Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 16:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zoomagent.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
zoomagent.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target zoomagent.exe
- Size 76.4MB
- Sample260817-tssdcsvare
- SHA256 e890ace347e88b817493580db0a75ad11eecd1c3125638f507596e44d51f40ee
- MD5 03db822eacaaafcca778f9859290967e
- SHA1 b0237e50dccc27d8834d5d8e05c8010508b50dc7
- SHA512 81c9498348bdf02fd09e2c3fb5fed7039e50dcf5f3f8ef744ad8630199ce7d53a295edffac7f67f7731a4b03588188217370969da6605454424ffcea12fe815d
- SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpD:9iLVelepClAy6uw3W0BEROh2nvvh
- TLSH T12C08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1224 FWAInstallMonitor.exe - Loads dropped DLL 6 IoCs
pid Process 2528 MsiExec.exe 2528 MsiExec.exe 2528 MsiExec.exe 2528 MsiExec.exe 2528 MsiExec.exe 2528 MsiExec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\zoomagent.exe\" -r" zoomagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\zoomagent.exe\" -r" zoomagent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\E: Msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\T: Msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\A: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: Msiexec.exe File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\U: Msiexec.exe File opened (read-only) \??\G: Msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\V: Msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: Msiexec.exe File opened (read-only) \??\J: Msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\I: Msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: Msiexec.exe File opened (read-only) \??\U: Msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\T: Msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\V: Msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\K: Msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Products.ini zoomagent.exe File opened for modification C:\Windows\Installer\e58a330.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA96D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAAA7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAAB7.tmp msiexec.exe File opened for modification C:\Windows\Products.ini zoomagent.exe File created C:\Windows\Installer\e58a330.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA459.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA8BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA91E.tmp msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWAInstallMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zoomagent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zoomagent.exe - Kills process with taskkill 1 IoCs
pid Process 4660 taskkill.exe - Modifies registry class 33 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "BE99FA82F394469A8A3EC4368967E914" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo zoomagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2" zoomagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true" zoomagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA} zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "BE99FA82F394469A8A3EC4368967E914" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "2" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1" zoomagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy zoomagent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4116 Msiexec.exe Token: SeIncreaseQuotaPrivilege 4116 Msiexec.exe Token: SeSecurityPrivilege 1588 msiexec.exe Token: SeCreateTokenPrivilege 4116 Msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4116 Msiexec.exe Token: SeLockMemoryPrivilege 4116 Msiexec.exe Token: SeIncreaseQuotaPrivilege 4116 Msiexec.exe Token: SeMachineAccountPrivilege 4116 Msiexec.exe Token: SeTcbPrivilege 4116 Msiexec.exe Token: SeSecurityPrivilege 4116 Msiexec.exe Token: SeTakeOwnershipPrivilege 4116 Msiexec.exe Token: SeLoadDriverPrivilege 4116 Msiexec.exe Token: SeSystemProfilePrivilege 4116 Msiexec.exe Token: SeSystemtimePrivilege 4116 Msiexec.exe Token: SeProfSingleProcessPrivilege 4116 Msiexec.exe Token: SeIncBasePriorityPrivilege 4116 Msiexec.exe Token: SeCreatePagefilePrivilege 4116 Msiexec.exe Token: SeCreatePermanentPrivilege 4116 Msiexec.exe Token: SeBackupPrivilege 4116 Msiexec.exe Token: SeRestorePrivilege 4116 Msiexec.exe Token: SeShutdownPrivilege 4116 Msiexec.exe Token: SeDebugPrivilege 4116 Msiexec.exe Token: SeAuditPrivilege 4116 Msiexec.exe Token: SeSystemEnvironmentPrivilege 4116 Msiexec.exe Token: SeChangeNotifyPrivilege 4116 Msiexec.exe Token: SeRemoteShutdownPrivilege 4116 Msiexec.exe Token: SeUndockPrivilege 4116 Msiexec.exe Token: SeSyncAgentPrivilege 4116 Msiexec.exe Token: SeEnableDelegationPrivilege 4116 Msiexec.exe Token: SeManageVolumePrivilege 4116 Msiexec.exe Token: SeImpersonatePrivilege 4116 Msiexec.exe Token: SeCreateGlobalPrivilege 4116 Msiexec.exe Token: SeRestorePrivilege 1588 msiexec.exe Token: SeTakeOwnershipPrivilege 1588 msiexec.exe Token: SeRestorePrivilege 1588 msiexec.exe Token: SeTakeOwnershipPrivilege 1588 msiexec.exe Token: SeRestorePrivilege 1588 msiexec.exe Token: SeTakeOwnershipPrivilege 1588 msiexec.exe Token: SeRestorePrivilege 1588 msiexec.exe Token: SeTakeOwnershipPrivilege 1588 msiexec.exe Token: SeRestorePrivilege 1588 msiexec.exe Token: SeTakeOwnershipPrivilege 1588 msiexec.exe Token: SeIncreaseQuotaPrivilege 2528 MsiExec.exe Token: SeSecurityPrivilege 2528 MsiExec.exe Token: SeTakeOwnershipPrivilege 2528 MsiExec.exe Token: SeLoadDriverPrivilege 2528 MsiExec.exe Token: SeSystemProfilePrivilege 2528 MsiExec.exe Token: SeSystemtimePrivilege 2528 MsiExec.exe Token: SeProfSingleProcessPrivilege 2528 MsiExec.exe Token: SeIncBasePriorityPrivilege 2528 MsiExec.exe Token: SeCreatePagefilePrivilege 2528 MsiExec.exe Token: SeBackupPrivilege 2528 MsiExec.exe Token: SeRestorePrivilege 2528 MsiExec.exe Token: SeShutdownPrivilege 2528 MsiExec.exe Token: SeDebugPrivilege 2528 MsiExec.exe Token: SeSystemEnvironmentPrivilege 2528 MsiExec.exe Token: SeRemoteShutdownPrivilege 2528 MsiExec.exe Token: SeUndockPrivilege 2528 MsiExec.exe Token: SeManageVolumePrivilege 2528 MsiExec.exe Token: 33 2528 MsiExec.exe Token: 34 2528 MsiExec.exe Token: 35 2528 MsiExec.exe Token: 36 2528 MsiExec.exe Token: SeRestorePrivilege 1588 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1224 FWAInstallMonitor.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4116 5032 zoomagent.exe 86 PID 1588 wrote to memory of 2528 1588 msiexec.exe 92 PID 2528 wrote to memory of 4660 2528 MsiExec.exe 96 PID 900 wrote to memory of 2824 900 zoomagent.exe 99 PID 2528 wrote to memory of 1224 2528 MsiExec.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\zoomagent.exe"C:\Users\Admin\AppData\Local\Temp\zoomagent.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 420EAF69960CAC2F26C9483FCB9643CE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\taskkill.exetaskkill /IM FWAInstallMonitor.exe /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4660
-
-
C:\ProgramData\FWAInstallMonitor.exe"C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 25283⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\zoomagent.exe"C:\Users\Admin\AppData\Local\Temp\zoomagent.exe" -r1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2824
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\CloudAgentCleanupHelper.LOG
- Size 20KB
- SHA256 4c12b4f3e7abc053ef904a98f2b79ab967801c40d14dcd1ea2511eb60a6a273a
- MD5 87a228fe1ae85a4775f8669753d757bf
- SHA1 21968ee1114bf39f9ba8ee7ce3f3b784ed0505ab
- SHA512 8ab9353f95a5136746c52d477e90c9a6f87d6b34bc3f74c23106224976c04756a32683cfd52284025a9f6b04ddfe186d6ef99fd382210a68cbf78cfe4186e24b
- SSDEEP 384:agVS7VuMSTu9SOuhSsuBSKuaSXSRS6uPSqunSUu1Suu3SeuNSsU/VSqVuHSwuOSY:agVS7VuMSTu9SOuhSsuBSKuaSXSRS6u5
- TLSH T1CA924D4234C720285DFC678258BF558FBBAB56F8335823B8B7B5611B58CB40CF16AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8a0bf.LOG
- Size 1KB
- SHA256 ef05da985a29277a17c98b6b7bde7d60c2181aa42391d5ff0e280a79bcf6b47c
- MD5 ffc717f8fe567c81ec7e9832a41d99cc
- SHA1 f4f5a40c82cc222a8f089afc247a8ebebca04546
- SHA512 2fb067848d0c837437b1004930d7939f6bf45b2ba76cf61ca113ae466214850477a05529e8170b4d406db4b922fc3c04d6e9560e11ff7a42d697d3fa54f4e51d
- TLSH T14531A36A5BF50819F1F69707AEF3C0530A73FCD559398B4C22888319466AD05B9BC3AB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8bcf2.LOG
- Size 2KB
- SHA256 0dad1f5f843614bd31689502fdae19bdbcecb31a60643e482097a57e605856b9
- MD5 2f43f160438f846be40ef37e67b334db
- SHA1 9dc48a59eec3b7f8136fec47b0eb4ee0f005ce84
- SHA512 429ca83153a8873b152a2db05faaa3734c28b7a144f8ab1ee34197a98da974400bb68f3b207a7ffac0fd3569c1b22ddc2a376fadbbd94c7969a66a047bfd4571
- TLSH T1CE5104295BF40805F1B29B07AEF381525A73BC926934DB4C2284836D467BD09B97D3EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
- Size 9.5MB
- SHA256 1d5d7e68afc6169714f271f3c34e2e9837c8d65c35972bbfd68e42587aa88e41
- MD5 bf13effc012ef066703fa24fec6702bb
- SHA1 4253181b98f6ce3518b90f412d58d9e2ead85c43
- SHA512 577b78b49ecf8b12947b654b0fa4e16b514063a147786141d6fd9aa288b157c2b6bcc817d6ead82f992fdd1102deea9ba51d551ee1509ac903bcd623483f3a9e
- SSDEEP 196608:+isGNpFZNWHRXNJWVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:+GNpFZsHRdon+X1BXy6hqc0g0kuAgJ1B
- TLSH T116A6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
- Size 3.3MB
- SHA256 d6708d69ce1602228a2886cbd5eee44cb0d125b908ac6a9e46c8e0273944f432
- MD5 839023671d7d0031ad37bee47b1863e4
- SHA1 7d34df01816f6d2924cb2e0aba372389f5b80747
- SHA512 18d9806ce085851ae1bfe2a9d4a82fabbb692005bfcd70d578edd18c57c3774fcbaa092987896341354892c413a8236231898fe69ba16e6765ba887d9d6c9cf6
- SSDEEP 98304:yxW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:kIL3Bm8yYdS12plWa
- TLSH T131F5F0117790C13AE0AE06B268689375452DFC314B38E5CBF3C99A6E2DB16D29F31B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
- Size 8.6MB
- SHA256 1be34f84ad22349d92cda0d2968321766454f6d80ed9a660ccccf8cb9a930d0d
- MD5 2bf967267cc5c0336c5eb6e4d5b6f847
- SHA1 384d608cbe048917764e695ff066af368816ed45
- SHA512 6fad4b9ed082c82a78400a3cffb2f4ca1a949d8305c1a08690391cb212916217fcdaf941377330e054a70309031e57c58a928f517a3bc9bf792e430282667438
- SSDEEP 196608:06N+sCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:7bn5tTl8hKlaCC
- TLSH T1EE96E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
- Size 4.4MB
- SHA256 57ff10c46a1460979f68c58d31604fb00dc627cb6c9e51c6ec22e85148cb69ce
- MD5 5129b9e76a3663970798267abb4c3c9e
- SHA1 4597b7d7593ba217a803d5978c8a2b8ebe4e2b1e
- SHA512 640f2bb4625d4f70570cec92dd626108d1122107177c4599e23b67dae6aaed0dd1c96ccd22981bcbea186cf1bdac705aba5e32cddc7f636c41d5ed298e6aa2a2
- SSDEEP 98304:rSbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:GFf61+zZBENjYM2qXAns
- TLSH T1E3260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{0D326B4C-1102-4C69-8266-7323C701B45C}\FWACleanupHelper.exe
- Size 611KB
- SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
- MD5 b3157f7d3822d40038f4db3ee31dba3d
- SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
- SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
- SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
- TLSH T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA459.tmp
- Size 57KB
- SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
- MD5 d480853146cffda8e468cc4d2751b405
- SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
- SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
- SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
- TLSH T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA8BF.tmp
- Size 138KB
- SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
- MD5 b96cc173298220d17aa0932bf3047727
- SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
- SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
- SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
- TLSH T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA91E.tmp
- Size 1.1MB
- SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
- MD5 4cd4d7ccba93300d456b696e8ec502c5
- SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
- SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
- SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
- TLSH T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Products.ini
- Size 380B
- SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
- MD5 6c310b6e27c949b929a3843d57c8ba37
- SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
- SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
- TLSH T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
- MD5 SHA1 SHA512 TLSH