ad181287bf37dd398c92b33d9ff655c88cb54b02f1567d0d1cf69e84f0168094

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AdobeInstaller.exe
Size 76.4MB
Sample260810-plgk3aycrd
SHA256 ad181287bf37dd398c92b33d9ff655c88cb54b02f1567d0d1cf69e84f0168094
MD5 f5bf06e0954d31b3906e728b6f882e55
SHA1 e47bb6637c856778c230f86edd1b37d73557ba4a
SHA512 83bd2a75ed5ff4254608263d3c0f6b6d7acefd4112e6e6c42b236440b313e094ca211de9cc988bbeeabdfdf5117381aaff2cc2554582b0a613af5ac6b49efba3
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovp9:9iLVelepClAy6uw3W0BEROh2nvvL
TLSH
T11C08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
31	3272	ModulesUpgradeMgr.exe
31	3272	ModulesUpgradeMgr.exe

Executes dropped EXE 12 IoCs

pid	Process
3912	FWAInstallMonitor.exe
2480	FWAService.exe
3272	ModulesUpgradeMgr.exe
4956	SUDLLUpdaterPatch.exe
3432	SUDLLUpdaterPatch.exe
2496	FTAgentTmp.exe
2516	FTAgent.exe
1812	FWAService.exe
408	FWA_UI_Agent.exe
1460	FWAInstallMonitor.exe
3676	ModulesUpgradeMgr.exe
3804	FWA_UI_Agent.exe

Loads dropped DLL 22 IoCs

pid	Process
964	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
3400	MsiExec.exe
752	regsvr32.exe
3400	MsiExec.exe
3400	MsiExec.exe
3400	MsiExec.exe
3400	MsiExec.exe
4016	regsvr32.exe
3400	MsiExec.exe
4944	Process not Found
3400	MsiExec.exe
3400	MsiExec.exe
3400	MsiExec.exe
3400	MsiExec.exe
964	MsiExec.exe
1812	FWAService.exe
1812	FWAService.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AdobeInstaller.exe\" -r"	AdobeInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AdobeInstaller.exe\" -r"	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FaronicsTicketing = "C:\\ProgramData\\Faronics\\StorageSpace\\FWA\\modules\\FTAgent.exe"	FTAgentTmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\E:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	Msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File created	C:\Windows\system32\wbem\AutoRecover\AAF97DF8955A0A044709078E6305D4FE.mof	mofcomp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399	FWAService.exe
File created	C:\Windows\system32\wbem\AutoRecover\1814E26C1E25849B8396DBC50D93D010.mof	mofcomp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BC2CC0A899B13419B010C5F42995E7FF	FWAService.exe
File created	C:\Windows\system32\wbem\AutoRecover\48CEEC55102547DB8D2945999C51BC92.mof	mofcomp.exe
File created	C:\Windows\system32\wbem\AutoRecover\1C29FC8FA2CF87E04D41BFB25C6A2483.mof	mofcomp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_C1A41D5D7C8988E93E0A1E0DF528ADB1	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_8D9F064440398521BA9116339D131399	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BC2CC0A899B13419B010C5F42995E7FF	FWAService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_FDA5B48150D0FCAF7FF7B29F2E7B2C5D	FWAService.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll	msiexec.exe
File created	C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe	msiexec.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58361e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI746B.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D76.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0D326B4C-1102-4C69-8266-7323C701B45C}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7207.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3709.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77E9.tmp	msiexec.exe
File created	C:\Windows\Installer\e583622.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7322.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3214.tmp	msiexec.exe
File created	C:\Windows\Installer\e58361e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A56.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AA6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D18.tmp	msiexec.exe
File created	C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7576.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E69.tmp	msiexec.exe
File opened for modification	C:\Windows\Products.ini	AdobeInstaller.exe
File opened for modification	C:\Windows\Installer\{0D326B4C-1102-4C69-8266-7323C701B45C}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Products.ini	AdobeInstaller.exe
File opened for modification	C:\Windows\Installer\MSI694A.tmp	msiexec.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3996	cmd.exe
4960	cmd.exe
1816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTAgentTmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWA_UI_Agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SUDLLUpdaterPatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mofcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModulesUpgradeMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ModulesUpgradeMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SUDLLUpdaterPatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWA_UI_Agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5036	taskkill.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	FWAService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	FWAService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	FWAService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name = "EPSYDAFZ"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "false"	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo = "https://www.faronicsdeploy.com/\|4E49AECE-BD3E-47DD-B2CD-EDC9ED362151\|2\|2\|FWASUCIMGUSC\|\|1786306094\|0\|\|"	ModulesUpgradeMgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS\ProxyEnabled = "0"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "4E49AECEBD3E47DDB2CDEDC9ED362151"	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	ModulesUpgradeMgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "4E49AECEBD3E47DDB2CDEDC9ED362151"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	ModulesUpgradeMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2"	ModulesUpgradeMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Faronics\\Faronics Deploy Agent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	AdobeInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FEE93EA4-7276-4010-9EEB-318186C4521B}\ = "StorageSpaces"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\ = "FaronicsStorageSpace Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4B623D0201196C4286637327C104BC5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true"	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://www.faronicsdeploy.com/"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	ModulesUpgradeMgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\ProductIcon = "C:\\Windows\\Installer\\{0D326B4C-1102-4C69-8266-7323C701B45C}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\PackageName = "Cloud Agent_C64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ProductInstaller\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\LastModuleUpdateTime = "2026-08-10 13:29:27.078"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}\InprocServer32\ = "C:\\PROGRA~2\\Faronics\\FARONI~1\\FWAWMI~1.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	AdobeInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9022825-AEEE-4AF6-87C0-4BCE6608DCCB}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4B623D0201196C4286637327C104BC5\Storagespace = "FaronicsWebAgentInstall"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://www.faronicsdeploy.com/"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\656DAC6F8F5EE71498F0F80A3C2EA66D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}	AdobeInstaller.exe
Key created	\REGISTRY\MACHINE\Software\classes\WOW6432Node\CLSID\{83FAD298-BEB5-44BE-9756-5CDB2D2304CC}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}\FWA_PROXY_SETTINGS	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID = "00000000000000000000EEAAB15450A7"	FWAService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace.1\CLSID\ = "{CA220945-0674-4494-B122-93EF5A4A6345}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy	ModulesUpgradeMgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4B623D0201196C4286637327C104BC5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ProductInstaller\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version	AdobeInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StorageSpaces.FaronicsStorageSpace\CurVer\ = "StorageSpaces.FaronicsStorageSpace.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA220945-0674-4494-B122-93EF5A4A6345}\AppID = "{{FEE93EA4-7276-4010-9EEB-318186C4521B}}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D5460976-987D-4418-AA5E-BD3497AD2DC7}	MsiExec.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FWAService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	FWAService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	FWAService.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2200	schtasks.exe
912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4812	msiexec.exe
4812	msiexec.exe
2496	FTAgentTmp.exe
2496	FTAgentTmp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2428	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	2428	Msiexec.exe
Token: SeSecurityPrivilege	4812	msiexec.exe
Token: SeCreateTokenPrivilege	2428	Msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2428	Msiexec.exe
Token: SeLockMemoryPrivilege	2428	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	2428	Msiexec.exe
Token: SeMachineAccountPrivilege	2428	Msiexec.exe
Token: SeTcbPrivilege	2428	Msiexec.exe
Token: SeSecurityPrivilege	2428	Msiexec.exe
Token: SeTakeOwnershipPrivilege	2428	Msiexec.exe
Token: SeLoadDriverPrivilege	2428	Msiexec.exe
Token: SeSystemProfilePrivilege	2428	Msiexec.exe
Token: SeSystemtimePrivilege	2428	Msiexec.exe
Token: SeProfSingleProcessPrivilege	2428	Msiexec.exe
Token: SeIncBasePriorityPrivilege	2428	Msiexec.exe
Token: SeCreatePagefilePrivilege	2428	Msiexec.exe
Token: SeCreatePermanentPrivilege	2428	Msiexec.exe
Token: SeBackupPrivilege	2428	Msiexec.exe
Token: SeRestorePrivilege	2428	Msiexec.exe
Token: SeShutdownPrivilege	2428	Msiexec.exe
Token: SeDebugPrivilege	2428	Msiexec.exe
Token: SeAuditPrivilege	2428	Msiexec.exe
Token: SeSystemEnvironmentPrivilege	2428	Msiexec.exe
Token: SeChangeNotifyPrivilege	2428	Msiexec.exe
Token: SeRemoteShutdownPrivilege	2428	Msiexec.exe
Token: SeUndockPrivilege	2428	Msiexec.exe
Token: SeSyncAgentPrivilege	2428	Msiexec.exe
Token: SeEnableDelegationPrivilege	2428	Msiexec.exe
Token: SeManageVolumePrivilege	2428	Msiexec.exe
Token: SeImpersonatePrivilege	2428	Msiexec.exe
Token: SeCreateGlobalPrivilege	2428	Msiexec.exe
Token: SeRestorePrivilege	4812	msiexec.exe
Token: SeTakeOwnershipPrivilege	4812	msiexec.exe
Token: SeRestorePrivilege	4812	msiexec.exe
Token: SeTakeOwnershipPrivilege	4812	msiexec.exe
Token: SeRestorePrivilege	4812	msiexec.exe
Token: SeTakeOwnershipPrivilege	4812	msiexec.exe
Token: SeRestorePrivilege	4812	msiexec.exe
Token: SeTakeOwnershipPrivilege	4812	msiexec.exe
Token: SeRestorePrivilege	4812	msiexec.exe
Token: SeTakeOwnershipPrivilege	4812	msiexec.exe
Token: SeIncreaseQuotaPrivilege	964	MsiExec.exe
Token: SeSecurityPrivilege	964	MsiExec.exe
Token: SeTakeOwnershipPrivilege	964	MsiExec.exe
Token: SeLoadDriverPrivilege	964	MsiExec.exe
Token: SeSystemProfilePrivilege	964	MsiExec.exe
Token: SeSystemtimePrivilege	964	MsiExec.exe
Token: SeProfSingleProcessPrivilege	964	MsiExec.exe
Token: SeIncBasePriorityPrivilege	964	MsiExec.exe
Token: SeCreatePagefilePrivilege	964	MsiExec.exe
Token: SeBackupPrivilege	964	MsiExec.exe
Token: SeRestorePrivilege	964	MsiExec.exe
Token: SeShutdownPrivilege	964	MsiExec.exe
Token: SeDebugPrivilege	964	MsiExec.exe
Token: SeSystemEnvironmentPrivilege	964	MsiExec.exe
Token: SeRemoteShutdownPrivilege	964	MsiExec.exe
Token: SeUndockPrivilege	964	MsiExec.exe
Token: SeManageVolumePrivilege	964	MsiExec.exe
Token: 33	964	MsiExec.exe
Token: 34	964	MsiExec.exe
Token: 35	964	MsiExec.exe
Token: 36	964	MsiExec.exe
Token: SeRestorePrivilege	4812	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	FWAInstallMonitor.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2428	3976	AdobeInstaller.exe	86
PID 4812 wrote to memory of 964	4812	msiexec.exe	90
PID 964 wrote to memory of 5036	964	MsiExec.exe	93
PID 1952 wrote to memory of 3184	1952	AdobeInstaller.exe	95
PID 964 wrote to memory of 3912	964	MsiExec.exe	96
PID 4812 wrote to memory of 3400	4812	msiexec.exe	98
PID 3400 wrote to memory of 1804	3400	MsiExec.exe	99
PID 3400 wrote to memory of 1328	3400	MsiExec.exe	101
PID 3400 wrote to memory of 3052	3400	MsiExec.exe	103
PID 3400 wrote to memory of 752	3400	MsiExec.exe	105
PID 3400 wrote to memory of 5004	3400	MsiExec.exe	106
PID 3400 wrote to memory of 4016	3400	MsiExec.exe	108
PID 4812 wrote to memory of 3272	4812	msiexec.exe	112
PID 3272 wrote to memory of 4956	3272	ModulesUpgradeMgr.exe	121
PID 4956 wrote to memory of 3432	4956	SUDLLUpdaterPatch.exe	123
PID 4812 wrote to memory of 2496	4812	msiexec.exe	125
PID 2496 wrote to memory of 2516	2496	FTAgentTmp.exe	126
PID 3400 wrote to memory of 2200	3400	MsiExec.exe	128
PID 3912 wrote to memory of 3996	3912	FWAInstallMonitor.exe	132
PID 3996 wrote to memory of 2308	3996	cmd.exe	134
PID 3996 wrote to memory of 912	3996	cmd.exe	135
PID 3976 wrote to memory of 4784	3976	AdobeInstaller.exe	138
PID 3976 wrote to memory of 1924	3976	AdobeInstaller.exe	139
PID 3976 wrote to memory of 2024	3976	AdobeInstaller.exe	140
PID 1812 wrote to memory of 3676	1812	FWAService.exe	141
PID 1812 wrote to memory of 3804	1812	FWAService.exe	143
PID 3912 wrote to memory of 4960	3912	FWAInstallMonitor.exe	144
PID 4960 wrote to memory of 3760	4960	cmd.exe	146
PID 3912 wrote to memory of 1816	3912	FWAInstallMonitor.exe	147
PID 1816 wrote to memory of 1796	1816	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\AdobeInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\AdobeInstaller.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4784
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1205838E3CF0DBE7EEE12D9A1BFE1136
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM FWAInstallMonitor.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5036
- - C:\ProgramData\FWAInstallMonitor.exe
    "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 964
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU System /tn LaunchStartUpFWAInstallHelper /tr "\"C:\ProgramData\FWAInstallMonitor.exe\" /StartMonitorAtStartUp 5 /MsiPath C:\Users\Admin\AppData\Local\Temp\FaronicsDeployAgent.msi" /sc onstart
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchFWACleanupHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C0571B74571AD593C8C13C0AE6BD928A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1804
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1328
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3052
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:752
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:5004
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4016
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU System /SC ONSTART /tn FWASvcHelperMonitortask /tr "'C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe' /CHECKSVCHEALTH" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2200
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\\" LaunchFromInstaller
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe
    "C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe
      "C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe" -installProgress
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3432
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
    C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2516

C:\Users\Admin\AppData\Local\Temp\AdobeInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\AdobeInstaller.exe" -r
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:3184

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3676
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
  "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3804

C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:408

C:\ProgramData\FWAInstallMonitor.exe
"C:\ProgramData\FWAInstallMonitor.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e583621.rbs

Path C:\Config.Msi\e583621.rbs
Size 2.3MB
SHA256 8e92676e86762e001acc6053ad4679d365b628682287ead3f26524d5ba0f8f5c
MD5 79595aa9a67fcc7d471fd0b6b6b889bd
SHA1 4e359776517f279d694bfe731b4ec5f316dc6f26
SHA512 f1d2c815819c7a032120f837a18d17925525cc54d4286118ba40f710aa150c77126d38389b6b899a67590458f5db03feefe7815b141af8d0035f56436f3f7326
SSDEEP 49152:j7DIW7GnW/+Ee7pINUcbO0sSwqbLcgO3LinW7GnW/+Ee7pINUcbO0sSwqbLcgO36:/GnW/7e7pSJ+SwKyGnW/7e7pSJ+SwKx
TLSH
T1F4B56C2177ECC236F6EF16B0AE39566A043EB9710F3081CBE384995E5D706D29A3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FRCServer.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
Size 1.8MB
SHA256 bffc018b68ef16b4fea63ab34d1cf0a9878f7fb3c8a67d598c166416e1d649a9
MD5 77e663d9c4963989f3d27b7f67d1cfeb
SHA1 7965180f011d1a57105c7ffc4c1b7452f6276246
SHA512 cd5f4e599a84f8caa137d62f98b33a72c73f5564e5a52d38b10179722fc4f4b8b47ee7b649c4f6fcfbcd5031d557f7cea3f7e3c58b6e907b68545c790a585426
SSDEEP 49152:nga5x2H/+IfovtLc8pbsOApAQfCQqDQDFNh87b8ZN0VZd9oUhdQVAMIg8o:Z2H/JfcbbsFAQf3qDSFNh87b8ftUhd2r
TLSH
T1E0958D32F6A19077D573323086D9A3B9A6BEB6701F35424B56904F3D2E344D29A3873B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FSSInstaller.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe
Size 409KB
SHA256 17743d623e6233b1eae704029e727be95e6ef60de9e50beeb9ece73fc0491f05
MD5 e7c5ee0932aaddfd28698a2d1c1e83cf
SHA1 c1018872090152063d0d18a1f67c9abade653386
SHA512 10df9e681263f5b657d83b208e9f1ef92aa633565506947644eb2f9d520847bb52dd43cc724bca1f0f063adb3b23ed269af4d7eabff28adf146b802f4a525c53
SSDEEP 12288:2gOpS6b5K+zeXnSdDZTiejq4++51JeXmnsS8/3fD:kr4+zeXngFmejqT6JeXmnsS8vL
TLSH
T1EC944A20B7D8D035F1B31A71AFB6D7764479B9A04B7091CFA3D4096A1EB0AD1C93272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTAgentTmp.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
Size 348KB
SHA256 378734ead0ab162de6a49fc35e31e04b8f2908abb371e61864ef4699fd2b2191
MD5 6eeb9d0eba24458e43de4bc3dd2f0e26
SHA1 fecc7adedf688b1beff31194f49ba5a66525bf8f
SHA512 270017cc32096a06cce3474d3d13f26fe8083d2240aaa96cd7ce55197ae7ff9bf432014739dac9215be01c0ff264673b7b2ec008144cd4053849d3617d7180f2
SSDEEP 6144:wbjvvXO3l+tUfbLTH/00HAhp5JzSmz1X34cvSGX:wfv4+tU3bVAPzSmzFrxX
TLSH
T1E674192122E48432F6AE17719A79D7A5493ABC701B7091EFE39479395D306C38E3272F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAMigrator.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll
Size 409KB
SHA256 16f38d265c199915637f57b69d52dbe788fdef9bb069bff498ef1e0ef5365e5b
MD5 d19e0a1640cd0e581d17ca4f8cafee3e
SHA1 0f729c747a9fc92e12e431d5bfe3feee0db0b2c0
SHA512 6cf366c5f5c8242b82cf1afc3173fb82af820a266f92ce383bbc0dfcf076a9a54a4bc930a8856928bb4f852e1ca825a66db84460b9f8e91bf262ad5487044caf
SSDEEP 6144:I3JuKF15GIDpbD13wvrlqr8EiTtFwVlwTMGLJmhV7d9+dfXh22AeeZ:kJuKFDBDpklqQEiTtMGLIhV7+dfA2Jw
TLSH
T1D5948D2277D5C136D89F10B4BA7A976A0579B4F00B2956C3F7E88A2F4F706C2973520B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAService.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
Size 489KB
SHA256 9769f3949ba8b5d7c3350bf259be87730de34acc89adc7098f9d8daa78e03071
MD5 e32df651f40f2b4a168d8ed46eb915cf
SHA1 40d61b9fa843e6d4d1bf688c9fd922a268b5cf96
SHA512 8616dd679cf7676b31cac94666e731326b56e5ba5f5f166650874ae61dddd5bd61d75efb8ad82d7f02ea16df82626e23cd4d7c54730d8d049ae0760e416c3264
SSDEEP 12288:DeiZxEe6DKMU1FeaAY1KWAlPVW2CHjxf9XqZ1Y:De/uJFe21KBW2CHNf9XqZK
TLSH
T11BB42710B7E9C129F5F31670AE7A862A487ABCA25F3482CF63D40D5D4D70EC18A76727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWAWmiProvider.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll
Size 171KB
SHA256 4ffa7e291d9ce9fac6ddd5de6fa32ac65c47c8c01317c55eea5065ff82a63442
MD5 2ca6508cbe51e8a14089c946532bc802
SHA1 542d94e2972ab6cf3d5e6a91c78b8b226f08f60f
SHA512 7a85c1ca19e5d4f031bbb39ec37ddba2a5c48f8695eccfd71042306fe624216eecbaf2b2027970aa3386b0205c7f00038eec93a01d2b8c97dab85773e6289daf
SSDEEP 3072:/wXWbfhkZPjz8Y0HWFljyQVB9loWDXu6cD9dwsv:/wDPj82FRyMB9loWruJJJv
TLSH
T1C5045B2177D4C136FAEA263999348A6A653F7C614FB4C1CBB3984E2D5DB02C05B3532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWA_UI_Agent.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
Size 388KB
SHA256 21ed2bbfc2af29005d9bb38a7d5ac290a5294c336a8ce45e19312706a243ada4
MD5 86ab0039ee5399676176a3300f76a9a7
SHA1 75d3afd2a1aaeb49c9d588085807152e2766d3e0
SHA512 72b9f81d8a917e0c044794b46222c6a58cf98814d3eb0bc33367d50c5a4298c3f5638c1f35bec35f06f8988db3778b85936ce39ee2be079972e82d7a71c38d25
SSDEEP 12288:rqC6BYrwL0X+wp2Me+gJaCYDDmQMrwenMH:GCgYrwQX+Oe+g6H
TLSH
T1698428AC36A4C072E35607344D69D6AD56297C350B7084CBB3D4BB7EAB70AD39D3231A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FarWsClient.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll
Size 1.9MB
SHA256 b7f1a65f41005424fd903bab57fa3e77733c43ebd5b5bfe47ff21e84ffdf8f2e
MD5 719577a0d9e5069fd11614aec74c306e
SHA1 293bfb1a02a02bff042c9d00839485db39e3a0eb
SHA512 63b8aadd0a6e18505cba2437d93a164bdbbd23f7a73250871309cfd0353754023ae08200243f3e95c9ac4d1cc50d3e4e4d96ca755fc16c23267ee866e894fd87
SSDEEP 49152:3OsaOacMhJf0zkDpUBXtPqZZKP/rcj5mvYn/1412:35EpUdtPqngr85l
TLSH
T13095BF12FB8185B2E5DE02786576ABBF493EAA104338C9D3DB903A69CC311D1673F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaronicsSA.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe
Size 687KB
SHA256 72d27a92b088420da85cba5accf133848755afab335fde2094d69ac57b4e9ab6
MD5 a160c77e50d73782473014f2a15d0439
SHA1 0788ddb95cd627b5c523d6753e4aa9197c562bdf
SHA512 0500345fc9bacf208463d77e7537baaf0fb6c6ba031d9f7e0c858e240af1a0532175b73d5045366800178c7ae0600a311c1f4ca0620d82349e8ec11b00c8dee4
SSDEEP 12288:vExBg4kHMm0IMH3etb44AxKfRakuZB5u8R3lp1:X4k123PcfRakUu81lp1
TLSH
T15CE46C2077E581B6F5B316B1AFB9976A543AFC210B3185CFA384492D1E70AE19E31337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FaronicsWebProduct.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof
Size 719B
SHA256 ad81deda391bacdb17148de21b56281308c557ef998bdbcda71186b786ac2503
MD5 7fa8d87869afb2f84d5ca36b9402a555
SHA1 7eaeb6ef29530cfa0b86c8ead2450cd2e7404e87
SHA512 3dff08d3becc8b0dd99e5c4569cfa22581f5e17575f83c68d753d4ae4b223f00a927d1fceed03d64c8729d800e98d0b851259f001c5355b63c9473a2897298b9
TLSH
T19301C0A1ADE7C032957A1DB2165999FBBE9E412CC32C0110BCBC8370230549B07BE8EE
MD5 SHA1 SHA512 TLSH

Submit Download

FaronicsWebProduct_v2.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof
Size 4KB
SHA256 1d3936d0973b63a09159e1f18227ffa34c0d7d5b4752ad1fa183dc1d6819ebd6
MD5 c2153986413b79d14ef7e88c38194a4c
SHA1 0261d8e1ff1a94d3d7f056d68c54b79e4fd3b699
SHA512 42cacd3e9926d13f766926e54761a23ac9a7b73aeec141a569da38fed9e98194098248256ad68160e3334204f814dd52fa2aed8908c00cb1406cb78a66dbea0f
SSDEEP 96:er94m6n/jCExTLrZ76wsnSZdNmPSdvXzvbcN:dddLrswYSZ3m0XzgN
TLSH
T1249141B5DB683923247682735B127BCAFF2D8219C3689462747F53422F3114A87BF1AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FwaCore.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll
Size 4.0MB
SHA256 15191574dde522a9c58fa108774d93023ac12be6ca7a66c6b2230956286282bc
MD5 abf25088ac8040fe62661659c272ab0a
SHA1 cb54884d7afb7f0eb0eef1e66a275acda610401e
SHA512 f9b85039d393e4e3485f09de2faedc0d6a1120cec2dcf5adb576fd436f4cfc463786f8564749633f79a6982628bc4f2e7d5e4799df076934c6c574140ae18208
SSDEEP 98304:VdwtZAvTEfdKsN8zhA954FDLo8TJwGTy2Kui:V6fwsNKH+ouO6z
TLSH
T178162911ABE58118F0FF26B17A7A97264877BC725B3089CFA3048C0D5971AC2D975B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MigrationHelper_32.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe
Size 142KB
SHA256 5e8888cf9c6deadde3c629cb42f8db81cdb2c7dc2c907fab740822c2ac12ff9e
MD5 ce818800c5d5b917fd46ac27e4830fb6
SHA1 f0aea752a02a82fa4980458aa0d348989b643c7a
SHA512 f8b341ac25233d338b6104f05cdd566036e9c4cd07389e57759f86d4fb44ad94fe1fefab835c1f21c9a4fe281074f54bf1e49a102054fecb9ae5d1cda4fa96f3
SSDEEP 3072:awDsGT6uUhgfMcNVZvvzgvLn045S7/5GnRMmwMJp3:aO69hgfMmnvzgvLnMAqmXP
TLSH
T1F7E37B213BD9C072E4B219319D7596EA593AF8328B75C0CF73884A294E707C1DA3977B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MigrationHelper_64.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe
Size 156KB
SHA256 4f88f9d7edb9d12e6e978d47367a9af1b3ae63aae725376302246ae4bef6eeab
MD5 c9a37b13b61cb93f54f9bf7e72c8f6bf
SHA1 9f4edf2ecd49082f90477d511abbbde2bd64547b
SHA512 6ac80f4989ebb03a9835f02252adc3bc838620215e1ceb75bd2cc2cbb7484421ff7e5fbc321c18a2b514e24c39ea32b4b93338492c8e7d1229d9d64789c98518
SSDEEP 3072:3KSksrX4h7+obDvxJ2TuBDgmd1o6JdiRDNC1oUjmdRA9:3KXsroh7TJ2TuBDvn6+jmc
TLSH
T14BF3292633E850B5E1B7927889B68A46F7B278524B31C3CF0324427E1E77AD19D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModulesUpgradeMgr.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
Size 675KB
SHA256 d9d176116043efb53969d74e5364ba0e65a0bf48d7b5ac5658a2489b999a853d
MD5 55739eac8811e08a08c1ae6170120387
SHA1 f2f226af74dae5f7a4c7f9112181acbfc41b64b9
SHA512 21b4f2c9f63e6362548d01c883faba38c7e2327a9eeecc7c9fc5898125481e7a01439aa54fc9dc8b90caa80df6ab8216bf1467c38a8bb6427aedd7ba3ed3e175
SSDEEP 12288:SQteMEYEkbxreqs3mVfdn+3ry9dOJs4v+z75zhAv:SQtBed0fdwy9dOq4v+z75hAv
TLSH
T1F9E47C2277E5C13AF5B211719E3E576A043BF8310B3295CBE3844A2D5EB06D29935B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotificationHelper.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe
Size 722KB
SHA256 438784b9444c41b1d1b30e2d9e3a4b49f2dbb5981c2c19a4bbb0da20b60058f0
MD5 477bce13a6a80fadae7e7e4cb5e0e654
SHA1 7fea419680129983f24e6be08259de3db5787916
SHA512 0488a61b5b189b0b03b69aca0f7ac2c0f2fee8f967969bef9df71de312255a9fb7251aeabb5713a23b171166e65ea7df4cbef0b1de8d55a2828100afc5d6df8b
SSDEEP 6144:GYSfJBPJfUuS6lnJqRSRAmij433jCriEgZePcXOKhku:GYSBBPd3lnJmftSjCeEgZgKhz
TLSH
T1E1F4E70273E8C1A5E0BFC6707C7D92A9CA267C790F3087CBB6447E2ED9256C29935356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenCapture.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe
Size 433KB
SHA256 0125d4b61056147b566a44c214e4c6ce931b3da411530d6d7b0e14307dd5918b
MD5 d33756f8294d4e52f5c9d924f2be7970
SHA1 1b8275e7efa5c030f25c685649b3183e5b071a1d
SHA512 d4424063ede5b6caca1634836ca955229abdeca5c0fdc9d5e17996fee5e59fcbca4b0337442d519503cefdf61cc22b483d862cae28c4b9a1c4b9f287d3c6b3e2
SSDEEP 6144:tsUIfJI4EvAjwbHdMMVjVLtEdLtHWyhjRwF1dKLHFuIFunFeay:uUIhI4obHHhRtEJmxKLPunFen
TLSH
T15A949D3276D1C036D4A612718E7AEB6904BAF4700B3155C7B7D90E6EAF706D29B3331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StorageSpaces.dll

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll
Size 309KB
SHA256 c7ad31e8e674c80393f318861faa97145d8dfe5643dcdf4a911f4a4ae5cbaa7d
MD5 7b57d1b3a0a70293cc9726995693f487
SHA1 707ee804ea36bc76ff2e3055c8c9a056041899fd
SHA512 e4aa4cec676375bc17b2b71d17ed55edfa6fdfd67873590cd04ffb81dc0d068f9fb017910ebca73ee394d20065fe89307d9eb51b2f7052f4de372de6ab2b7eaa
SSDEEP 6144:NqF/GnOMMIi7KkANz64RgnxOnynCy204Ut5zpnPQuHrg8MRB3F:89GOEkIpRgnxaymAVpnPQuLg8C3F
TLSH
T139644B20B7EA8139F5FB0A71A939866A043FBD610BB1C1CFE384595D1D716C39A3472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StorageSpaces.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof
Size 6KB
SHA256 835d7a0cc6a5b5828db951848deb043df0711f59875d2e8790d3bb39a8b3f390
MD5 acb011eebd496621b25036ad0368a792
SHA1 7c9ae920ae5b72627ea6578157a4a9837dc0e94a
SHA512 cab3410e52272eb729e2d52a09020029840bfa8ecb249e2850535d44c36e39f7d0d9e4495a53b7c48ef84ba4285007525b50d5edb5a9b3bf92d8aec1d0ec4098
SSDEEP 96:5LXV+qCTWFYkcm1zvdSnQlAHWRPOQlx1mB01lobLwaUzqSwps8Q/gIph:FFU0bcelSQpnIk
TLSH
T1DED19C03A3FD4A58F5F7AF489B7612305B3BBD4A593DD91D02A8040D09F2E80E9627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserNotificationHelper.exe

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe
Size 306KB
SHA256 cf75ba27e212c515ae69d08e6a90f801e7854d122957babd2c84bc179187cb7f
MD5 155ec492b09ffc3fc84f87da285424fa
SHA1 5adec3631019abdfc4c144fe471dc547610127f6
SHA512 c5ed784d21c42e6e6314394c45b346e1580425ec7be561b6589b08815badc0950b053f378a2396450bb45116bb8739a409cae5e0f3386509b854e5ee878c399f
SSDEEP 6144:KbbyjEF2dcgBbPc5ENcxllWymJygw5N+Rxm8jjU:kbSEqcgFc+N0StJygw5N+LPU
TLSH
T198640611B7F8852AF6F31B71ADB48269497BBCA25F7481CF6384096D4E30AC1CA75723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgent.mof

Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof
Size 14KB
SHA256 9010345865e39a11773936549afd0f10000a9c8d0cf55062e0fa90161c4557f0
MD5 b34207013b7a4ff05e150086df422de2
SHA1 5bcb95b9861b6b898b0d03a0ab26e66f00d1b704
SHA512 f1b316142c5054d7af260bfc2aa2efdbe1565a807e331f891b8c968cf27497aad4a33e613dc8b445cca69fd59a35f8aba0300fabecca97254c21e0421d63b9ed
SSDEEP 192:lFXMtf/Sg1Y19xQ/aci4dMqvF8KJEsOpXjcCR9V+k:lFXM1Y19mixUFdasFCR9VP
TLSH
T10A623602A3FA4648F1F66B48597A0571CA377D965D39DD2C02A8500D0AFFA44EDB1FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 6KB
SHA256 0807aee3cf73e67e7f322ce9c13e91706dfd4371c814dba168ca3cc81352bf41
MD5 2cdc442d021c035f9015c8565ca20423
SHA1 3a648afc85f780d4a44dfe6365a4fdf93c131d55
SHA512 9681e80934d3353562aa2d5b1385493341c26faa0034177b6cdbb4f6c1a09c1e4d29d064b309b503473edad686a061f5c92d2098c7737465d8e30f54202cd707
SSDEEP 192:wZ2to4ZQG1K19g2+S72+989P+S4+989O+St+989C+Sv+989i+SJ+9895+Ss+KJ93:cgrS7rimSZijSQiHSGinScisS9C3SMi0
TLSH
T148D11B4374D6202E2DBC66C146BBDA9DAF8646F8B28C36E47774713392CB50DC1A9B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 18KB
SHA256 390ff20fe9efd62f3835ed3bf980ec44493c4602c3c74455c506c36c7496c96a
MD5 25c6a890fb98df2655cff45c04a84366
SHA1 4bd26a87d48f2c9c6e6aa45d612b63350d25f170
SHA512 e6c8caeda09dacf0a9f59e6c083fa1a746b1f24060b1b340b463658e28604d731c65808b67a8b17d7da574a7db82d6e70cc12c241d710a65c9e1fa2adfec72db
SSDEEP 96:XxgQbhJWQPZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcB:hgIF2FcFsgMBFxC+
TLSH
T13D825A56BBE82419FDA2B5708FB9D43E6713BA910978CC3E40AC650E4773A04BA56336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 18KB
SHA256 2aafcb21cf743914440c23d682e8c054d1d056c0444683264511a887c580af4f
MD5 641171329ab6c6d781808315dbdf89b7
SHA1 acbabb9ebe1c65fb0331f56d7eaa9a0d12d7e236
SHA512 aca081eaadb54a5fc80414b2cdad86df8f4f8aeb72f8b73de99d6cac81a523e609ca4630e05ea3dbc6f51ec53079ac66d22a526d47130829ce9e85b47bfdfd4c
SSDEEP 96:txgQbhJW0PZFGPZFuw2PZFasjPcEsqBbhydBxgBWTkCfwexa/sZPZFxfA0fsjPcI:Lg0F2FcFsgMBFxv+
TLSH
T11D826C56BBE82419FDA2B5708FF9D43E6713BAD10978CC3E40AC650E4773A04BA56336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 26KB
SHA256 11986273fbafefcc97f7fba7b3814fdd298590cd2e4ff4394d6483bd5e0873b7
MD5 82fb5a5b93f822dc4f1d26bd985e02f0
SHA1 191177472b83d9a9cedaad64f217935d69a027c4
SHA512 0892b43b17f9eb7f19c3de5c950d142949bfd522513e75edb9103066aabc111d6ddd23576faa44d133bf60460a14437ce9ba4a464c09ea95d488ac01e0244697
SSDEEP 768:4TWFm7Fm7yFd8AhirmE39J6Bpyfn1r6NHFd8AhiSmE39J6Bpyfn1r6NHFmNWU:2WFm7Fm7yFd8AhiyE39J6Bpyfn1r6NHJ
TLSH
T10FC2C21AABEC1509F5B2A9358EF0C42B5623BD926D78CD1D01AC1F4D0B37A40F866F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 31KB
SHA256 afc4286473db51720a521931458e5a56bda972f0c1e5895c820526641a1dd873
MD5 0499544cc11695bd4e2c769133af9186
SHA1 fbb0be30fece5513ba2fb25a3575def5409330f2
SHA512 aade10b8c8a63f019f0149f77efe08d66518c1ab081ee375cb586586bc2a692a90ecf9142e771bb4ec2bee608a4def5e238cbedb865e2c24703d65be51c52c4d
SSDEEP 768:YvFmGFmSmE39J6Bpyfn1r6NbWKFd8AhiSmE39J6Bpyfn1r6NHFmNW8Fd8AhirmEl:YvFmGFmNE39J6Bpyfn1r6NbWKFd8Ahiv
TLSH
T154E2911AABEC1649F5B299358EF0C41B9623BD936D78CD1C01AC1F4D0B37A40E866F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 38KB
SHA256 2c1c628cbd86361785f6b383bc0bd2f495ba76763f7d4b216d9dda2c4e61595b
MD5 8421adf6500cdd9bb115be8bdb1b49e9
SHA1 784365a9bf79e00ef13660273d463566ec7dd323
SHA512 bb4f6912e558eb0523395f187eb339ff27754acc1cb3479ae9a7c6d9399a90907e14cea86d8ced61d564deb70bc44429be4579b144b078b8dd387d0806e9c8e1
SSDEEP 768:6C5FmMmE39J6Bpyfn1r6NbWKFd8AhiSmE39J6Bpyfn1r6NHFmNW8Fd8AhirmE39B:6C5FmvE39J6Bpyfn1r6NbWKFd8AhiNEC
TLSH
T12303821AABEC1249F5B299359EF0841B9523BC936D78CE1C019C1F4D0B37A40E876FB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 35KB
SHA256 032a4568774e30637d6aaab7f93c43b0906b6fbd4f6e94f35c289933769b3a8c
MD5 3fedf073d4219be20185a9b116811557
SHA1 1d9626ad4c051e76de07dac6d8cf1b43bcc23741
SHA512 6c373d326c72b2d0240f6bacdcea1575f750ec46a4bbf7faad67e79b8effe4531c50da579f9e756b1b20ce99f0dc96db8e25fbfda10472b6bb69784a63ca24b9
SSDEEP 768:3LsFmMmE39J6Bpyfn1r6NbWKFd8AhiSmE39J6Bpyfn1r6NHFmNW8Fd8AhirmE39b:3LsFmvE39J6Bpyfn1r6NbWKFd8AhiNEU
TLSH
T1DBF2711AABEC1249F5B299359EF0841B9623BC936D78CD1C01AC1F4D0B37A40E876F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 35KB
SHA256 4fb29b61398eaa14b27bfc961783977727daf00ffee8d219b48fabdb81634f24
MD5 cbab232074b2a358e9d1d375f8c94ab3
SHA1 eeaa285b55d84eef59f4f3f31186475bf41a4f8d
SHA512 7180e1cddadb1a1c0c3197d3025cf16d934749b6fbe7186a80dcf86dad5b3d93b2886ed7e93920c5d0bb4000ec647a891d693a7bf123339868f65235ce221815
SSDEEP 768:XL4FmCmE39J6Bpyfn1r6NbWKFd8AhiSmE39J6Bpyfn1r6NHFmNW8Fd8AhirmE39b:XL4Fm9E39J6Bpyfn1r6NbWKFd8AhiNEU
TLSH
T1D4F2711AABEC1249F5B29A359EF0841B9623BC936D78CD1C019C1F4D0B37A40F866F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

State.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
Size 42KB
SHA256 f30b58b07e96eb7aab3082bbd8e7f3a7ffe6943f32ae080e2aa34c93247b9fce
MD5 e1edbd4926b65ecfa416ebc5cd8768b6
SHA1 3b9e4bd663eec52db0b70a42d7d97bcb012442af
SHA512 70af2da426f021c01ba1b4a086aff36b68e4b3b91bdd6702932f25569b04a70352a239648d62250b162c69f51b1285bfd3db0693300063c64aaae8ff77bf0f89
SSDEEP 768:jAYFmymE39J6Bpyfn1r6NbWKFd8AhiSmE39J6Bpyfn1r6NHFmNW8Fd8AhirmE39K:jAYFmtE39J6Bpyfn1r6NbWKFd8AhiNEF
TLSH
T18713741AABED0249F5B29A359EF0841B9523BC936D78CE5C019C1F4D0737A40E876F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 23KB
SHA256 a1339811528b9abe4046461712d2666b41865fa2c822180be82b4cfb5ed74f8c
MD5 ca9d6d04b290087c449d5e24a6aeef3c
SHA1 e7941e5c53d0362fb1838ac3bc2b94ada3d0cbd4
SHA512 31294b09056d5eb6a6432c3367f4072358de54c26b554e27598737527cc1ff61a1276366807e3f3330bbdb363d702a197595b71338e5543a5deac4f58019fad3
SSDEEP 192:O50kH0kUC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFS:O50i0B8k0Vqs00l02Lg4UXuS
TLSH
T135B2A510B7E97818FDB3B9708FF8D43AA7237A950D79C82E406C954E4773944B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 23KB
SHA256 44fb55b47e1856e6949df3ce50b30f3e97b18ec57fb34051143d773bf0b8d19e
MD5 60cf3b1d71c889a73dacccfb50830cfb
SHA1 534b24913148da7955ae44fd32800851d8ecdf6b
SHA512 1a0b0e348c24210feb9f759cfd910bd7ad1248aeec0a07f0b7be90dfcce96adf31d57eaf58593d28116255164a67040d9dba54f2311ae015831c65da3d031500
SSDEEP 192:uWxg0kH0kUC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFS:uWxg0i0B8k0Vqs00l02Lg4UXuS
TLSH
T1C3B25C14B7E96814FDB2B9708FF8D43AA7237A950D79CC3E406C964E4773940B9A2336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 089c75ea2303d78827eab4a341b9ec59421a51e1f8a0001103ed0b0860081a98
MD5 7de0e64fd6d47cc0a5552f2b012acc64
SHA1 610539876e517b3536e9aec9df76dee405cebab1
SHA512 5b5a0a235234d42c10fa058dbfa4990cf9c5f2f0e8a1987348b4f094a383f132c308bad3582c5c3a8f94161b3cd7c997f680613341b5bb86d770e798fa674063
SSDEEP 192:730kakriC3Fk0kYqy3F00k2F6F2LmFP23FUkEYFXL:730tr8k0Vqs00l02Lg4UXuXL
TLSH
T1F8B26D11B7E92818FDB3B9708FF8D42AA7237A951D79CC2E406C964E4773940B962336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 4e2e59dd507dbd30a430320b0a7692f8e868e41c06a448307f17eb44f9962476
MD5 31170cc51ea6162be28d2f24b8cf8448
SHA1 9a12cdca8d4c04cea429b0d4cb785130389daeb4
SHA512 6d4dceaef1acb517dd571867804b3acd19e5a4dba4c64775d6cae9ebeb23cef4b6f9b2b88b57b75ec480face4a3f09bd3fce0e7f3a1f9b0f44527d027e498715
SSDEEP 192:730kakriC3FRkSJJqy3F00k2F6F2LmFP23FUkEYFXL:730tr8RNqs00l02Lg4UXuXL
TLSH
T109B27D15B7E92818FDB3B9708FF8D42BA7237A951D78CC2E406C964E4773940B962336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 c43b53e9909ad6e59ce30b63b57a23eceaf58a8d90d113c72d00c124619b7e7a
MD5 132f5f0477e08fee694332ff7cae0465
SHA1 4f1364a4f829ffbc58e1c2d94ff37204dbfa8d9d
SHA512 187860c00c1950875f94240a069da5ad4d554df1f3db00524a3b1588411191658fc57a0089ac9ece2cf8a537c6742243a584f3d81cefd900bc709670fafd13b8
SSDEEP 192:b30kakriC3FG4J6qy3F00k2F6F2LmFP23FUkEYFXL:b30tr8Gtqs00l02Lg4UXuXL
TLSH
T143B28D15B7E92818FDB3B9708FF8D42BA7237A951D78CC2E406C964E4773940B962336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 20a0c27c9eb9cf3fca66d5abe3795f73cd7844cc260e6c81e34f19723ffab25b
MD5 55da706014938c3d50c6843b71c6ba8a
SHA1 79fb8876510f4be3ce5c18ae59c43974b8146efc
SHA512 8bc7c29f06738d88385f0cd571212522bb1ed16f7604730397d40c9f2554124c335eed1eae331b379fd584485ed889bbaf898d59b3dabc417604344381689d36
SSDEEP 192:L30kakriC3F0AJYqy3F00k2F6F2LmFP23FUkEYFXL:L30tr803qs00l02Lg4UXuXL
TLSH
T1DCB29D15B7E92818FDB3B9708FF8D42BA7237A951C78CC2E406C964E4773940B962736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tasks.dat

Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
Size 24KB
SHA256 5823d5dd5a051ed44fe520c49dac6fd3c9ecab78eec2ab0557ca3e979c2a5705
MD5 575fc0b5922e096fe7465e42321b1606
SHA1 12ab527d20879e54c3aa28ca65c2ab4c381c7ff8
SHA512 3d286fecf74bafe70e9a54f849e1554958882ea3b66eef23323ec10c5daf6d515a1798201994798af1f737604d5c1f608d62573b697b53d9da48b64492b5fb57
SSDEEP 192:730kakriC3FXjJ0qy3F00k2F6F2LmFP23FUkEYFXL:730tr8XSqs00l02Lg4UXuXL
TLSH
T16DB29D1577E92818FDB3B9718FF8D42BA7237A951C38CC2E40AC964E4773940B962736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgentConfig.bak

Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.bak
Size 5KB
SHA256 c3f2655a4d77fe653f6db4e9f1af0ec114f5beb258f416d144e937c31aafafbd
MD5 e7fb9172d2c01cf96dbd142d9e21c588
SHA1 26c40b9da5e5f2e136d5e56733993c9571634c89
SHA512 f275daf6024ccc390649203e83bc6a2f5e6ccecbb27b84629bfc80a420d34c931d3415bcadf580a4e6451ef59a8d937496cb04ace0ebf9ff8f4fcb31c99e09c8
SSDEEP 96:JRAVjGg/0vpmmzjXu6eBpWxNB9LP1edjA6RQJAhFuLv9bLbqq86Ol3Ov7WPIbDEj:/+qg/KpeK7B9L47SJAyz9bP2607P6GaE
TLSH
T106C1793429EF5029B1B3BF964BD475DBE96EF673360660A9105203874713E42EEC293E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAgentConfig.xml

Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
Size 1KB
SHA256 611d977ddd0578f006e5182ae2d0a7b9bb4244c6d3eec71e1827c9224b073c25
MD5 17ed21d75bc11a667105ba91fbe6e03f
SHA1 15c6c56f7f97f5ccd49f38fca7207f41d589e246
SHA512 ba51155ac1b4214f19c282db460c0942808adc28d79390bf039b156a179490f160b975323b3141950f41ce53c4b3a67c539955901d248ca4695dc5e16265bac6
TLSH
T15A21AD252EEE90387273DE955FD4B5EBDB5EB7733606A81D1441034A8A22F00CDC243D
MD5 SHA1 SHA512 TLSH

Submit Download

WebAgentConfig.xml.bak

Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml.bak
Size 5KB
SHA256 9be854a249923ce2480de2c4e31cefaff4ef5d9188b188f427a971a6b174d9d1
MD5 325ce516422d01bc79bb5fde2afd9b54
SHA1 ab143679744e2fcbda8c003be2b49c9dc5e0cc3b
SHA512 7d650c6bce4335b5120dd499e3bf85c86a2f3d38d910b989b37d2d14a424f8afd2bbf8f16106740ded20398bc5c519e9a6e5d1efb217e7eb7ba38df8d084cf3e
SSDEEP 96:JRAVBa8S6zg+MM9kewcoqloKtsaQmmMAMJz2GXoyaQ6FSzGCyHloiMyFA7anclK:/+tvzgK9k2JlntOM4UoyVwnxFolyFAWt
TLSH
T183B1CD343DEE5029B173AE6A9FD4BADADAAEB773330664591022034A4613D42DDC193E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotificationHelper.exe

Path C:\ProgramData\Faronics\StorageSpace\FWA\modules\NotificationHelper.exe
Size 722KB
SHA256 273be5f8a0e4d12a2c9485c7b05f56f271ec641f311ccfd0d5349b193fd86c49
MD5 c56164b45ba5bca3c581bce77bc2f866
SHA1 122de44204931445f21ec6fef294ac101acd9cde
SHA512 5b02421760d8ffa47a0e5c0af875c44df802e094d493761c7b50c2e459fe8c15da29cec2c318b97a7eba89a2f58de0450e299c83289554f859650cf7013a3a1f
SSDEEP 6144:70jOOWPXXcQmKFF3lmmrWLiRWyyhrClpZrKcWOKZA:70iOW/X1FF3IBEhyh+lpZNKK
TLSH
T166F4E60273E8C1A5E0BFC6707C7D92A9CA267C790F3087CBB6447E2ED9256C29935356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FwaCore.dll

Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\FwaCore.dll
Size 4.1MB
SHA256 01e1d3690eef51e391b042f580cbb44a11ba8b51596b8f6e0a24218a65e1f994
MD5 3b7be6130f97edc75c376cd622fad97f
SHA1 7a1958f59bfafa03fcd18e973ccdeb93f7df2c68
SHA512 272efb0e7c0114ea5f130ad2b15b23bcb4a802b030455f5c237b647602f456f5a81f3b45b7265c1bba6c3ea24bad4ac3c186526dbe2fa474d6dff293a0a0b979
SSDEEP 49152:csguL86hUw0i4qFDQtpjPB2hMjr0m+AZqWg5C7GyKqPADE4wl8aOhW6PWra7BaOT:p86hUw0ihDQTP9jQywrCKqPADcf6fN
TLSH
T158162711E7E58014F0BF27B57A7E962A4937BC721B3089DFA304880D5972AC1D976B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUDLLUpdaterPatch.exe

Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\SUDLLUpdaterPatch.exe
Size 6.2MB
SHA256 b95a0687b8708acd587bbecc91b0e9e415984a0f1f860a54a6cf34eeddc7c862
MD5 698a090c0b049666f212a51c8c8bfc7a
SHA1 a1e2ceb9e5ccf68bf605478691445fc3fc4f83f3
SHA512 54eea4cfe6672b3f39c5d36c0cf2f27f280b46350a359a99371597db087779d5a37c99f4e960e60ea9f48b641e63675898bb958748935fcc58e3416a594151aa
SSDEEP 98304:SSTnRtkvQ+tuS4PfYiwOBpIeWRsTpLepn8rKXmRbYiwOBpIeWRsTpLCN:tPXXS4PAi1zwRsTpapn8O/i1zwRsTpWN
TLSH
T13D667D1076FC8A24D3B642315BBDEA629979B875073191CB339CAA6E1F336D0C536F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI833ec.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI833ec.LOG
Size 1KB
SHA256 bd7f0aaa2d21972f000918b75f64cc36948030264badefaafa7ed25a7379f1e7
MD5 d9881fc5f6c1f8f8faa8ab7c394749a9
SHA1 7f0e6d3f3fcbf78ba52d4436b8d5567cf93e46f2
SHA512 d93ed83a9b3c21baf81b62d0a2a14f494638b48360864d9f4a784d5ab06ba23586daf32d0c17154bb34aca0b3b5c3115f488491165ac92611341a6791d9e8231
TLSH
T13D3188661EE90815F1B75B47EAF3C1620A33FDD69835CF4C23488319066BD45ADBC3A6
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud Agent_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
Size 9.5MB
SHA256 f12258ac8bb060117adb9af6e6d3f5b62a8758ae8aacfead165eda2e1c9864cc
MD5 c993dd62ab601a7c1a744af15e1c8085
SHA1 e806d595a8945daa6d22c9ad15c32be1e0798ba4
SHA512 dd0e0d20cbe6e7674fba3d649b108d902e833c0e10c5af04a8350142b839778cfecc095b9c5bf61962028a17c14ff14c77a41115ac3bac76d82b21d7719adc4c
SSDEEP 196608:RisGNpFZNMHRXNJkVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:DGNpFZSHRdOn+X1BXy6hqc0g0kuAgJ1B
TLSH
T169A6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imaging Client_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
Size 3.3MB
SHA256 2c7a609d235f89de449f3077433062a35544b2fa3e120dba199d1ea3222cc0d1
MD5 65072453b67cbad82f08f17b59d43184
SHA1 33dc324a4166394a0ed77cc1dbba2dac3ffc45c3
SHA512 1089ba71e50319e45ea836b55849d96318d46ff9646cc26e921c967b103c8597051a7fd4409c1b4a43bb244f065ff1072cee8075a55b5e8c33a3716700d982f0
SSDEEP 98304:kxW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:mIL3Bm8yYdS12plWa
TLSH
T195F5F0117790C13AE0AE06B268689375452DFC314B38E5CBF3C99A6E2DB16D29F31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Software Updater_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
Size 8.6MB
SHA256 e6b5b9d25f88adee1cad6e4e4d562b14d3453cb1ec8bfbced0106136e46e05f9
MD5 4e1592638a80571c25d90e2a8d47a23f
SHA1 fdb2db44affcd8f7be2a776067de1e102b9bb47c
SHA512 aa6cf432a1658e152fcb9e46e6d3d1932a9dd4f81ae83acc8f55e0e798868f44591044db04d43a241c77bc16fa3c109fbc8323e15cc8a655dbdc6eeb76cb48c5
SSDEEP 196608:a6N+sCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:Rbn5tTl8hKlaCC
TLSH
T10E96E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Usage Stats_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
Size 4.3MB
SHA256 03e0bd8f785773cf593b3e47c85fafbd1d441163aa9a663d8f85fd9c30aa3e0d
MD5 bc5de136c85ad4adc9cf35d82cfa16ea
SHA1 5b0ca148d2107e4a6ec70b0fb4f47dd4b3f48ede
SHA512 8a3199d8eaa08865c9e1c8c253318e235c513d9694b91ac5549e48dda5d1396b88fbcfbe58cd45778b9e22e2fb3fad5f5a311eff8837ab8c8b9895e6853217b4
SSDEEP 98304:lSbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:oFf61+zZBENjYM2qXAns
TLSH
T13D260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWACleanupHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\{0D326B4C-1102-4C69-8266-7323C701B45C}\FWACleanupHelper.exe
Size 611KB
SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
MD5 b3157f7d3822d40038f4db3ee31dba3d
SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
TLSH
T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3709.tmp

Path C:\Windows\Installer\MSI3709.tmp
Size 57KB
SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
MD5 d480853146cffda8e468cc4d2751b405
SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
TLSH
T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3A56.tmp

Path C:\Windows\Installer\MSI3A56.tmp
Size 138KB
SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
MD5 b96cc173298220d17aa0932bf3047727
SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
TLSH
T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3A76.tmp

Path C:\Windows\Installer\MSI3A76.tmp
Size 1.1MB
SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
MD5 4cd4d7ccba93300d456b696e8ec502c5
SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
TLSH
T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI72D3.tmp

Path C:\Windows\Installer\MSI72D3.tmp
Size 147KB
SHA256 8ea9e3b1bcde24b779bf93d9c622239b4a7f28b733be9dd653fec4ec751f882d
MD5 b6ba4cd0f36e944b8f857887bfdb9ddb
SHA1 29dcce4205ce8c7a68e5da237ddf6a7d91593b20
SHA512 6eb18ffef9364eca2988d93d3f194aa590d23d7c02bffbfae4d5a12186586c871fe20b9128f754e7ab60660390240508aefb5363f841a308fd0fadaec5855abd
SSDEEP 3072:nUIB3+oXlkPUdTDq3SeMzGFpJ1bbFy85nVi:ULAlkPOTDESes4DbgCV
TLSH
T1AAE34A1172E4C176E2BB2A385E7987364A6BBC618F7095CF6B940E3E5E306C0DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Products.ini

Path C:\Windows\Products.ini
Size 380B
SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
MD5 6c310b6e27c949b929a3843d57c8ba37
SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
TLSH
T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
MD5 SHA1 SHA512 TLSH

Submit Download