49afcf8c8cf5ed69efa2bbf9d6656079ec7f84a458f4388d200b49d061a4b989

Analysis

max time kernel
151s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PortfolioStatement6083.exe
Size 76.4MB
Sample260807-ftzbeaeb23
SHA256 49afcf8c8cf5ed69efa2bbf9d6656079ec7f84a458f4388d200b49d061a4b989
MD5 248ff0126720b0a77c5800d0e2deb636
SHA1 63a091c69d91a64cc322705d6c17d358eeb2f416
SHA512 7e48a98706c42e5c65e2755ebbed3ac9abf8bc8d7c373f3aecaf85b6774c50f5b06d07cedbfb3b3db8411e4a405a42829661d6a991ae221613e9a3c960319e87
SSDEEP 1572864:FqnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpv:FiLVelepClAy6uw3W0BEROh2nvv5
TLSH
T1AA08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5024	FWAInstallMonitor.exe
4508	FWAService.exe
952	ModulesUpgradeMgr.exe
3844	FTAgentTmp.exe
420	FTAgent.exe
1060	FWAService.exe
4276	ModulesUpgradeMgr.exe
5732	FWA_UI_Agent.exe
2488	FWAInstallMonitor.exe
4336	FWA_UI_Agent.exe

Loads dropped DLL 22 IoCs

pid	Process
628	MsiExec.exe
628	MsiExec.exe
628	MsiExec.exe
628	MsiExec.exe
628	MsiExec.exe
628	MsiExec.exe
2020	MsiExec.exe
5852	regsvr32.exe
2020	MsiExec.exe
2020	MsiExec.exe
2020	MsiExec.exe
2020	MsiExec.exe
1308	regsvr32.exe
2020	MsiExec.exe
4656	Process not Found
2020	MsiExec.exe
2020	MsiExec.exe
2020	MsiExec.exe
1060	FWAService.exe
2020	MsiExec.exe
628	MsiExec.exe
1060	FWAService.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PortfolioStatement6083.exe\" -r"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PortfolioStatement6083.exe\" -r"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FaronicsTicketing = "C:\\ProgramData\\Faronics\\StorageSpace\\FWA\\modules\\FTAgent.exe"	FTAgentTmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\D:	Msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5	FWAService.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59b06a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF41A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF381C45A7660A3532.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB481.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC95.tmp	msiexec.exe
File created	C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\tmpEBAE.tmp	mofcomp.exe
File opened for modification	C:\Windows\Installer\MSIED7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEEF6.tmp	msiexec.exe
File created	C:\Windows\Installer\e59b06e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBB8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF88712D556541D1C.TMP	msiexec.exe
File opened for modification	C:\Windows\Products.ini	PortfolioStatement6083.exe
File created	C:\Windows\Installer\SourceHash{0D326B4C-1102-4C69-8266-7323C701B45C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF15A.tmp	msiexec.exe
File opened for modification	C:\Windows\Products.ini	PortfolioStatement6083.exe
File created	C:\Windows\Installer\e59b06a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF18600475C28C4B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE992.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\tmpEDD1.tmp	mofcomp.exe
File opened for modification	C:\Windows\Installer\MSIF3AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE626.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE3A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF36997D0D9E955C5A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\tmpEAF3.tmp	mofcomp.exe
File opened for modification	C:\Windows\SystemTemp\tmpEC3B.tmp	mofcomp.exe
File opened for modification	C:\Windows\Installer\MSIBB69.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC65.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF08D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF05D.tmp	msiexec.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1348	cmd.exe
1928	cmd.exe
1268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PortfolioStatement6083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModulesUpgradeMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWA_UI_Agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTAgentTmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModulesUpgradeMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PortfolioStatement6083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWA_UI_Agent.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2692	taskkill.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	FWAService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	FWAService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	FWAService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	FWAService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FEE93EA4-7276-4010-9EEB-318186C4521B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS	FWAService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\ = "FWA WMI Sample Instance Provider"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\ProductIcon = "C:\\Windows\\Installer\\{0D326B4C-1102-4C69-8266-7323C701B45C}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\656DAC6F8F5EE71498F0F80A3C2EA66D\C4B623D0201196C4286637327C104BC5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "0CB8C9ED31544C95B3AB30CEE2DDEC3C"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\TypeLib	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS\ProxyEnabled = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ProductInstaller\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "0CB8C9ED31544C95B3AB30CEE2DDEC3C"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\InprocServer32\ = "C:\\PROGRA~2\\Faronics\\FARONI~1\\FWAWMI~1.DLL"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\ = "FaronicsStorageSpace Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4B623D0201196C4286637327C104BC5\FaronicsWebAgentInstall	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\656DAC6F8F5EE71498F0F80A3C2EA66D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "false"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo = "https://deploy.faronics.com/\|0CB8C9ED-3154-4C95-B3AB-30CEE2DDEC3C\|2\|2\|FWASUCIMGUSC\|\|1785814187\|0\|\|"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FEE93EA4-7276-4010-9EEB-318186C4521B}\ = "StorageSpaces"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID	PortfolioStatement6083.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace.1\CLSID\ = "{CA220945-0674-4494-B122-93EF5A4A6345}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS\AuthRequired = "0"	FWAService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name = "DLAWBTBF"	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2"	PortfolioStatement6083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\StorageSpaces.DLL\AppID = "{FEE93EA4-7276-4010-9EEB-318186C4521B}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo = "v1-T-10-0-26100-2-0-0-256-1-64-D-n0-n60-1-1033"	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6055DB66-56A9-4264-8A2D-EC1E19293928}\FWA_InstallDir = "C:\\Program Files (x86)\\Faronics\\Faronics Deploy Agent\\"	MsiExec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1764	schtasks.exe
3624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5860	msiexec.exe
5860	msiexec.exe
3844	FTAgentTmp.exe
3844	FTAgentTmp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4220	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	4220	Msiexec.exe
Token: SeSecurityPrivilege	5860	msiexec.exe
Token: SeCreateTokenPrivilege	4220	Msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4220	Msiexec.exe
Token: SeLockMemoryPrivilege	4220	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	4220	Msiexec.exe
Token: SeMachineAccountPrivilege	4220	Msiexec.exe
Token: SeTcbPrivilege	4220	Msiexec.exe
Token: SeSecurityPrivilege	4220	Msiexec.exe
Token: SeTakeOwnershipPrivilege	4220	Msiexec.exe
Token: SeLoadDriverPrivilege	4220	Msiexec.exe
Token: SeSystemProfilePrivilege	4220	Msiexec.exe
Token: SeSystemtimePrivilege	4220	Msiexec.exe
Token: SeProfSingleProcessPrivilege	4220	Msiexec.exe
Token: SeIncBasePriorityPrivilege	4220	Msiexec.exe
Token: SeCreatePagefilePrivilege	4220	Msiexec.exe
Token: SeCreatePermanentPrivilege	4220	Msiexec.exe
Token: SeBackupPrivilege	4220	Msiexec.exe
Token: SeRestorePrivilege	4220	Msiexec.exe
Token: SeShutdownPrivilege	4220	Msiexec.exe
Token: SeDebugPrivilege	4220	Msiexec.exe
Token: SeAuditPrivilege	4220	Msiexec.exe
Token: SeSystemEnvironmentPrivilege	4220	Msiexec.exe
Token: SeChangeNotifyPrivilege	4220	Msiexec.exe
Token: SeRemoteShutdownPrivilege	4220	Msiexec.exe
Token: SeUndockPrivilege	4220	Msiexec.exe
Token: SeSyncAgentPrivilege	4220	Msiexec.exe
Token: SeEnableDelegationPrivilege	4220	Msiexec.exe
Token: SeManageVolumePrivilege	4220	Msiexec.exe
Token: SeImpersonatePrivilege	4220	Msiexec.exe
Token: SeCreateGlobalPrivilege	4220	Msiexec.exe
Token: SeRestorePrivilege	5860	msiexec.exe
Token: SeTakeOwnershipPrivilege	5860	msiexec.exe
Token: SeRestorePrivilege	5860	msiexec.exe
Token: SeTakeOwnershipPrivilege	5860	msiexec.exe
Token: SeRestorePrivilege	5860	msiexec.exe
Token: SeTakeOwnershipPrivilege	5860	msiexec.exe
Token: SeRestorePrivilege	5860	msiexec.exe
Token: SeTakeOwnershipPrivilege	5860	msiexec.exe
Token: SeRestorePrivilege	5860	msiexec.exe
Token: SeTakeOwnershipPrivilege	5860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	628	MsiExec.exe
Token: SeSecurityPrivilege	628	MsiExec.exe
Token: SeTakeOwnershipPrivilege	628	MsiExec.exe
Token: SeLoadDriverPrivilege	628	MsiExec.exe
Token: SeSystemProfilePrivilege	628	MsiExec.exe
Token: SeSystemtimePrivilege	628	MsiExec.exe
Token: SeProfSingleProcessPrivilege	628	MsiExec.exe
Token: SeIncBasePriorityPrivilege	628	MsiExec.exe
Token: SeCreatePagefilePrivilege	628	MsiExec.exe
Token: SeBackupPrivilege	628	MsiExec.exe
Token: SeRestorePrivilege	628	MsiExec.exe
Token: SeShutdownPrivilege	628	MsiExec.exe
Token: SeDebugPrivilege	628	MsiExec.exe
Token: SeSystemEnvironmentPrivilege	628	MsiExec.exe
Token: SeRemoteShutdownPrivilege	628	MsiExec.exe
Token: SeUndockPrivilege	628	MsiExec.exe
Token: SeManageVolumePrivilege	628	MsiExec.exe
Token: 33	628	MsiExec.exe
Token: 34	628	MsiExec.exe
Token: 35	628	MsiExec.exe
Token: 36	628	MsiExec.exe
Token: SeRestorePrivilege	5860	msiexec.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4220	Msiexec.exe
5860	msiexec.exe
628	MsiExec.exe
2020	MsiExec.exe
3444	Msiexec.exe
4492	Msiexec.exe
4100	Msiexec.exe
5928	Msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4220	1496	PortfolioStatement6083.exe	91
PID 5860 wrote to memory of 628	5860	msiexec.exe	95
PID 628 wrote to memory of 2692	628	MsiExec.exe	96
PID 628 wrote to memory of 5024	628	MsiExec.exe	98
PID 5860 wrote to memory of 2020	5860	msiexec.exe	100
PID 2020 wrote to memory of 4148	2020	MsiExec.exe	101
PID 2020 wrote to memory of 5632	2020	MsiExec.exe	103
PID 2020 wrote to memory of 980	2020	MsiExec.exe	105
PID 2020 wrote to memory of 5852	2020	MsiExec.exe	107
PID 2020 wrote to memory of 1932	2020	MsiExec.exe	108
PID 2020 wrote to memory of 1308	2020	MsiExec.exe	110
PID 5860 wrote to memory of 952	5860	msiexec.exe	115
PID 5860 wrote to memory of 3844	5860	msiexec.exe	118
PID 1180 wrote to memory of 3444	1180	PortfolioStatement6083.exe	119
PID 3844 wrote to memory of 420	3844	FTAgentTmp.exe	120
PID 1060 wrote to memory of 4276	1060	FWAService.exe	122
PID 2020 wrote to memory of 1764	2020	MsiExec.exe	124
PID 5024 wrote to memory of 1348	5024	FWAInstallMonitor.exe	128
PID 1348 wrote to memory of 4760	1348	cmd.exe	130
PID 1348 wrote to memory of 3624	1348	cmd.exe	131
PID 1496 wrote to memory of 4492	1496	PortfolioStatement6083.exe	135
PID 1496 wrote to memory of 4100	1496	PortfolioStatement6083.exe	136
PID 1496 wrote to memory of 5928	1496	PortfolioStatement6083.exe	137
PID 1060 wrote to memory of 4336	1060	FWAService.exe	138
PID 5024 wrote to memory of 1928	5024	FWAInstallMonitor.exe	139
PID 1928 wrote to memory of 4840	1928	cmd.exe	141
PID 5024 wrote to memory of 1268	5024	FWAInstallMonitor.exe	142
PID 1268 wrote to memory of 1076	1268	cmd.exe	144

C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe
"C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4220
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4492
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4100
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5928

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 810D117EF7ACE87A078D9DAEA7C8CD6C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM FWAInstallMonitor.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2692
- - C:\ProgramData\FWAInstallMonitor.exe
    "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 628
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU System /tn LaunchStartUpFWAInstallHelper /tr "\"C:\ProgramData\FWAInstallMonitor.exe\" /StartMonitorAtStartUp 5 /MsiPath C:\Users\Admin\AppData\Local\Temp\FaronicsDeployAgent.msi" /sc onstart
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchFWACleanupHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7B49EF29F81E23E8F81F69AD6E08BE64 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4148
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5632
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:980
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5852
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1932
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU System /SC ONSTART /tn FWASvcHelperMonitortask /tr "'C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe' /CHECKSVCHEALTH" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1764
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\\" LaunchFromInstaller
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:952
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
    C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:420

C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe
"C:\Users\Admin\AppData\Local\Temp\PortfolioStatement6083.exe" -r
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5016

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4508

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4276
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4336

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5732

C:\ProgramData\FWAInstallMonitor.exe
"C:\ProgramData\FWAInstallMonitor.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b06d.rbs

Path C:\Config.Msi\e59b06d.rbs
Size 2.3MB
SHA256 3feb2fde2428c88f4c1683b615610abb5c63993f3ea5d7da2719a8b42bb54b45
MD5 8cf3131f9073d33daf1296d06e453534
SHA1 cbb83d9e880d5a200740057f155c6b3ad4617de2
SHA512 7c1346b2abc13b676329c6959610f36ecf18b7f80ab8383328d0de25d1733b67f19f1ff13076e7fc66ec1a69b67596edb1b29fc2446c796d554c9d6f239f7df9
SSDEEP 49152:x7DIW7GnW/+Ee7pINUcbO0sSwqbLcgO3LinW7GnW/+Ee7pINUcbO0sSwqbLcgO3V:BGnW/7e7pSJ+SwKyGnW/7e7pSJ+SwKW
TLSH
T1E8B56C2177ECC236F6EF16B0AE39566A043EB9710F3081CBE384995E5D706D29A3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FRCServer.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
Size 1.8MB
SHA256 bffc018b68ef16b4fea63ab34d1cf0a9878f7fb3c8a67d598c166416e1d649a9
MD5 77e663d9c4963989f3d27b7f67d1cfeb
SHA1 7965180f011d1a57105c7ffc4c1b7452f6276246
SHA512 cd5f4e599a84f8caa137d62f98b33a72c73f5564e5a52d38b10179722fc4f4b8b47ee7b649c4f6fcfbcd5031d557f7cea3f7e3c58b6e907b68545c790a585426
SSDEEP 49152:nga5x2H/+IfovtLc8pbsOApAQfCQqDQDFNh87b8ZN0VZd9oUhdQVAMIg8o:Z2H/JfcbbsFAQf3qDSFNh87b8ftUhd2r
TLSH
T1E0958D32F6A19077D573323086D9A3B9A6BEB6701F35424B56904F3D2E344D29A3873B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FSSInstaller.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe
Size 409KB
SHA256 17743d623e6233b1eae704029e727be95e6ef60de9e50beeb9ece73fc0491f05
MD5 e7c5ee0932aaddfd28698a2d1c1e83cf
SHA1 c1018872090152063d0d18a1f67c9abade653386
SHA512 10df9e681263f5b657d83b208e9f1ef92aa633565506947644eb2f9d520847bb52dd43cc724bca1f0f063adb3b23ed269af4d7eabff28adf146b802f4a525c53
SSDEEP 12288:2gOpS6b5K+zeXnSdDZTiejq4++51JeXmnsS8/3fD:kr4+zeXngFmejqT6JeXmnsS8vL
TLSH
T1EC944A20B7D8D035F1B31A71AFB6D7764479B9A04B7091CFA3D4096A1EB0AD1C93272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTAgentTmp.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
Size 348KB
SHA256 378734ead0ab162de6a49fc35e31e04b8f2908abb371e61864ef4699fd2b2191
MD5 6eeb9d0eba24458e43de4bc3dd2f0e26
SHA1 fecc7adedf688b1beff31194f49ba5a66525bf8f
SHA512 270017cc32096a06cce3474d3d13f26fe8083d2240aaa96cd7ce55197ae7ff9bf432014739dac9215be01c0ff264673b7b2ec008144cd4053849d3617d7180f2
SSDEEP 6144:wbjvvXO3l+tUfbLTH/00HAhp5JzSmz1X34cvSGX:wfv4+tU3bVAPzSmzFrxX
TLSH
T1E674192122E48432F6AE17719A79D7A5493ABC701B7091EFE39479395D306C38E3272F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAMigrator.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll
Size 409KB
SHA256 16f38d265c199915637f57b69d52dbe788fdef9bb069bff498ef1e0ef5365e5b
MD5 d19e0a1640cd0e581d17ca4f8cafee3e
SHA1 0f729c747a9fc92e12e431d5bfe3feee0db0b2c0
SHA512 6cf366c5f5c8242b82cf1afc3173fb82af820a266f92ce383bbc0dfcf076a9a54a4bc930a8856928bb4f852e1ca825a66db84460b9f8e91bf262ad5487044caf
SSDEEP 6144:I3JuKF15GIDpbD13wvrlqr8EiTtFwVlwTMGLJmhV7d9+dfXh22AeeZ:kJuKFDBDpklqQEiTtMGLIhV7+dfA2Jw
TLSH
T1D5948D2277D5C136D89F10B4BA7A976A0579B4F00B2956C3F7E88A2F4F706C2973520B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAService.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
Size 489KB
SHA256 9769f3949ba8b5d7c3350bf259be87730de34acc89adc7098f9d8daa78e03071
MD5 e32df651f40f2b4a168d8ed46eb915cf
SHA1 40d61b9fa843e6d4d1bf688c9fd922a268b5cf96
SHA512 8616dd679cf7676b31cac94666e731326b56e5ba5f5f166650874ae61dddd5bd61d75efb8ad82d7f02ea16df82626e23cd4d7c54730d8d049ae0760e416c3264
SSDEEP 12288:DeiZxEe6DKMU1FeaAY1KWAlPVW2CHjxf9XqZ1Y:De/uJFe21KBW2CHNf9XqZK
TLSH
T11BB42710B7E9C129F5F31670AE7A862A487ABCA25F3482CF63D40D5D4D70EC18A76727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAWmiProvider.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll
Size 171KB
SHA256 4ffa7e291d9ce9fac6ddd5de6fa32ac65c47c8c01317c55eea5065ff82a63442
MD5 2ca6508cbe51e8a14089c946532bc802
SHA1 542d94e2972ab6cf3d5e6a91c78b8b226f08f60f
SHA512 7a85c1ca19e5d4f031bbb39ec37ddba2a5c48f8695eccfd71042306fe624216eecbaf2b2027970aa3386b0205c7f00038eec93a01d2b8c97dab85773e6289daf
SSDEEP 3072:/wXWbfhkZPjz8Y0HWFljyQVB9loWDXu6cD9dwsv:/wDPj82FRyMB9loWruJJJv
TLSH
T1C5045B2177D4C136FAEA263999348A6A653F7C614FB4C1CBB3984E2D5DB02C05B3532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWA_UI_Agent.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
Size 388KB
SHA256 21ed2bbfc2af29005d9bb38a7d5ac290a5294c336a8ce45e19312706a243ada4
MD5 86ab0039ee5399676176a3300f76a9a7
SHA1 75d3afd2a1aaeb49c9d588085807152e2766d3e0
SHA512 72b9f81d8a917e0c044794b46222c6a58cf98814d3eb0bc33367d50c5a4298c3f5638c1f35bec35f06f8988db3778b85936ce39ee2be079972e82d7a71c38d25
SSDEEP 12288:rqC6BYrwL0X+wp2Me+gJaCYDDmQMrwenMH:GCgYrwQX+Oe+g6H
TLSH
T1698428AC36A4C072E35607344D69D6AD56297C350B7084CBB3D4BB7EAB70AD39D3231A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FarWsClient.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll
Size 1.9MB
SHA256 b7f1a65f41005424fd903bab57fa3e77733c43ebd5b5bfe47ff21e84ffdf8f2e
MD5 719577a0d9e5069fd11614aec74c306e
SHA1 293bfb1a02a02bff042c9d00839485db39e3a0eb
SHA512 63b8aadd0a6e18505cba2437d93a164bdbbd23f7a73250871309cfd0353754023ae08200243f3e95c9ac4d1cc50d3e4e4d96ca755fc16c23267ee866e894fd87
SSDEEP 49152:3OsaOacMhJf0zkDpUBXtPqZZKP/rcj5mvYn/1412:35EpUdtPqngr85l
TLSH
T13095BF12FB8185B2E5DE02786576ABBF493EAA104338C9D3DB903A69CC311D1673F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaronicsSA.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe
Size 687KB
SHA256 72d27a92b088420da85cba5accf133848755afab335fde2094d69ac57b4e9ab6
MD5 a160c77e50d73782473014f2a15d0439
SHA1 0788ddb95cd627b5c523d6753e4aa9197c562bdf
SHA512 0500345fc9bacf208463d77e7537baaf0fb6c6ba031d9f7e0c858e240af1a0532175b73d5045366800178c7ae0600a311c1f4ca0620d82349e8ec11b00c8dee4
SSDEEP 12288:vExBg4kHMm0IMH3etb44AxKfRakuZB5u8R3lp1:X4k123PcfRakUu81lp1
TLSH
T15CE46C2077E581B6F5B316B1AFB9976A543AFC210B3185CFA384492D1E70AE19E31337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaronicsWebProduct.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof
Size 719B
SHA256 ad81deda391bacdb17148de21b56281308c557ef998bdbcda71186b786ac2503
MD5 7fa8d87869afb2f84d5ca36b9402a555
SHA1 7eaeb6ef29530cfa0b86c8ead2450cd2e7404e87
SHA512 3dff08d3becc8b0dd99e5c4569cfa22581f5e17575f83c68d753d4ae4b223f00a927d1fceed03d64c8729d800e98d0b851259f001c5355b63c9473a2897298b9
TLSH
T19301C0A1ADE7C032957A1DB2165999FBBE9E412CC32C0110BCBC8370230549B07BE8EE
MD5 SHA1 SHA512 TLSH

Submit Download

FaronicsWebProduct_v2.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof
Size 4KB
SHA256 1d3936d0973b63a09159e1f18227ffa34c0d7d5b4752ad1fa183dc1d6819ebd6
MD5 c2153986413b79d14ef7e88c38194a4c
SHA1 0261d8e1ff1a94d3d7f056d68c54b79e4fd3b699
SHA512 42cacd3e9926d13f766926e54761a23ac9a7b73aeec141a569da38fed9e98194098248256ad68160e3334204f814dd52fa2aed8908c00cb1406cb78a66dbea0f
SSDEEP 96:er94m6n/jCExTLrZ76wsnSZdNmPSdvXzvbcN:dddLrswYSZ3m0XzgN
TLSH
T1249141B5DB683923247682735B127BCAFF2D8219C3689462747F53422F3114A87BF1AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FwaCore.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll
Size 4.0MB
SHA256 15191574dde522a9c58fa108774d93023ac12be6ca7a66c6b2230956286282bc
MD5 abf25088ac8040fe62661659c272ab0a
SHA1 cb54884d7afb7f0eb0eef1e66a275acda610401e
SHA512 f9b85039d393e4e3485f09de2faedc0d6a1120cec2dcf5adb576fd436f4cfc463786f8564749633f79a6982628bc4f2e7d5e4799df076934c6c574140ae18208
SSDEEP 98304:VdwtZAvTEfdKsN8zhA954FDLo8TJwGTy2Kui:V6fwsNKH+ouO6z
TLSH
T178162911ABE58118F0FF26B17A7A97264877BC725B3089CFA3048C0D5971AC2D975B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MigrationHelper_32.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe
Size 142KB
SHA256 5e8888cf9c6deadde3c629cb42f8db81cdb2c7dc2c907fab740822c2ac12ff9e
MD5 ce818800c5d5b917fd46ac27e4830fb6
SHA1 f0aea752a02a82fa4980458aa0d348989b643c7a
SHA512 f8b341ac25233d338b6104f05cdd566036e9c4cd07389e57759f86d4fb44ad94fe1fefab835c1f21c9a4fe281074f54bf1e49a102054fecb9ae5d1cda4fa96f3
SSDEEP 3072:awDsGT6uUhgfMcNVZvvzgvLn045S7/5GnRMmwMJp3:aO69hgfMmnvzgvLnMAqmXP
TLSH
T1F7E37B213BD9C072E4B219319D7596EA593AF8328B75C0CF73884A294E707C1DA3977B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MigrationHelper_64.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe
Size 156KB
SHA256 4f88f9d7edb9d12e6e978d47367a9af1b3ae63aae725376302246ae4bef6eeab
MD5 c9a37b13b61cb93f54f9bf7e72c8f6bf
SHA1 9f4edf2ecd49082f90477d511abbbde2bd64547b
SHA512 6ac80f4989ebb03a9835f02252adc3bc838620215e1ceb75bd2cc2cbb7484421ff7e5fbc321c18a2b514e24c39ea32b4b93338492c8e7d1229d9d64789c98518
SSDEEP 3072:3KSksrX4h7+obDvxJ2TuBDgmd1o6JdiRDNC1oUjmdRA9:3KXsroh7TJ2TuBDvn6+jmc
TLSH
T14BF3292633E850B5E1B7927889B68A46F7B278524B31C3CF0324427E1E77AD19D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModulesUpgradeMgr.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
Size 675KB
SHA256 d9d176116043efb53969d74e5364ba0e65a0bf48d7b5ac5658a2489b999a853d
MD5 55739eac8811e08a08c1ae6170120387
SHA1 f2f226af74dae5f7a4c7f9112181acbfc41b64b9
SHA512 21b4f2c9f63e6362548d01c883faba38c7e2327a9eeecc7c9fc5898125481e7a01439aa54fc9dc8b90caa80df6ab8216bf1467c38a8bb6427aedd7ba3ed3e175
SSDEEP 12288:SQteMEYEkbxreqs3mVfdn+3ry9dOJs4v+z75zhAv:SQtBed0fdwy9dOq4v+z75hAv
TLSH
T1F9E47C2277E5C13AF5B211719E3E576A043BF8310B3295CBE3844A2D5EB06D29935B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotificationHelper.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe
Size 722KB
SHA256 438784b9444c41b1d1b30e2d9e3a4b49f2dbb5981c2c19a4bbb0da20b60058f0
MD5 477bce13a6a80fadae7e7e4cb5e0e654
SHA1 7fea419680129983f24e6be08259de3db5787916
SHA512 0488a61b5b189b0b03b69aca0f7ac2c0f2fee8f967969bef9df71de312255a9fb7251aeabb5713a23b171166e65ea7df4cbef0b1de8d55a2828100afc5d6df8b
SSDEEP 6144:GYSfJBPJfUuS6lnJqRSRAmij433jCriEgZePcXOKhku:GYSBBPd3lnJmftSjCeEgZgKhz
TLSH
T1E1F4E70273E8C1A5E0BFC6707C7D92A9CA267C790F3087CBB6447E2ED9256C29935356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenCapture.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe
Size 433KB
SHA256 0125d4b61056147b566a44c214e4c6ce931b3da411530d6d7b0e14307dd5918b
MD5 d33756f8294d4e52f5c9d924f2be7970
SHA1 1b8275e7efa5c030f25c685649b3183e5b071a1d
SHA512 d4424063ede5b6caca1634836ca955229abdeca5c0fdc9d5e17996fee5e59fcbca4b0337442d519503cefdf61cc22b483d862cae28c4b9a1c4b9f287d3c6b3e2
SSDEEP 6144:tsUIfJI4EvAjwbHdMMVjVLtEdLtHWyhjRwF1dKLHFuIFunFeay:uUIhI4obHHhRtEJmxKLPunFen
TLSH
T15A949D3276D1C036D4A612718E7AEB6904BAF4700B3155C7B7D90E6EAF706D29B3331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StorageSpaces.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll
Size 309KB
SHA256 c7ad31e8e674c80393f318861faa97145d8dfe5643dcdf4a911f4a4ae5cbaa7d
MD5 7b57d1b3a0a70293cc9726995693f487
SHA1 707ee804ea36bc76ff2e3055c8c9a056041899fd
SHA512 e4aa4cec676375bc17b2b71d17ed55edfa6fdfd67873590cd04ffb81dc0d068f9fb017910ebca73ee394d20065fe89307d9eb51b2f7052f4de372de6ab2b7eaa
SSDEEP 6144:NqF/GnOMMIi7KkANz64RgnxOnynCy204Ut5zpnPQuHrg8MRB3F:89GOEkIpRgnxaymAVpnPQuLg8C3F
TLSH
T139644B20B7EA8139F5FB0A71A939866A043FBD610BB1C1CFE384595D1D716C39A3472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StorageSpaces.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof
Size 6KB
SHA256 835d7a0cc6a5b5828db951848deb043df0711f59875d2e8790d3bb39a8b3f390
MD5 acb011eebd496621b25036ad0368a792
SHA1 7c9ae920ae5b72627ea6578157a4a9837dc0e94a
SHA512 cab3410e52272eb729e2d52a09020029840bfa8ecb249e2850535d44c36e39f7d0d9e4495a53b7c48ef84ba4285007525b50d5edb5a9b3bf92d8aec1d0ec4098
SSDEEP 96:5LXV+qCTWFYkcm1zvdSnQlAHWRPOQlx1mB01lobLwaUzqSwps8Q/gIph:FFU0bcelSQpnIk
TLSH
T1DED19C03A3FD4A58F5F7AF489B7612305B3BBD4A593DD91D02A8040D09F2E80E9627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserNotificationHelper.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe
Size 306KB
SHA256 cf75ba27e212c515ae69d08e6a90f801e7854d122957babd2c84bc179187cb7f
MD5 155ec492b09ffc3fc84f87da285424fa
SHA1 5adec3631019abdfc4c144fe471dc547610127f6
SHA512 c5ed784d21c42e6e6314394c45b346e1580425ec7be561b6589b08815badc0950b053f378a2396450bb45116bb8739a409cae5e0f3386509b854e5ee878c399f
SSDEEP 6144:KbbyjEF2dcgBbPc5ENcxllWymJygw5N+Rxm8jjU:kbSEqcgFc+N0StJygw5N+LPU
TLSH
T198640611B7F8852AF6F31B71ADB48269497BBCA25F7481CF6384096D4E30AC1CA75723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgent.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof
Size 14KB
SHA256 9010345865e39a11773936549afd0f10000a9c8d0cf55062e0fa90161c4557f0
MD5 b34207013b7a4ff05e150086df422de2
SHA1 5bcb95b9861b6b898b0d03a0ab26e66f00d1b704
SHA512 f1b316142c5054d7af260bfc2aa2efdbe1565a807e331f891b8c968cf27497aad4a33e613dc8b445cca69fd59a35f8aba0300fabecca97254c21e0421d63b9ed
SSDEEP 192:lFXMtf/Sg1Y19xQ/aci4dMqvF8KJEsOpXjcCR9V+k:lFXM1Y19mixUFdasFCR9VP
TLSH
T10A623602A3FA4648F1F66B48597A0571CA377D965D39DD2C02A8500D0AFFA44EDB1FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 3KB
SHA256 9f15cffb4a9dfb3b3fcd45e9c9f00ee9e885b3d504985b8b93fe57ae614ffc8d
MD5 94719833949609fe8522bfbe7c51d854
SHA1 da3b93ea7e95ce54ce4e5c376129b12749b7ebc2
SHA512 46801f0ddcdeb23356235a361c5a5743b9387423709ce4a16438fc37196dccf869a00d9edb3b06d49146d91f1e49cb1bbf04340b74c844279bc375c51f0a1dc3
TLSH
T11C81F54034CE24785DF86A9158B79ACDAF9B85E8338E223DB7746323945F41CC139B2B
MD5 SHA1 SHA512 TLSH

Submit Download

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 26KB
SHA256 ef6635e4f66575bab0e0cf48608371d9a7e766a16900daa5af889961049942be
MD5 8536913a03b1535ae4c41c35054f3b64
SHA1 02e44e9aca3e78f509e4a73f9330ef46c0793f79
SHA512 ddf81a0a7a597ffc02a874057ccae71caaa644fafbc782b3249df213a56cda5d4e0b1bf0563aea8cb8004c230773b345cbcb9e33a5483ded3472db6f1665027a
SSDEEP 768:Ag6S76W0SjOLS0OfSYa5SCaSSzwuS9SmSWKnSaa2S3iMSVqySQg/pSqOmsS3mpSY:ALS+W0SjOLS0OfSYa5SCaSSzwuS9SmSD
TLSH
T183C26A4035CE28789DFC668158FB898D7B9B86E8339D127CB6B96213945F80CC179F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAInstallMonitor.exe

Path C:\ProgramData\FWAInstallMonitor.exe
Size 611KB
SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
MD5 b3157f7d3822d40038f4db3ee31dba3d
SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
TLSH
T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 18KB
SHA256 390ff20fe9efd62f3835ed3bf980ec44493c4602c3c74455c506c36c7496c96a
MD5 25c6a890fb98df2655cff45c04a84366
SHA1 4bd26a87d48f2c9c6e6aa45d612b63350d25f170
SHA512 e6c8caeda09dacf0a9f59e6c083fa1a746b1f24060b1b340b463658e28604d731c65808b67a8b17d7da574a7db82d6e70cc12c241d710a65c9e1fa2adfec72db
SSDEEP 96:XxgQbhJWQPZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcB:hgIF2FcFsgMBFxC+
TLSH
T13D825A56BBE82419FDA2B5708FB9D43E6713BA910978CC3E40AC650E4773A04BA56336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 18KB
SHA256 2aafcb21cf743914440c23d682e8c054d1d056c0444683264511a887c580af4f
MD5 641171329ab6c6d781808315dbdf89b7
SHA1 acbabb9ebe1c65fb0331f56d7eaa9a0d12d7e236
SHA512 aca081eaadb54a5fc80414b2cdad86df8f4f8aeb72f8b73de99d6cac81a523e609ca4630e05ea3dbc6f51ec53079ac66d22a526d47130829ce9e85b47bfdfd4c
SSDEEP 96:txgQbhJW0PZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcI:Lg0F2FcFsgMBFxv+
TLSH
T11D826C56BBE82419FDA2B5708FF9D43E6713BAD10978CC3E40AC650E4773A04BA56336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 26KB
SHA256 4cd7cab26f2c46eac6f6873738244c6dde02f54e75be040c00dc7e2e9531ea2b
MD5 5c31667db5ba7cccbbf7872119ed0eb7
SHA1 623cf4a25e2a5ca51a4506b287f9ff9d786bc7cf
SHA512 b5aa699fb69a56db217ab044bad17cd4aeb5317cca4a102dfb8f8dea74bff2c9a0a9a9fae37c7231ce5d1b95bccbcfb7f03356c27bb5bba3de10cfa0347359a7
SSDEEP 768:4kojFmSyWcjFmefyZWfhyFd8Api1R39bAj7yPn1r6NHFd8ApiKR39bAj7yPn1r6h:BojFmSyWcjFmefyZWfhyFd8Api1R39bt
TLSH
T1E4C2BE1AABED1509F9B2E9358EF0C42B5223BD926D78CD1D01AC1F4D0737A40E866F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 38KB
SHA256 aea8935e721c7b9ca631a703214a53eaab52eade8fd829b238d7e57587273b21
MD5 5c9064c313b6d68ed9c15ea5e44f901e
SHA1 b862e1ac6f97c6a12198b1c27975278813cd423a
SHA512 e62076a05115100b59205ddd0feff7dd14a742d39880710b949f6dc7b2535f716ce896cd5bb7aa270dc41fcfc1ab6a711399cf1f5d025260449540ed7d4493df
SSDEEP 768:sr50yW0jFmoyZWfPR39bAj7yPn1r6NuWKFd8ApiKR39bAj7yPn1r6NtjFmehW8F2:sr50yW0jFmoyZWfPR39bAj7yPn1r6Nu1
TLSH
T12503805AABED0609F5B29A359EF0841B9123BC936D78CE1C01AC0F4D1737A44E877F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 35KB
SHA256 c5c0ace0d1218ec763e28271ff375cbd681b54cb7949b951b0f6685cff2ca386
MD5 6df90af6d144bfacdf323096c7fb8911
SHA1 dc9ebbbe7e49e0584dfe091940f37eec1b20ef94
SHA512 9d0320f85fc51916f0ec85e152058ceea401d51a20628d8157057867496fde2b199a149e694fa75ed53f4b6190ce31d0e06a4dd459fea2b854ae79ff7136da63
SSDEEP 768:BrAwAWXjFm2yZWfPR39bAj7yPn1r6NuWKFd8ApiKR39bAj7yPn1r6NtjFmehW8FW:BrAwAWXjFm2yZWfPR39bAj7yPn1r6NuV
TLSH
T1AEF2815AABED0609F5B29A359EF0841B9223BC936D78CD1C01AC0F4D1737A44F866F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 35KB
SHA256 394f5f1bef3808ada7b323c734bf06b5e1f4a1b38db940982d4793a9ba10fa9e
MD5 4a00f81955eb3ecd00f25956fda1e4ee
SHA1 b763f29c5e8425527a6c7870c342f443a21b914c
SHA512 06525151e9684f6cbe1960c27fa87d41be29eb34397f6f092488b36f0e912579472afde15cdb7a7837bae828184007e28b19a3ff8555eb9868f2051d109c09a6
SSDEEP 768:RrAm/WXjFm2yZWfPR39bAj7yPn1r6NuWKFd8ApiKR39bAj7yPn1r6NtjFmehW8FW:RrAm/WXjFm2yZWfPR39bAj7yPn1r6NuV
TLSH
T1AFF2815AABED0609F5B29A359EF0841B9223BC936D78CD1C01AC0F4D1737A44F866F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 42KB
SHA256 b7e72a9ab8738882835fec9389845e353044c116c8d12b5d5b7a54b8a37d7211
MD5 a5ba3e1174cb780d38f4e628b6d8767c
SHA1 dff27256ea708c1bc618a48ae27a4298ef05ff23
SHA512 e052e14b005f1191470339891a37fd4b2aa39e00e0ffd611450fbc60b138cbe9a7d48fa7db56a09be3c8be03317d700c5e06a1bfd29ebd1d28d74e82e4c7f921
SSDEEP 768:Vr2S/WEjFm2yZWfPR39bAj7yPn1r6NuWKFd8ApiKR39bAj7yPn1r6NtjFmehW8FE:Vr2S/WEjFm2yZWfPR39bAj7yPn1r6NuH
TLSH
T1ED13805AABED0609F5B29A359EF0841B9123BC936D78CE5C01AC0F4C1737A44F876F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 23KB
SHA256 d911ffd2c1f5daf19f0e6774fe4576dfd68f2eb14f208c5a35a2e4e62e85a01f
MD5 3ceff2d4213dc7f43d7f849e366d7dc6
SHA1 e144d307bf5972f62aa4d93038ec5548817719d8
SHA512 61f93b368bd17b674875f01c5bc6de744cb19ba14126ad6e2e98113143bf7e849c46fcb7241911f05d510267a88dece2a99c608fbefb37795ae617fe7fe145e3
SSDEEP 192:uGtxg0kH0kUC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFS:uGtxg0i0B8k0Vqs00l02Lg4UXuS
TLSH
T1AAB25D10B7E96814FDB2B9708FF8D43AA7237A950D79CC3E406C964E4773940B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 8a8f7550f5a11b59b974dc006ec73f7262c5b9fe18b8eaeb2b75cb3ea2901b1d
MD5 52e114813d883a8b42f1ee9463863adf
SHA1 0c0d5398e8ffc796dfbfcd32876dfc70c010e165
SHA512 511a9b57fb36f150d6189a5f460980680c488a890da9fa602fa229d6786f567ff91d534621e16ca30e0263ddc03bdb5c0c517c846dae50555663854470775e3a
SSDEEP 192:78Q0kakmiC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFr5L:78Q0ty8k0Vqs00l02Lg4UXuFL
TLSH
T116B27E1177E92818FDB3B9708FF8D43AA7237A951D79CC2E406C964E4773940B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 73147f059e5a0f01c970c585b4f33cd10dc69833f802817fa19f86d9020a4a1a
MD5 4017ae66ed841c57f3aea02cce7767b7
SHA1 90eb6e0e316d15b6efede9733aefdd5ec504d707
SHA512 bddbfd43f9e75d4823baa87920d1dbceda31217bf8b716ccdbe80bbc70a85248c1199d461ac3deabfb80ec669f2a6b918d3a49389069e5c5610671038e6e55cb
SSDEEP 192:78Q0kakmiC3FRk+FJqy3F00k2F6F2LmFP23FUkEYFr5L:78Q0ty8RVqs00l02Lg4UXuFL
TLSH
T179B27D1177E92818FDB3B9708FF8D42BA7237A951D38CC2E406C964E4773944B9A2736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 067eda34afc72ed4b7ba918787ce58788286c449b0201d68bc015482356c7c5f
MD5 50a43768f7742092e934c4ccb3ce13ae
SHA1 42ed5d10fbfe86500b440a2c60f3c294e807d286
SHA512 fbdd6d8da65f53c872eb340191284c577ef00a3679d4803bea8910a1c7e64ae51f9d4477caca7b798ebfe3fda4d32bd565b68d110f76054a28b9e7b7af566e36
SSDEEP 192:sO8Q0kakmiC3FMxFkqy3F00k2F6F2LmFP23FUkEYFr5L:sO8Q0ty8M8qs00l02Lg4UXuFL
TLSH
T15FB28D1177E92818FDB3B9708FF8D42BA7237A951D38CC2E406C964E4773944B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 54f238547903be63ac7de8cedce0fde16c28037b89f21176fd53030e67e84f50
MD5 7cedfc6edb70423885c2dd6cb0dff2fe
SHA1 06826b736450b94774b0a38ab920de8b5b7dfb4e
SHA512 3a03484acba1b50eb110336fa40f4fd32adc95658d0f6d7e73464ac613ec3b2f4474ab839e2e8c610f4a6296055a0eb2eb636c1d174bb6f9f9027f52658074ba
SSDEEP 192:L8Q0kakmiC3F0QFYqy3F00k2F6F2LmFP23FUkEYFr5L:L8Q0ty80rqs00l02Lg4UXuFL
TLSH
T1E1B29D1177E92818FDB3B9708FF8D42BA7237A951D38CC2E406C964E4773944B9A2736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 301f99a665dc8b91f26600594bd1c32c9e9829ff3a26fdc24e32f54ea7f7eff1
MD5 f69227d9571a2c68f87f40a3a7651f41
SHA1 5d9a65f8f90c917ae86744b042cd78e863229990
SHA512 e392e5f153f718649e847106e597b9ba4c433bc59a54b2f71d095e532b4f3c48c89bc6b26b3846ed4012b6f055421f694920dbbfa41ed1bf4862f41a4ddf4f4a
SSDEEP 192:78Q0kakmiC3FXvF0qy3F00k2F6F2LmFP23FUkEYFr5L:78Q0ty8XCqs00l02Lg4UXuFL
TLSH
T111B2AD1177E92818FDB3B9708FF8D42BA7237A951D38CC2E406C964E4773944B9A2736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgentConfig.xml

Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
Size 5KB
SHA256 3095a5788fb558663ccaff45284b0f18eb7cc1de2ee58529a9aede002bcdec5c
MD5 1419e6d7218d2a92ed9a8e2af7b07aee
SHA1 95631d7a58caf89d92e3b87286a892b84a928f1a
SHA512 1730b0bd4aae946b827f37b41a8c645cd70e94e3c87e81423ad6b2d3b7fab5ff042743cfa86c3514992d118ae43b58a1c76cb2c9258d4344eb3c924a6c3b13bf
SSDEEP 96:JRAVjGg/0vpmmzTu6eBpWxNB9LP1edjA6RQJAhFuLv9bLbqq86Ol3Ov7WPIbDE6W:/+qg/KpGK7B9L47SJAyz9bP2607P6GaE
TLSH
T1F3C17A3429EF5029B1B3BF964BD475DBE96EF67336066069105203874713E42EEC253E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9aec4.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI9aec4.LOG
Size 1KB
SHA256 ee3f5de0c7e6567e3bd15c25c16060e5e61bbe5723e0899eae941035dc2ec71f
MD5 f93fe2d97ba98c113faf80eb2caeea50
SHA1 4ece55668bbfb45acd6a20f1a2e080c4eb9d7ff6
SHA512 dbbd129a561a83eea4bf4989b8c6b4ef2882ad628c923806aefab7d625330ca4e5cf9eef278df024cf0cb78a406fb918e1f67ce327dae8ec8f860626034577ff
TLSH
T13C31E8F52BD50805B1F61747EDF7C4621F73FCE9A874DB0C23488219066BD0999B836A
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud Agent_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
Size 9.5MB
SHA256 84e43b8701ebe55d6bb66e84c7f1f25644c19a42d363c00ac416a5ebe4b86a6d
MD5 19a623a0c60e65db4b5b6577f1fb61cc
SHA1 b4e1da3953a36d6116d9e8a053b94a23f873d66e
SHA512 927fb2ef2c882fb2912c075036d1d766cb990658e203d480e7e6593776e63195b21a089fed445d87c44126b6732a72ff9e1be7206661050b1f15c1fc66dab278
SSDEEP 196608:KisGNpFZNJHRXNJpVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:yGNpFZPHRdln+X1BXy6hqc0g0kuAgJ1B
TLSH
T1AAA6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imaging Client_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
Size 3.3MB
SHA256 02727c4ddb1b66345c5c8f501f3ab8e47c4feb72d573c69c5b7825351e8b29e4
MD5 d1c2ac74383291045f1980574c07766e
SHA1 a63c0b125185fb3c7c186a184a6647fab1e6bb1a
SHA512 b8196cf246dc2a9d9003147b11c4fd2492f917892c53c4183192b104b2cac07c597896317552abbb352dbae716297e229a7f4ff7803e2993e9569c3973ffa48e
SSDEEP 98304:BxW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:rIL3Bm8yYdS12plWa
TLSH
T124F5F0117790C13AE0AE06B268689375452DFC314B38E5CBF3C99A6E2DB16D29F31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Software Updater_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
Size 8.6MB
SHA256 51757dc19be4bd4b0fcc8c29d55ff7aaace9b5faba13e4dda0938cdea6d90dfb
MD5 c06698af723067bfc985a505f4ef543c
SHA1 91e6e2aa18a83221f747989538a486e44216b037
SHA512 0dc9b1604da80af585d02c14fa5376e9c2e1a8b8b1eaa01a3e239ddbb464d4a023d055537b240661b1c93e6e5f3312858d025c59c7ba2ed91ee2ef1cf173c0a7
SSDEEP 196608:b6N+sCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:mbn5tTl8hKlaCC
TLSH
T14696E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Usage Stats_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
Size 4.4MB
SHA256 c4bcfaa3361134ac31179dfbc7f565b7146e96c91f8e4cd60c8bd0bb232abdbc
MD5 7bfaabc018d3e0bcf1fddb7e8627f3be
SHA1 533cf2af9b75351e86a28ef6daede9eac7d9dc4a
SHA512 a1ff7887232bf284ecf704797e360c96f8a74cc9a0024082c4cf6804062d1974030ab900a62cd07975e8886affb2ec7e838d55c568110d472c04ece56e973563
SSDEEP 98304:jSbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:+Ff61+zZBENjYM2qXAns
TLSH
T124260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB481.tmp

Path C:\Windows\Installer\MSIB481.tmp
Size 57KB
SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
MD5 d480853146cffda8e468cc4d2751b405
SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
TLSH
T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBAFA.tmp

Path C:\Windows\Installer\MSIBAFA.tmp
Size 138KB
SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
MD5 b96cc173298220d17aa0932bf3047727
SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
TLSH
T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBB69.tmp

Path C:\Windows\Installer\MSIBB69.tmp
Size 1.1MB
SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
MD5 4cd4d7ccba93300d456b696e8ec502c5
SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
TLSH
T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIED7C.tmp

Path C:\Windows\Installer\MSIED7C.tmp
Size 147KB
SHA256 8ea9e3b1bcde24b779bf93d9c622239b4a7f28b733be9dd653fec4ec751f882d
MD5 b6ba4cd0f36e944b8f857887bfdb9ddb
SHA1 29dcce4205ce8c7a68e5da237ddf6a7d91593b20
SHA512 6eb18ffef9364eca2988d93d3f194aa590d23d7c02bffbfae4d5a12186586c871fe20b9128f754e7ab60660390240508aefb5363f841a308fd0fadaec5855abd
SSDEEP 3072:nUIB3+oXlkPUdTDq3SeMzGFpJ1bbFy85nVi:ULAlkPOTDESes4DbgCV
TLSH
T1AAE34A1172E4C176E2BB2A385E7987364A6BBC618F7095CF6B940E3E5E306C0DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Products.ini

Path C:\Windows\Products.ini
Size 380B
SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
MD5 6c310b6e27c949b929a3843d57c8ba37
SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
TLSH
T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
MD5 SHA1 SHA512 TLSH

Submit Download