsiExec.exe 3048 Msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2520 wrote to memory of 4640 2520 Adobe Plugin Update.exe 91 PID 4764 wrote to memory of 1064 4764 msiexec.exe 95 PID 1064 wrote to memory of 608 1064 MsiExec.exe 96 PID 6032 wrote to memory of 3048 6032 Adobe Plugin Update.exe 98 PID 1064 wrote to memory of 3848 1064 MsiExec.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adobe Plugin Update.exe"C:\Users\Admin\AppData\Local\Temp\Adobe Plugin Update.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4640
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BC501A39B443D8A8BB2DEE3332906BB72⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\taskkill.exetaskkill /IM FWAInstallMonitor.exe /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:608
-
-
C:\ProgramData\FWAInstallMonitor.exe"C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 10643⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3848
-
-
-
C:\Users\Admin\AppData\Local\Temp\Adobe Plugin Update.exe"C:\Users\Admin\AppData\Local\Temp\Adobe Plugin Update.exe" -r1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\CloudAgentCleanupHelper.LOG
- Size 24KB
- SHA256 831da5199be9df6e1de21ad0e7b27a345086226ec4b9fb0a9de327f99e3d5ee5
- MD5 05fcd442a64d96a45fcc4a9e3f82d4db
- SHA1 18c767cc68dae032589cf58a099b791f852e8879
- SHA512 1951740377c960856b4972246bce021c1f299b29f3947d9314aef266688f4ba2ee918b29f0f621668b7669252aae8b69e386ad4f33f038f881ac7abfa3e98fe0
- SSDEEP 768:wgMS78maSz+zS+c6SxbpSUSZS+O0S7q0SfSsSNj5SY8NSWgrS1S/qSqqy8SJy5Su:w3SwmaSz+zS+c6SxbpSUSZS+O0S7q0S+
- TLSH T1CCB23B0936C620382E7D678158FB9A8DFB9ACAF43395526CB6F5B513545B80DC0BCF0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\CloudAgentCleanupHelper.LOG
- Size 2KB
- SHA256 bb76104ecd3a5d715e0b71af780e7da47f72840882728002bb228a8920d1ea61
- MD5 d159d59cbe2df88698c4e00609426652
- SHA1 fc0fe8e5f13593a43ce80d77125914c0b54cbe98
- SHA512 84667815294ae76f0215a18b23e2f8ebf27ad916120fe4034386fd0a64a2c86513af63664a83df5aff25d1feb505969840190505d4594c94a32aabda0a3d3254
- TLSH T12051C60536C620282D7A679145FB9ACEEBD6CDF433865128B7B4F623955B41CC4BCB0E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\FWAInstallMonitor.exe
- Size 611KB
- SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
- MD5 b3157f7d3822d40038f4db3ee31dba3d
- SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
- SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
- SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
- TLSH T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI91fd3.LOG
- Size 1KB
- SHA256 147f472654f206dbcf3f472f8a89f2dd7016e53d7690008235f168df9726db58
- MD5 3ac721fc679032449b768e873bbeb214
- SHA1 cfd1a71a02ae32adb3651bd68497bc217ed05519
- SHA512 18cc548e53741bebacc777a0c3f294ace68c934e24b7a919b7970b09cc49dcadce7a77a9d98462e1772fbd764f14bccbc5ce4d4e707c3e2584441172efbe7162
- TLSH T11631D2A52EE44C46F2B7578BADB3C0524B73BCD168358B4C23498259467BD08AC6C7AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI93464.LOG
- Size 3KB
- SHA256 639cada19a3bc2c0debeae2306102b53ea030d783081bef5faade6cea70bd0ee
- MD5 08f29625229b63b59a9187e8ae41c218
- SHA1 b2ca2f1449d6ffc84181ca64a27618f30ef459c0
- SHA512 0f81dff8dc31468b81812d55d337885e629de47384afe68c6eda4aa70f020110f22f91d5f586faa68f064f2a667a1d40f048119e85aff059f17f9e59107c2591
- TLSH T1C48115141FE45845B2BBAB5BEEB38151CA33FDA66835C64C2183825D05A3D05AD3C7BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
- Size 9.5MB
- SHA256 2faf1680fd66b03103d41c425711a602d35fbc9b7c0f59d1e4bfde4985ea1c2c
- MD5 86e1bc84929a96a58ef9fe6b47c7aaaf
- SHA1 74b0250e5dac83391acefb8b416cbd0a2adbc931
- SHA512 c19580872d60e846ee7a72d6913aedba6b4b7b5adf9b49c64822052db1c5fbcac1fabf88ac123b0f78bd72c9d2b5ef970503db9a84d020732a108a0451c290dc
- SSDEEP 196608:jisGNpFZNbHRXNJWVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:1GNpFZJHRdon+X1BXy6hqc0g0kuAgJ1B
- TLSH T12CA6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
- Size 3.3MB
- SHA256 6576a782e805eb57186778e29c38193a2c4dee5d26534f8a753877354968d3b7
- MD5 b64b80739564643518023991365a4474
- SHA1 946820ded4d7d995b6e3879e31b27837bbfe9233
- SHA512 e385e43668200f742a240bca20143638a6d9d4d22bbfaef83208feaf64ab7820bf20baa26a6f4042c2dc09e9ed4ec6e514d4d335b39a9607b801f2697ae961a5
- SSDEEP 98304:NxW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:fIL3Bm8yYdS12plWa
- TLSH T112F5F0117790C13AE0AE06B268789375452DFC314B38E5CBF3C99A6E2DB16D29E31B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
- Size 8.6MB
- SHA256 597097e862b8c436a2a0b642028e2292bb3c1f2038dd5e1a28ae379237c3d226
- MD5 fab8be6bf30a9c1a365f7b34ea491855
- SHA1 fd2be9f0e3d2f15ebc74f46cb618b7c2fbd02bcb
- SHA512 916a483e9303f289d82d218f898ce1a0f70113a861130e81022e75b60fbdd829d4b00a1b4235795c807fe9502c35d061e8a4bf6a76461316fa055cf85495f521
- SSDEEP 196608:/6N+sCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:Cbn5tTl8hKlaCC
- TLSH T1FE96E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
- Size 4.3MB
- SHA256 bdd55ed7539a4e7067d3fef5b4ff3e56e33ee1ffb42233034b075315621a36a7
- MD5 165e36a1b849464610bae695fcc71d7b
- SHA1 c5daf0e9ceff68ed1cd9ae7fa9a657aaa219ef83
- SHA512 03b5c6e9cc825000dc80c4811b0adb8828675f838c2611e02f33739fa1f45187ddae1da6241dfb1e3abab4b3aed74b040c0fccce5252881eb0b92b5b066c79ec
- SSDEEP 98304:OSbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:BFf61+zZBENjYM2qXAns
- TLSH T179260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI259F.tmp
- Size 57KB
- SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
- MD5 d480853146cffda8e468cc4d2751b405
- SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
- SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
- SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
- TLSH T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2A92.tmp
- Size 138KB
- SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
- MD5 b96cc173298220d17aa0932bf3047727
- SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
- SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
- SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
- TLSH T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2AD1.tmp
- Size 1.1MB
- SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
- MD5 4cd4d7ccba93300d456b696e8ec502c5
- SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
- SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
- SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
- TLSH T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Products.ini
- Size 380B
- SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
- MD5 6c310b6e27c949b929a3843d57c8ba37
- SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
- SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
- TLSH T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
- MD5 SHA1 SHA512 TLSH