49afcf8c8cf5ed69efa2bbf9d6656079ec7f84a458f4388d200b49d061a4b989

Analysis

user interaction
yes
max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PortfolioStatement6083.exe
Size 76.4MB
Sample260807-ftzbeaeb23
SHA256 49afcf8c8cf5ed69efa2bbf9d6656079ec7f84a458f4388d200b49d061a4b989
MD5 248ff0126720b0a77c5800d0e2deb636
SHA1 63a091c69d91a64cc322705d6c17d358eeb2f416
SHA512 7e48a98706c42e5c65e2755ebbed3ac9abf8bc8d7c373f3aecaf85b6774c50f5b06d07cedbfb3b3db8411e4a405a42829661d6a991ae221613e9a3c960319e87
SSDEEP 1572864:FqnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpv:FiLVelepClAy6uw3W0BEROh2nvv5
TLSH
T1AA08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
51	3020	ModulesUpgradeMgr.exe
51	3020	ModulesUpgradeMgr.exe

Executes dropped EXE 12 IoCs

pid	Process
3984	FWAInstallMonitor.exe
5008	FWAService.exe
3020	ModulesUpgradeMgr.exe
1916	SUDLLUpdaterPatch.exe
4504	SUDLLUpdaterPatch.exe
2032	FTAgentTmp.exe
2224	FTAgent.exe
204	FWAService.exe
4368	ModulesUpgradeMgr.exe
4508	FWA_UI_Agent.exe
4252	FWAInstallMonitor.exe
2668	FWA_UI_Agent.exe

Loads dropped DLL 22 IoCs

pid	Process
2248	MsiExec.exe
2248	MsiExec.exe
2248	MsiExec.exe
2248	MsiExec.exe
2248	MsiExec.exe
2248	MsiExec.exe
4452	MsiExec.exe
4016	regsvr32.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
2792	regsvr32.exe
4452	MsiExec.exe
2708	Process not Found
4452	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
204	FWAService.exe
4452	MsiExec.exe
2248	MsiExec.exe
204	FWAService.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FaronicsTicketing = "C:\\ProgramData\\Faronics\\StorageSpace\\FWA\\modules\\FTAgent.exe"	FTAgentTmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PortfolioStatement6083.exe\" -r"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PortfolioStatement6083.exe\" -r"	PortfolioStatement6083.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\E:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\E:	Msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BC2CC0A899B13419B010C5F42995E7FF	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BC2CC0A899B13419B010C5F42995E7FF	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5	FWAService.exe
File created	C:\Windows\system32\wbem\AutoRecover\AAF97DF8955A0A044709078E6305D4FE.mof	mofcomp.exe
File created	C:\Windows\system32\wbem\AutoRecover\48CEEC55102547DB8D2945999C51BC92.mof	mofcomp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D	FWAService.exe
File created	C:\Windows\system32\wbem\AutoRecover\1814E26C1E25849B8396DBC50D93D010.mof	mofcomp.exe
File created	C:\Windows\system32\wbem\AutoRecover\1C29FC8FA2CF87E04D41BFB25C6A2483.mof	mofcomp.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe	msiexec.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI23D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EF0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE50C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE945.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBC7.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Products.ini	PortfolioStatement6083.exe
File created	C:\Windows\Installer\SourceHash{0D326B4C-1102-4C69-8266-7323C701B45C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI174D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Products.ini	PortfolioStatement6083.exe
File opened for modification	C:\Windows\Installer\MSIE904.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e3e3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE934.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A7B.tmp	msiexec.exe
File created	C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2184.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e3e7.msi	msiexec.exe
File created	C:\Windows\Installer\e58e3e3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI236A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI264A.tmp	msiexec.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3264	cmd.exe
4648	cmd.exe
1576	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SUDLLUpdaterPatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PortfolioStatement6083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModulesUpgradeMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWA_UI_Agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWA_UI_Agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PortfolioStatement6083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTAgentTmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModulesUpgradeMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SUDLLUpdaterPatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAService.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3536	taskkill.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	FWAService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	FWAService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	FWAService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FEE93EA4-7276-4010-9EEB-318186C4521B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\StorageSpaces.DLL\AppID = "{FEE93EA4-7276-4010-9EEB-318186C4521B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo = "https://deploy.faronics.com/\|0CB8C9ED-3154-4C95-B3AB-30CEE2DDEC3C\|2\|2\|FWASUCIMGUSC\|\|1785814187\|0\|\|"	ModulesUpgradeMgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version = "1.31.8110.282"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "0CB8C9ED31544C95B3AB30CEE2DDEC3C"	PortfolioStatement6083.exe
Key created	\REGISTRY\MACHINE\Software\classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name = "DIJHFWDH"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "false"	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace\ = "FaronicsStorageSpace Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace\CurVer	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "0CB8C9ED31544C95B3AB30CEE2DDEC3C"	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ProductInstaller\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\SiteType = "2"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\ProgID	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS\ProxyEnabled = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version	ModulesUpgradeMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace.1\ = "FaronicsStorageSpace Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace.1\CLSID\ = "{CA220945-0674-4494-B122-93EF5A4A6345}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	ModulesUpgradeMgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS\AuthRequired = "0"	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "false"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\InprocServer32\ = "C:\\PROGRA~2\\Faronics\\FARONI~1\\FWAWMI~1.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace\CurVer\ = "StorageSpaces.FaronicsStorageSpace.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo	PortfolioStatement6083.exe
Key created	\REGISTRY\MACHINE\Software\classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Faronics\\Faronics Deploy Agent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name	ModulesUpgradeMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	ModulesUpgradeMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy = "Manual"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID = "00000000000000000000DA48EC94345F"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2"	PortfolioStatement6083.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\656DAC6F8F5EE71498F0F80A3C2EA66D	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	PortfolioStatement6083.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
648	schtasks.exe
4460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1124	msiexec.exe
1124	msiexec.exe
2032	FTAgentTmp.exe
2032	FTAgentTmp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4720	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	4720	Msiexec.exe
Token: SeSecurityPrivilege	1124	msiexec.exe
Token: SeCreateTokenPrivilege	4720	Msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4720	Msiexec.exe
Token: SeLockMemoryPrivilege	4720	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	4720	Msiexec.exe
Token: SeMachineAccountPrivilege	4720	Msiexec.exe
Token: SeTcbPrivilege	4720	Msiexec.exe
Token: SeSecurityPrivilege	4720	Msiexec.exe
Token: SeTakeOwnershipPrivilege	4720	Msiexec.exe
Token: SeLoadDriverPrivilege	4720	Msiexec.exe
Token: SeSystemProfilePrivilege	4720	Msiexec.exe
Token: SeSystemtimePrivilege	4720	Msiexec.exe
Token: SeProfSingleProcessPrivilege	4720	Msiexec.exe
Token: SeIncBasePriorityPrivilege	4720	Msiexec.exe
Token: SeCreatePagefilePrivilege	4720	Msiexec.exe
Token: SeCreatePermanentPrivilege	4720	Msiexec.exe
Token: SeBackupPrivilege	4720	Msiexec.exe
Token: SeRestorePrivilege	4720	Msiexec.exe
Token: SeShutdownPrivilege	4720	Msiexec.exe
Token: SeDebugPrivilege	4720	Msiexec.exe
Token: SeAuditPrivilege	4720	Msiexec.exe
Token: SeSystemEnvironmentPrivilege	4720	Msiexec.exe
Token: SeChangeNotifyPrivilege	4720	Msiexec.exe
Token: SeRemoteShutdownPrivilege	4720	Msiexec.exe
Token: SeUndockPrivilege	4720	Msiexec.exe
Token: SeSyncAgentPrivilege	4720	Msiexec.exe
Token: SeEnableDelegationPrivilege	4720	Msiexec.exe
Token: SeManageVolumePrivilege	4720	Msiexec.exe
Token: SeImpersonatePrivilege	4720	Msiexec.exe
Token: SeCreateGlobalPrivilege	4720	Msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2248	MsiExec.exe
Token: SeSecurityPrivilege	2248	MsiExec.exe
Token: SeTakeOwnershipPrivilege	2248	MsiExec.exe
Token: SeLoadDriverPrivilege	2248	MsiExec.exe
Token: SeSystemProfilePrivilege	2248	MsiExec.exe
Token: SeSystemtimePrivilege	2248	MsiExec.exe
Token: SeProfSingleProcessPrivilege	2248	MsiExec.exe
Token: SeIncBasePriorityPrivilege	2248	MsiExec.exe
Token: SeCreatePagefilePrivilege	2248	MsiExec.exe
Token: SeBackupPrivilege	2248	MsiExec.exe
Token: SeRestorePrivilege	2248	MsiExec.exe
Token: SeShutdownPrivilege	2248	MsiExec.exe
Token: SeDebugPrivilege	2248	MsiExec.exe
Token: SeSystemEnvironmentPrivilege	2248	MsiExec.exe
Token: SeRemoteShutdownPrivilege	2248	MsiExec.exe
Token: SeUndockPrivilege	2248	MsiExec.exe
Token: SeManageVolumePrivilege	2248	MsiExec.exe
Token: 33	2248	MsiExec.exe
Token: 34	2248	MsiExec.exe
Token: 35	2248	MsiExec.exe
Token: 36	2248	MsiExec.exe
Token: SeRestorePrivilege	1124	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	FTAgent.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2224	FTAgent.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	FWAInstallMonitor.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4720	1016	PortfolioStatement6083.exe	89
PID 1124 wrote to memory of 2248	1124	msiexec.exe	93
PID 2248 wrote to memory of 3536	2248	MsiExec.exe	96
PID 4104 wrote to memory of 3960	4104	PortfolioStatement6083.exe	100
PID 2248 wrote to memory of 3984	2248	MsiExec.exe	101
PID 1124 wrote to memory of 4452	1124	msiexec.exe	104
PID 4452 wrote to memory of 1920	4452	MsiExec.exe	105
PID 4452 wrote to memory of 1832	4452	MsiExec.exe	107
PID 4452 wrote to memory of 3756	4452	MsiExec.exe	109
PID 4452 wrote to memory of 4016	4452	MsiExec.exe	111
PID 4452 wrote to memory of 648	4452	MsiExec.exe	112
PID 4452 wrote to memory of 2792	4452	MsiExec.exe	114
PID 1124 wrote to memory of 3020	1124	msiexec.exe	118
PID 3020 wrote to memory of 1916	3020	ModulesUpgradeMgr.exe	124
PID 1916 wrote to memory of 4504	1916	SUDLLUpdaterPatch.exe	126
PID 1124 wrote to memory of 2032	1124	msiexec.exe	128
PID 2032 wrote to memory of 2224	2032	FTAgentTmp.exe	133
PID 204 wrote to memory of 4368	204	FWAService.exe	135
PID 4452 wrote to memory of 648	4452	MsiExec.exe	137
PID 3984 wrote to memory of 3264	3984	FWAInstallMonitor.exe	141
PID 3264 wrote to memory of 4360	3264	cmd.exe	143
PID 3264 wrote to memory of 4460	3264	cmd.exe	144
PID 1016 wrote to memory of 2596	1016	PortfolioStatement6083.exe	147
PID 1016 wrote to memory of 2908	1016	PortfolioStatement6083.exe	148
PID 1016 wrote to memory of 5104	1016	PortfolioStatement6083.exe	149
PID 204 wrote to memory of 2668	204	FWAService.exe	153
PID 3984 wrote to memory of 4648	3984	FWAInstallMonitor.exe	154
PID 4648 wrote to memory of 1460	4648	cmd.exe	156
PID 3984 wrote to memory of 1576	3984	FWAInstallMonitor.exe	157
PID 1576 wrote to memory of 2752	1576	cmd.exe	159

C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe
"C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2596
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5104

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 128B043AB4C84594EE77342CC964539B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM FWAInstallMonitor.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3536
- - C:\ProgramData\FWAInstallMonitor.exe
    "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 2248
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU System /tn LaunchStartUpFWAInstallHelper /tr "\"C:\ProgramData\FWAInstallMonitor.exe\" /StartMonitorAtStartUp 5 /MsiPath C:\Users\Admin\AppData\Local\Temp\FaronicsDeployAgent.msi" /sc onstart
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchFWACleanupHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E0F9156ED253392988438A727CFB4F61 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1832
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3756
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4016
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:648
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2792
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU System /SC ONSTART /tn FWASvcHelperMonitortask /tr "'C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe' /CHECKSVCHEALTH" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:648
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\\" LaunchFromInstaller
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe
    "C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe
      "C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe" -installProgress
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4504
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
    C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2224

C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe
"C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe" -r
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:3960

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:204
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4368
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2668

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4508

C:\ProgramData\FWAInstallMonitor.exe
"C:\ProgramData\FWAInstallMonitor.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e3e6.rbs

Path C:\Config.Msi\e58e3e6.rbs
Size 2.3MB
SHA256 a5eaa4b75520a9e8284ef4d010a8c68c97f83e4b0478df5c39ebae4329b297e9
MD5 c9e41e552a5af599d0129572bfb63a6e
SHA1 d2de4532dad7e17bc070cc0b8adaccd46bec4ddc
SHA512 654305697cd22ce9bdae8da00565f3426960ded90026665e341dd2802d9e09f540460288d41fdc16389a64aee2bf7753dd7872cd5439be158acdb48b23b81e8f
SSDEEP 49152:t7DIW7GnW/+Ee7pINUcbO0sSwqbLcgO3LinW7GnW/+Ee7pINUcbO0sSwqbLcgO35:9GnW/7e7pSJ+SwKyGnW/7e7pSJ+SwKa
TLSH
T1B7B56C2177ECC236F6EF16B0AE39566A043EB9710F3081CBE384995E5D706D29A3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FRCServer.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
Size 1.8MB
SHA256 bffc018b68ef16b4fea63ab34d1cf0a9878f7fb3c8a67d598c166416e1d649a9
MD5 77e663d9c4963989f3d27b7f67d1cfeb
SHA1 7965180f011d1a57105c7ffc4c1b7452f6276246
SHA512 cd5f4e599a84f8caa137d62f98b33a72c73f5564e5a52d38b10179722fc4f4b8b47ee7b649c4f6fcfbcd5031d557f7cea3f7e3c58b6e907b68545c790a585426
SSDEEP 49152:nga5x2H/+IfovtLc8pbsOApAQfCQqDQDFNh87b8ZN0VZd9oUhdQVAMIg8o:Z2H/JfcbbsFAQf3qDSFNh87b8ftUhd2r
TLSH
T1E0958D32F6A19077D573323086D9A3B9A6BEB6701F35424B56904F3D2E344D29A3873B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FSSInstaller.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe
Size 409KB
SHA256 17743d623e6233b1eae704029e727be95e6ef60de9e50beeb9ece73fc0491f05
MD5 e7c5ee0932aaddfd28698a2d1c1e83cf
SHA1 c1018872090152063d0d18a1f67c9abade653386
SHA512 10df9e681263f5b657d83b208e9f1ef92aa633565506947644eb2f9d520847bb52dd43cc724bca1f0f063adb3b23ed269af4d7eabff28adf146b802f4a525c53
SSDEEP 12288:2gOpS6b5K+zeXnSdDZTiejq4++51JeXmnsS8/3fD:kr4+zeXngFmejqT6JeXmnsS8vL
TLSH
T1EC944A20B7D8D035F1B31A71AFB6D7764479B9A04B7091CFA3D4096A1EB0AD1C93272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTAgentTmp.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
Size 348KB
SHA256 378734ead0ab162de6a49fc35e31e04b8f2908abb371e61864ef4699fd2b2191
MD5 6eeb9d0eba24458e43de4bc3dd2f0e26
SHA1 fecc7adedf688b1beff31194f49ba5a66525bf8f
SHA512 270017cc32096a06cce3474d3d13f26fe8083d2240aaa96cd7ce55197ae7ff9bf432014739dac9215be01c0ff264673b7b2ec008144cd4053849d3617d7180f2
SSDEEP 6144:wbjvvXO3l+tUfbLTH/00HAhp5JzSmz1X34cvSGX:wfv4+tU3bVAPzSmzFrxX
TLSH
T1E674192122E48432F6AE17719A79D7A5493ABC701B7091EFE39479395D306C38E3272F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAMigrator.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll
Size 409KB
SHA256 16f38d265c199915637f57b69d52dbe788fdef9bb069bff498ef1e0ef5365e5b
MD5 d19e0a1640cd0e581d17ca4f8cafee3e
SHA1 0f729c747a9fc92e12e431d5bfe3feee0db0b2c0
SHA512 6cf366c5f5c8242b82cf1afc3173fb82af820a266f92ce383bbc0dfcf076a9a54a4bc930a8856928bb4f852e1ca825a66db84460b9f8e91bf262ad5487044caf
SSDEEP 6144:I3JuKF15GIDpbD13wvrlqr8EiTtFwVlwTMGLJmhV7d9+dfXh22AeeZ:kJuKFDBDpklqQEiTtMGLIhV7+dfA2Jw
TLSH
T1D5948D2277D5C136D89F10B4BA7A976A0579B4F00B2956C3F7E88A2F4F706C2973520B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAService.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
Size 489KB
SHA256 9769f3949ba8b5d7c3350bf259be87730de34acc89adc7098f9d8daa78e03071
MD5 e32df651f40f2b4a168d8ed46eb915cf
SHA1 40d61b9fa843e6d4d1bf688c9fd922a268b5cf96
SHA512 8616dd679cf7676b31cac94666e731326b56e5ba5f5f166650874ae61dddd5bd61d75efb8ad82d7f02ea16df82626e23cd4d7c54730d8d049ae0760e416c3264
SSDEEP 12288:DeiZxEe6DKMU1FeaAY1KWAlPVW2CHjxf9XqZ1Y:De/uJFe21KBW2CHNf9XqZK
TLSH
T11BB42710B7E9C129F5F31670AE7A862A487ABCA25F3482CF63D40D5D4D70EC18A76727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAWmiProvider.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll
Size 171KB
SHA256 4ffa7e291d9ce9fac6ddd5de6fa32ac65c47c8c01317c55eea5065ff82a63442
MD5 2ca6508cbe51e8a14089c946532bc802
SHA1 542d94e2972ab6cf3d5e6a91c78b8b226f08f60f
SHA512 7a85c1ca19e5d4f031bbb39ec37ddba2a5c48f8695eccfd71042306fe624216eecbaf2b2027970aa3386b0205c7f00038eec93a01d2b8c97dab85773e6289daf
SSDEEP 3072:/wXWbfhkZPjz8Y0HWFljyQVB9loWDXu6cD9dwsv:/wDPj82FRyMB9loWruJJJv
TLSH
T1C5045B2177D4C136FAEA263999348A6A653F7C614FB4C1CBB3984E2D5DB02C05B3532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWA_UI_Agent.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
Size 388KB
SHA256 21ed2bbfc2af29005d9bb38a7d5ac290a5294c336a8ce45e19312706a243ada4
MD5 86ab0039ee5399676176a3300f76a9a7
SHA1 75d3afd2a1aaeb49c9d588085807152e2766d3e0
SHA512 72b9f81d8a917e0c044794b46222c6a58cf98814d3eb0bc33367d50c5a4298c3f5638c1f35bec35f06f8988db3778b85936ce39ee2be079972e82d7a71c38d25
SSDEEP 12288:rqC6BYrwL0X+wp2Me+gJaCYDDmQMrwenMH:GCgYrwQX+Oe+g6H
TLSH
T1698428AC36A4C072E35607344D69D6AD56297C350B7084CBB3D4BB7EAB70AD39D3231A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FarWsClient.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll
Size 1.9MB
SHA256 b7f1a65f41005424fd903bab57fa3e77733c43ebd5b5bfe47ff21e84ffdf8f2e
MD5 719577a0d9e5069fd11614aec74c306e
SHA1 293bfb1a02a02bff042c9d00839485db39e3a0eb
SHA512 63b8aadd0a6e18505cba2437d93a164bdbbd23f7a73250871309cfd0353754023ae08200243f3e95c9ac4d1cc50d3e4e4d96ca755fc16c23267ee866e894fd87
SSDEEP 49152:3OsaOacMhJf0zkDpUBXtPqZZKP/rcj5mvYn/1412:35EpUdtPqngr85l
TLSH
T13095BF12FB8185B2E5DE02786576ABBF493EAA104338C9D3DB903A69CC311D1673F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaronicsSA.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe
Size 687KB
SHA256 72d27a92b088420da85cba5accf133848755afab335fde2094d69ac57b4e9ab6
MD5 a160c77e50d73782473014f2a15d0439
SHA1 0788ddb95cd627b5c523d6753e4aa9197c562bdf
SHA512 0500345fc9bacf208463d77e7537baaf0fb6c6ba031d9f7e0c858e240af1a0532175b73d5045366800178c7ae0600a311c1f4ca0620d82349e8ec11b00c8dee4
SSDEEP 12288:vExBg4kHMm0IMH3etb44AxKfRakuZB5u8R3lp1:X4k123PcfRakUu81lp1
TLSH
T15CE46C2077E581B6F5B316B1AFB9976A543AFC210B3185CFA384492D1E70AE19E31337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaronicsWebProduct.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof
Size 719B
SHA256 ad81deda391bacdb17148de21b56281308c557ef998bdbcda71186b786ac2503
MD5 7fa8d87869afb2f84d5ca36b9402a555
SHA1 7eaeb6ef29530cfa0b86c8ead2450cd2e7404e87
SHA512 3dff08d3becc8b0dd99e5c4569cfa22581f5e17575f83c68d753d4ae4b223f00a927d1fceed03d64c8729d800e98d0b851259f001c5355b63c9473a2897298b9
TLSH
T19301C0A1ADE7C032957A1DB2165999FBBE9E412CC32C0110BCBC8370230549B07BE8EE
MD5 SHA1 SHA512 TLSH

Submit Download

FaronicsWebProduct_v2.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof
Size 4KB
SHA256 1d3936d0973b63a09159e1f18227ffa34c0d7d5b4752ad1fa183dc1d6819ebd6
MD5 c2153986413b79d14ef7e88c38194a4c
SHA1 0261d8e1ff1a94d3d7f056d68c54b79e4fd3b699
SHA512 42cacd3e9926d13f766926e54761a23ac9a7b73aeec141a569da38fed9e98194098248256ad68160e3334204f814dd52fa2aed8908c00cb1406cb78a66dbea0f
SSDEEP 96:er94m6n/jCExTLrZ76wsnSZdNmPSdvXzvbcN:dddLrswYSZ3m0XzgN
TLSH
T1249141B5DB683923247682735B127BCAFF2D8219C3689462747F53422F3114A87BF1AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FwaCore.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll
Size 4.0MB
SHA256 15191574dde522a9c58fa108774d93023ac12be6ca7a66c6b2230956286282bc
MD5 abf25088ac8040fe62661659c272ab0a
SHA1 cb54884d7afb7f0eb0eef1e66a275acda610401e
SHA512 f9b85039d393e4e3485f09de2faedc0d6a1120cec2dcf5adb576fd436f4cfc463786f8564749633f79a6982628bc4f2e7d5e4799df076934c6c574140ae18208
SSDEEP 98304:VdwtZAvTEfdKsN8zhA954FDLo8TJwGTy2Kui:V6fwsNKH+ouO6z
TLSH
T178162911ABE58118F0FF26B17A7A97264877BC725B3089CFA3048C0D5971AC2D975B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MigrationHelper_32.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe
Size 142KB
SHA256 5e8888cf9c6deadde3c629cb42f8db81cdb2c7dc2c907fab740822c2ac12ff9e
MD5 ce818800c5d5b917fd46ac27e4830fb6
SHA1 f0aea752a02a82fa4980458aa0d348989b643c7a
SHA512 f8b341ac25233d338b6104f05cdd566036e9c4cd07389e57759f86d4fb44ad94fe1fefab835c1f21c9a4fe281074f54bf1e49a102054fecb9ae5d1cda4fa96f3
SSDEEP 3072:awDsGT6uUhgfMcNVZvvzgvLn045S7/5GnRMmwMJp3:aO69hgfMmnvzgvLnMAqmXP
TLSH
T1F7E37B213BD9C072E4B219319D7596EA593AF8328B75C0CF73884A294E707C1DA3977B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MigrationHelper_64.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe
Size 156KB
SHA256 4f88f9d7edb9d12e6e978d47367a9af1b3ae63aae725376302246ae4bef6eeab
MD5 c9a37b13b61cb93f54f9bf7e72c8f6bf
SHA1 9f4edf2ecd49082f90477d511abbbde2bd64547b
SHA512 6ac80f4989ebb03a9835f02252adc3bc838620215e1ceb75bd2cc2cbb7484421ff7e5fbc321c18a2b514e24c39ea32b4b93338492c8e7d1229d9d64789c98518
SSDEEP 3072:3KSksrX4h7+obDvxJ2TuBDgmd1o6JdiRDNC1oUjmdRA9:3KXsroh7TJ2TuBDvn6+jmc
TLSH
T14BF3292633E850B5E1B7927889B68A46F7B278524B31C3CF0324427E1E77AD19D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModulesUpgradeMgr.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
Size 675KB
SHA256 d9d176116043efb53969d74e5364ba0e65a0bf48d7b5ac5658a2489b999a853d
MD5 55739eac8811e08a08c1ae6170120387
SHA1 f2f226af74dae5f7a4c7f9112181acbfc41b64b9
SHA512 21b4f2c9f63e6362548d01c883faba38c7e2327a9eeecc7c9fc5898125481e7a01439aa54fc9dc8b90caa80df6ab8216bf1467c38a8bb6427aedd7ba3ed3e175
SSDEEP 12288:SQteMEYEkbxreqs3mVfdn+3ry9dOJs4v+z75zhAv:SQtBed0fdwy9dOq4v+z75hAv
TLSH
T1F9E47C2277E5C13AF5B211719E3E576A043BF8310B3295CBE3844A2D5EB06D29935B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotificationHelper.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe
Size 722KB
SHA256 438784b9444c41b1d1b30e2d9e3a4b49f2dbb5981c2c19a4bbb0da20b60058f0
MD5 477bce13a6a80fadae7e7e4cb5e0e654
SHA1 7fea419680129983f24e6be08259de3db5787916
SHA512 0488a61b5b189b0b03b69aca0f7ac2c0f2fee8f967969bef9df71de312255a9fb7251aeabb5713a23b171166e65ea7df4cbef0b1de8d55a2828100afc5d6df8b
SSDEEP 6144:GYSfJBPJfUuS6lnJqRSRAmij433jCriEgZePcXOKhku:GYSBBPd3lnJmftSjCeEgZgKhz
TLSH
T1E1F4E70273E8C1A5E0BFC6707C7D92A9CA267C790F3087CBB6447E2ED9256C29935356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenCapture.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe
Size 433KB
SHA256 0125d4b61056147b566a44c214e4c6ce931b3da411530d6d7b0e14307dd5918b
MD5 d33756f8294d4e52f5c9d924f2be7970
SHA1 1b8275e7efa5c030f25c685649b3183e5b071a1d
SHA512 d4424063ede5b6caca1634836ca955229abdeca5c0fdc9d5e17996fee5e59fcbca4b0337442d519503cefdf61cc22b483d862cae28c4b9a1c4b9f287d3c6b3e2
SSDEEP 6144:tsUIfJI4EvAjwbHdMMVjVLtEdLtHWyhjRwF1dKLHFuIFunFeay:uUIhI4obHHhRtEJmxKLPunFen
TLSH
T15A949D3276D1C036D4A612718E7AEB6904BAF4700B3155C7B7D90E6EAF706D29B3331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StorageSpaces.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll
Size 309KB
SHA256 c7ad31e8e674c80393f318861faa97145d8dfe5643dcdf4a911f4a4ae5cbaa7d
MD5 7b57d1b3a0a70293cc9726995693f487
SHA1 707ee804ea36bc76ff2e3055c8c9a056041899fd
SHA512 e4aa4cec676375bc17b2b71d17ed55edfa6fdfd67873590cd04ffb81dc0d068f9fb017910ebca73ee394d20065fe89307d9eb51b2f7052f4de372de6ab2b7eaa
SSDEEP 6144:NqF/GnOMMIi7KkANz64RgnxOnynCy204Ut5zpnPQuHrg8MRB3F:89GOEkIpRgnxaymAVpnPQuLg8C3F
TLSH
T139644B20B7EA8139F5FB0A71A939866A043FBD610BB1C1CFE384595D1D716C39A3472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StorageSpaces.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof
Size 6KB
SHA256 835d7a0cc6a5b5828db951848deb043df0711f59875d2e8790d3bb39a8b3f390
MD5 acb011eebd496621b25036ad0368a792
SHA1 7c9ae920ae5b72627ea6578157a4a9837dc0e94a
SHA512 cab3410e52272eb729e2d52a09020029840bfa8ecb249e2850535d44c36e39f7d0d9e4495a53b7c48ef84ba4285007525b50d5edb5a9b3bf92d8aec1d0ec4098
SSDEEP 96:5LXV+qCTWFYkcm1zvdSnQlAHWRPOQlx1mB01lobLwaUzqSwps8Q/gIph:FFU0bcelSQpnIk
TLSH
T1DED19C03A3FD4A58F5F7AF489B7612305B3BBD4A593DD91D02A8040D09F2E80E9627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserNotificationHelper.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe
Size 306KB
SHA256 cf75ba27e212c515ae69d08e6a90f801e7854d122957babd2c84bc179187cb7f
MD5 155ec492b09ffc3fc84f87da285424fa
SHA1 5adec3631019abdfc4c144fe471dc547610127f6
SHA512 c5ed784d21c42e6e6314394c45b346e1580425ec7be561b6589b08815badc0950b053f378a2396450bb45116bb8739a409cae5e0f3386509b854e5ee878c399f
SSDEEP 6144:KbbyjEF2dcgBbPc5ENcxllWymJygw5N+Rxm8jjU:kbSEqcgFc+N0StJygw5N+LPU
TLSH
T198640611B7F8852AF6F31B71ADB48269497BBCA25F7481CF6384096D4E30AC1CA75723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgent.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof
Size 14KB
SHA256 9010345865e39a11773936549afd0f10000a9c8d0cf55062e0fa90161c4557f0
MD5 b34207013b7a4ff05e150086df422de2
SHA1 5bcb95b9861b6b898b0d03a0ab26e66f00d1b704
SHA512 f1b316142c5054d7af260bfc2aa2efdbe1565a807e331f891b8c968cf27497aad4a33e613dc8b445cca69fd59a35f8aba0300fabecca97254c21e0421d63b9ed
SSDEEP 192:lFXMtf/Sg1Y19xQ/aci4dMqvF8KJEsOpXjcCR9V+k:lFXM1Y19mixUFdasFCR9VP
TLSH
T10A623602A3FA4648F1F66B48597A0571CA377D965D39DD2C02A8500D0AFFA44EDB1FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 21KB
SHA256 855c3fc105b3aa54b5ff03b29a62578cdfe1cd047b2577f1f37798bc55f5adb7
MD5 a9b1c2fb7e26315613965b3e8ed02600
SHA1 c5845cf2ccaab22c4ed682062cd34d82b8f9dfff
SHA512 c5a4a76b0f11f7e3eb3bca918721119cd7b2dd494f56131d50588149c34323d93ef7d37a46fb3d42dd21e3bbd1b40d7ba15bcd7333ab4a1b4e9b413cd2a41992
SSDEEP 384:ygHS7Hq+SBqfS0qDSeqjSQqgSVSzSAq9SwqlS2qnSUq1SEqvSeA/HSqHqFSyq0S1:ygHS7Hq+SBqfS0qDSeqjSQqgSVSzSAqI
TLSH
T1C0A24B4474C6207C5DBC6EC169BB898F7F8B86D8329413B8BAB86613545B40ECE7DB07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 18KB
SHA256 390ff20fe9efd62f3835ed3bf980ec44493c4602c3c74455c506c36c7496c96a
MD5 25c6a890fb98df2655cff45c04a84366
SHA1 4bd26a87d48f2c9c6e6aa45d612b63350d25f170
SHA512 e6c8caeda09dacf0a9f59e6c083fa1a746b1f24060b1b340b463658e28604d731c65808b67a8b17d7da574a7db82d6e70cc12c241d710a65c9e1fa2adfec72db
SSDEEP 96:XxgQbhJWQPZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcB:hgIF2FcFsgMBFxC+
TLSH
T13D825A56BBE82419FDA2B5708FB9D43E6713BA910978CC3E40AC650E4773A04BA56336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 18KB
SHA256 2aafcb21cf743914440c23d682e8c054d1d056c0444683264511a887c580af4f
MD5 641171329ab6c6d781808315dbdf89b7
SHA1 acbabb9ebe1c65fb0331f56d7eaa9a0d12d7e236
SHA512 aca081eaadb54a5fc80414b2cdad86df8f4f8aeb72f8b73de99d6cac81a523e609ca4630e05ea3dbc6f51ec53079ac66d22a526d47130829ce9e85b47bfdfd4c
SSDEEP 96:txgQbhJW0PZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcI:Lg0F2FcFsgMBFxv+
TLSH
T11D826C56BBE82419FDA2B5708FF9D43E6713BAD10978CC3E40AC650E4773A04BA56336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 26KB
SHA256 7098bc991a5f88a8e7d45b3053c30007514e2a57a706b9d395fd751439ad4cb9
MD5 776159534d4122d427fcce8834e66f2d
SHA1 8841981b75deafaac44f26fda624dfa8aa74bc98
SHA512 a1f3286fac83dc37e58626eeb4d9fe0160b49a517704e3862b3482c764c28b6ae69b5a5fb0d3b6f1ddcc1cd6aa4cc0c66e189816df9c9ae8740918421bebbd81
SSDEEP 768:47PFmKFmByFd8AhizC39uF19yfn1r6N2Fd8AhiUC39uF19yfn1r6NUFmQW7:ePFmKFmByFd8AhizC39uF19yfn1r6N2Z
TLSH
T175C2B116ABEC1549F9B2A9358EF0C42B9623BD926D78CD1D01AC1F4D0737A00F866F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 31KB
SHA256 a4965d30fcd530d371cd407e8207cce2f7d5fd57c008e1f9609fc7af89d087f9
MD5 fbf59ea58ac33dec277e891589885f77
SHA1 d3e7afb9127813f0c3fec8f478a804c08e58c70c
SHA512 3020e189c958850d46e3382fe6e69cdcd25768c5e56690f5d981b892b7db1bed3371a2bdac508f7f3efdc30343f3b9fd701a76afa78fb0f79bb1cd49e53caf67
SSDEEP 768:QyFmzFmHC39uF19yfn1r6N7WaFd8AhiUC39uF19yfn1r6NUFmQWgFd8Ahi/C39up:QyFmzFmHC39uF19yfn1r6N7WaFd8Ahi4
TLSH
T111E2A116ABEC1649F6B29A358EF0841B9223BC936D78CD1D01AC1F4D0737A44E867F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 31KB
SHA256 f83709ff26e334a2dff450802506389e3d9ff4e35b32079f3f65372c4f435b17
MD5 73ec7b2ca2fd470749d2821d2e0fa0d7
SHA1 9ab72d3c2878617c156b5c04081b19bee7e226a9
SHA512 81304b422e9146576372c561836c1558d9839f318232ac59016368c9068d8bc47e866cbc3b3c6316898080ce6f24280d7e8f25b12a772bf5a41c9e8a3dfcd615
SSDEEP 768:wyFm5FmbC39uF19yfn1r6N7WaFd8AhiUC39uF19yfn1r6NUFmQWgFd8Ahi/C39up:wyFm5FmbC39uF19yfn1r6N7WaFd8Ahi4
TLSH
T128E2A01AABED1649F5B29A358EF0841B9223BC926D78CD1D01AC1F4D0737A04F867F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 38KB
SHA256 acecd279c711c021783f7166de385ec403f58ea807b26846f742ebb1a54f0dc2
MD5 8623754c21b9c5d95018f0170c84c091
SHA1 8b705e2a40113c90b666b669de49055665e3cc1c
SHA512 295b66030c2825bb878812ed9473838df533b2ef586dafc53fe9acc2a67bf3cc160798f6299d48b8d78febb814625b95e09bd133e348ee2d5151b1d836c13585
SSDEEP 768:WtQFmtC39uF19yfn1r6N7WaFd8AhiUC39uF19yfn1r6NUFmQWgFd8Ahi/C39uF1a:WtQFmtC39uF19yfn1r6N7WaFd8AhiUC5
TLSH
T13C03821AABED0649F5B29A359EF0841B9523BC936D78CE1C019C0F4D0737A44E877F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 35KB
SHA256 08667c1732bcc1e85ff192035eceff8b53f73a2338a9090ade7b75b641f57dd4
MD5 ab283864294e03a35bc55d70a3a4489c
SHA1 255bbdc9443fb805985472b9c9aba7f1898aa531
SHA512 5a71b06b1ad17677dc7f4424279da65168d52856fae10a87400cc2916a386ebe68a667e8f088756af73d2908beaea817f995d723b5fb587a1c415f2520ec5aaf
SSDEEP 768:f4tFmtC39uF19yfn1r6N7WaFd8AhiUC39uF19yfn1r6NUFmQWgFd8Ahi/C39uF1U:f4tFmtC39uF19yfn1r6N7WaFd8AhiUCL
TLSH
T1A5F2911AABED0649F5B29A358EF0841B9623BC936D78CD1D01AC0F4D0737A44E867F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 42KB
SHA256 fff76bcd6ae5464ae8c8184c89f7a2b427aaf252c602c2d0344e7543d61e3430
MD5 775e35b6a99071f092bf66a8e444cae0
SHA1 d6a1b3f548a30baba6ce5a0bf9597ddc3f216df3
SHA512 9bd2832dc384c2e1582e912a63724e5ccb7caa56b3827135cee1521c6860eebf9d60bd8155efe9628f5b1c23019ce0182b16985ac55cf8a08a137cb76bfd8b5a
SSDEEP 768:fPUFmtC39uF19yfn1r6N7WaFd8AhiUC39uF19yfn1r6NUFmQWgFd8Ahi/C39uF1O:fPUFmtC39uF19yfn1r6N7WaFd8AhiUCZ
TLSH
T12E13831AABED0249F5B29A359EF0841B9523BC936D78CE5C019C0F4D0B37A44E877F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 23KB
SHA256 a1339811528b9abe4046461712d2666b41865fa2c822180be82b4cfb5ed74f8c
MD5 ca9d6d04b290087c449d5e24a6aeef3c
SHA1 e7941e5c53d0362fb1838ac3bc2b94ada3d0cbd4
SHA512 31294b09056d5eb6a6432c3367f4072358de54c26b554e27598737527cc1ff61a1276366807e3f3330bbdb363d702a197595b71338e5543a5deac4f58019fad3
SSDEEP 192:O50kH0kUC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFS:O50i0B8k0Vqs00l02Lg4UXuS
TLSH
T135B2A510B7E97818FDB3B9708FF8D43AA7237A950D79C82E406C954E4773944B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 23KB
SHA256 cee5c1eb9b1b6638bb6d897d59aa8fcd6038ed94be7728a18b9c18fae1098dab
MD5 1c8002624fb5f7b0463f95c9c59668f8
SHA1 bd8ef1a97708deb29aaeb8b0f97d890e2ee91b74
SHA512 557f70ed915ad3cd6dd8f45b03920c8554a7a96dceaee04034742ac27ec05c8fd0ff045ac20405da1ac5b921b1b935754f9cd8039c89fee7373b23b3c2721900
SSDEEP 192:uhxg0kH0kUC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFS:uhxg0i0B8k0Vqs00l02Lg4UXuS
TLSH
T1A5B25C14B7E96814FDB2B9708FF8D03AA7237A950D79CC3E406C964E4773940B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 1b5be7d95cf77f3eaf5f13c2a3086e0fd29c6377d8850f91ba10119bd8fae35c
MD5 3afc08617d282c001389cf72904effc8
SHA1 425cae5a0a65bf2075d8264e2fccc2331f04fcd7
SHA512 68c6c52d8270b90262a73150a7af6231eb858a75a30e7c96b4500fc440c51d7ada36562ac5021a7b85b23faf5e99f01c998498ec4a39b54c14578f1758415c1b
SSDEEP 192:7D0kakXiC3Fk0kYqy3F00k2F6F2LmFP23FUkEYF9L:7D0tn8k0Vqs00l02Lg4UXu9L
TLSH
T1EFB27D1177E92818FDB3B9708FF8D42AA7237A951D78CC2E406C964E4773940B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 8deeff7af4ae152cc86b05e0b4618eee423374df3132882f5ac8aed552b7e71a
MD5 f4f05215c210d2e5d00e44cda91609ef
SHA1 6bbb12d04d861d354ee96abf27645aa8b5b01bce
SHA512 c8987fcbb4a927150638e953bb44605e159b87d8b610a7348136e9641995509f5cd7888a0a6a88d9001254fa776e0bdfcacfffaacba888e9f2aa2e20d08e92a3
SSDEEP 192:7D0kakXiC3FRkMnJqy3F00k2F6F2LmFP23FUkEYF9L:7D0tn8Rxqs00l02Lg4UXu9L
TLSH
T17AB28E1577E92818FDB3B9708FF8D42BA7237A951D38CC2E406C964E4773940B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 f1d8fa1203065f35c6e46ba1ab1141417f3428cd1ea97fb3a928dc232558e2e7
MD5 2b90a1e33fb3d87725a0d2f27ff7327b
SHA1 ca8c8ed8764a842971f006cc854439fe87cca3c1
SHA512 1a7b15c8b98007ed6cba54870c9f2951fdbf4b46ba549a7f670bff9c337bfa9cf9598e16bef8b4e7c384379b61b5667254018fe5c0d25ff3dcd3f3c2812bae54
SSDEEP 192:sOD0kakXiC3FMhnkqy3F00k2F6F2LmFP23FUkEYF9L:sOD0tn8Muqs00l02Lg4UXu9L
TLSH
T1DEB29E1177E92918FDB3B9708FF8D42BA7237A951D38CC2E406C964E4773944B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 0fa53d50281c16d9eeab4ef22dd2a22b45ee03788155f31b653f65934786aa93
MD5 378daf04003482ccf43cbe0a582889d4
SHA1 4d58d9462ab57cb9af672bd9cc0e088de5b31d38
SHA512 f609b828d83b5ee2bdf47ed0efd8e28062d614c7337a21afa7367152c1f02c3e3c8960499a8c84d646d2a679a389915c6c1c99b645aaee78342928a4598736fd
SSDEEP 192:bD0kakXiC3FGSn6qy3F00k2F6F2LmFP23FUkEYF9L:bD0tn8Glqs00l02Lg4UXu9L
TLSH
T15CB29E1577E92818FCB3B9708FF8D02BA7237A951D38CC2E406C964E4773940B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 41457989df27d380e70d7d6f88e554efbaf42a696cd971aa4ddfa6a3f7119df2
MD5 a6e36169435a7b0abb32c12ec8897ae9
SHA1 19b980d33afa673e47f0162bbf7ec1e589aa9a0b
SHA512 ece72f27641786461e78ab3e856a13e8b83aeb6d80e318962891b92847609f33935e3d61d6711cac3ab2e995cd0a33a7c5cb7ac02bbc4b2bcffebced100e1faf
SSDEEP 192:LD0kakXiC3F0MnYqy3F00k2F6F2LmFP23FUkEYF9L:LD0tn80lqs00l02Lg4UXu9L
TLSH
T188B2AE1577E92818FCB3B9708FF8D42BA7237A951D38CC2E406C964E4773944B9A2736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 c2bdeb7d63f7d206328de435c753579e0beef9aee3d1336be9e2f2f46a584d5b
MD5 05b7a8b805a39c2070fc1861983215c6
SHA1 bb284338b5c614536a22acc89bf89ef6296a2afe
SHA512 45b97474afd18b30e7f2c48c841383330542901e1d1836b7b68f61a0df78ca7c93dd087a4811fd6740c6374025f44e8db123059882aba3f2fa0d815714e0fd3a
SSDEEP 192:7D0kakXiC3FXdn0qy3F00k2F6F2LmFP23FUkEYF9L:7D0tn8XGqs00l02Lg4UXu9L
TLSH
T16AB2AE1577E92918FCB3B9708FF8D42BA7237A951C38CC2E406C964E4773944B9A2736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgentConfig.xml

Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
Size 5KB
SHA256 ddb90b0351818e8d4e0fbaa2e77240e3a69be83934284d03e7610c7968b45a46
MD5 227e6ffcee9609ded785c663869bd381
SHA1 8be35cf236e588394efeb9f2e15a4242533c961a
SHA512 1d19e41be6b6ccddcca2df3fa656702f94571bbfdf805d6dbfa5790d81a1ec34977664d5e7baa834bd20b16db75968467f1f68f6906d1a6ea9f4b68b0fc2d955
SSDEEP 96:JRAVBa8ST5zg+MM9kewcoqloKtsaQmmMAMJz2GXoyaQ6FSzGCyHloiMyFA7anclK:/+te5zgK9k2JlntOM4UoyVwnxFolyFAi
TLSH
T1B3B1CD343DEE5039B173AE6A9FD4BADADAAEB773330664591022034A4613D42DDC193E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgentConfig.xml

Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
Size 5KB
SHA256 868e0512f044895cf91359c67e304305491930fcbdb764ea94a7130479e3dc75
MD5 0a6ca2c95dffa488202cbedd7a0f1959
SHA1 c4c4f8c9df501355fa0a03b134fa100760b75ddc
SHA512 28b6070cdb371ab1437836d34a6147b07ac236351bc76ff5e7da6b5fd5be11b74529a051eada0513e758d7d9722cc0e6932e59aba29bd2b5276a6abf5de65273
SSDEEP 96:JRAVjGg/K1+kS2PszFbCh+t0Bxb1tLBGLF3TNBUyDkY/nKfBYwxJ2EUEu+I/4Ow:/+qg/s3s9Chw0BxbHLBoTA245F+Eu+11
TLSH
T15EC1D0382DFF102DB1B3EEA59BD07996E99EF672360A646D10A203464713981EDC253D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgentConfig.xml

Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
Size 5KB
SHA256 3095a5788fb558663ccaff45284b0f18eb7cc1de2ee58529a9aede002bcdec5c
MD5 1419e6d7218d2a92ed9a8e2af7b07aee
SHA1 95631d7a58caf89d92e3b87286a892b84a928f1a
SHA512 1730b0bd4aae946b827f37b41a8c645cd70e94e3c87e81423ad6b2d3b7fab5ff042743cfa86c3514992d118ae43b58a1c76cb2c9258d4344eb3c924a6c3b13bf
SSDEEP 96:JRAVjGg/0vpmmzTu6eBpWxNB9LP1edjA6RQJAhFuLv9bLbqq86Ol3Ov7WPIbDE6W:/+qg/KpGK7B9L47SJAyz9bP2607P6GaE
TLSH
T1F3C17A3429EF5029B1B3BF964BD475DBE96EF67336066069105203874713E42EEC253E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FwaCore.dll

Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\FwaCore.dll
Size 4.1MB
SHA256 01e1d3690eef51e391b042f580cbb44a11ba8b51596b8f6e0a24218a65e1f994
MD5 3b7be6130f97edc75c376cd622fad97f
SHA1 7a1958f59bfafa03fcd18e973ccdeb93f7df2c68
SHA512 272efb0e7c0114ea5f130ad2b15b23bcb4a802b030455f5c237b647602f456f5a81f3b45b7265c1bba6c3ea24bad4ac3c186526dbe2fa474d6dff293a0a0b979
SSDEEP 49152:csguL86hUw0i4qFDQtpjPB2hMjr0m+AZqWg5C7GyKqPADE4wl8aOhW6PWra7BaOT:p86hUw0ihDQTP9jQywrCKqPADcf6fN
TLSH
T158162711E7E58014F0BF27B57A7E962A4937BC721B3089DFA304880D5972AC1D976B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotificationHelper.exe

Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\NotificationHelper.exe
Size 722KB
SHA256 273be5f8a0e4d12a2c9485c7b05f56f271ec641f311ccfd0d5349b193fd86c49
MD5 c56164b45ba5bca3c581bce77bc2f866
SHA1 122de44204931445f21ec6fef294ac101acd9cde
SHA512 5b02421760d8ffa47a0e5c0af875c44df802e094d493761c7b50c2e459fe8c15da29cec2c318b97a7eba89a2f58de0450e299c83289554f859650cf7013a3a1f
SSDEEP 6144:70jOOWPXXcQmKFF3lmmrWLiRWyyhrClpZrKcWOKZA:70iOW/X1FF3IBEhyh+lpZNKK
TLSH
T166F4E60273E8C1A5E0BFC6707C7D92A9CA267C790F3087CBB6447E2ED9256C29935356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUDLLUpdaterPatch.exe

Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\SUDLLUpdaterPatch.exe
Size 6.2MB
SHA256 b95a0687b8708acd587bbecc91b0e9e415984a0f1f860a54a6cf34eeddc7c862
MD5 698a090c0b049666f212a51c8c8bfc7a
SHA1 a1e2ceb9e5ccf68bf605478691445fc3fc4f83f3
SHA512 54eea4cfe6672b3f39c5d36c0cf2f27f280b46350a359a99371597db087779d5a37c99f4e960e60ea9f48b641e63675898bb958748935fcc58e3416a594151aa
SSDEEP 98304:SSTnRtkvQ+tuS4PfYiwOBpIeWRsTpLepn8rKXmRbYiwOBpIeWRsTpLCN:tPXXS4PAi1zwRsTpapn8O/i1zwRsTpWN
TLSH
T13D667D1076FC8A24D3B642315BBDEA629979B875073191CB339CAA6E1F336D0C536F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8e143.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI8e143.LOG
Size 1KB
SHA256 2d5a5815b85afa26b6233801fb7228fcaee7eb69c0ed1f12af3106376058b260
MD5 7187bd648ec57a640a9cf50a000c0fed
SHA1 d5359403dce4d7d36c723ac501022a43e10952d0
SHA512 d0db9786a48967a11684b14d53946aaed03b7fddf3da1791bffdb97367d7a3a739cc44a844ee5981a2903d5a656097ec643e640dbdd81449317a599de23ab5f4
TLSH
T17931D2A42BE50804B2B35B07EEF7C1535A73BCC56975DB0C6388831D466BD099DB836A
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud Agent_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
Size 9.5MB
SHA256 ed8aeda379d05fee6b49203257bdf8870da3c91b84fcfc1e7ac8ec2effd00eea
MD5 212522101db698033ce784273ce3ff20
SHA1 8ea7796b291ed6dbfc029da1d918a8d0adaf2d62
SHA512 7494322f1e421fd0061c02e95eb22ba23c08e56371b74ff3688fee345819f32593a53825f4711e6c5e1ddd4d851f81fbe2e3ceaf9211767fffb5a0ecdbfdee79
SSDEEP 196608:VisGNpFZNJHRXNJpVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:PGNpFZPHRdln+X1BXy6hqc0g0kuAgJ1B
TLSH
T194A6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imaging Client_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
Size 3.3MB
SHA256 fe690aeb6966e6eb77941ac189fb0eb80d3d5e85f2ec44fd3984733eb95e3434
MD5 c0cd93c733488171c6ccf20c31afeaaa
SHA1 eed72a7d2bd3f7249c7f3c45f5595bf4dbbada8c
SHA512 e99231ebb040d3d44c1edd5dc5d53e3374171307196542403671b16040a23edea953eb6824655bada6cff5e0e9c74197b8eaca588d12bdc5d4acc0135b949bcc
SSDEEP 98304:SxW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:EIL3Bm8yYdS12plWa
TLSH
T14CF5F0117790C13AE0AE06B268689375452DFC314B38E5CBF3C99A6E2DB16D29F31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Software Updater_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
Size 8.6MB
SHA256 30e8e742238d94976cc14a7f084ac0c95a1e464b7d88690dadf1cbf8567a29bf
MD5 6724d2f67cd42f4ad26e548d714e35f0
SHA1 c1847e8862a746e2fd2c3dc40d7650f22ef6867b
SHA512 eebfb3b4b1d999c6fdc74296e2f6e0a64de3c276fbf82528c8a35d0502540e947351847a2f1fa39f8c7656b153994c01a4bc0b4c271ccacae148bb73046ea216
SSDEEP 196608:j6N+sCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:+bn5tTl8hKlaCC
TLSH
T12A96E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Usage Stats_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
Size 4.3MB
SHA256 7459ee02ee6decafeb32f2c1723a940cf7fa60d89ba594c74507e5c06f71fa48
MD5 867649e68d0b87bf36cf59303a8af595
SHA1 c0b29ad02392e2cac6294dea0726a7f45068d172
SHA512 d9043cd860cffff43f4ffb7602e3b9f0a3ed33ef4ed5ce99fe6ab84ed11a5e844dac645bc291d0a030a0dab4ada64a6839ec7815dddde53ecb6c78d40478e4a9
SSDEEP 98304:3SbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:qFf61+zZBENjYM2qXAns
TLSH
T1F4260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWACleanupHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\{0D326B4C-1102-4C69-8266-7323C701B45C}\FWACleanupHelper.exe
Size 611KB
SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
MD5 b3157f7d3822d40038f4db3ee31dba3d
SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
TLSH
T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1F6E.tmp

Path C:\Windows\Installer\MSI1F6E.tmp
Size 147KB
SHA256 8ea9e3b1bcde24b779bf93d9c622239b4a7f28b733be9dd653fec4ec751f882d
MD5 b6ba4cd0f36e944b8f857887bfdb9ddb
SHA1 29dcce4205ce8c7a68e5da237ddf6a7d91593b20
SHA512 6eb18ffef9364eca2988d93d3f194aa590d23d7c02bffbfae4d5a12186586c871fe20b9128f754e7ab60660390240508aefb5363f841a308fd0fadaec5855abd
SSDEEP 3072:nUIB3+oXlkPUdTDq3SeMzGFpJ1bbFy85nVi:ULAlkPOTDESes4DbgCV
TLSH
T1AAE34A1172E4C176E2BB2A385E7987364A6BBC618F7095CF6B940E3E5E306C0DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE50C.tmp

Path C:\Windows\Installer\MSIE50C.tmp
Size 57KB
SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
MD5 d480853146cffda8e468cc4d2751b405
SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
TLSH
T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE904.tmp

Path C:\Windows\Installer\MSIE904.tmp
Size 138KB
SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
MD5 b96cc173298220d17aa0932bf3047727
SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
TLSH
T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE934.tmp

Path C:\Windows\Installer\MSIE934.tmp
Size 1.1MB
SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
MD5 4cd4d7ccba93300d456b696e8ec502c5
SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
TLSH
T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Products.ini

Path C:\Windows\Products.ini
Size 380B
SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
MD5 6c310b6e27c949b929a3843d57c8ba37
SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
TLSH
T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
MD5 SHA1 SHA512 TLSH

Submit Download