Overview

overview

8

Static

static

3

AcrobatRea...te.exe

windows10-2004-x64

7

AcrobatRea...te.exe

windows11-ltsc_2024-x64

8

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    900s
  • max time network
    906s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 10:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AcrobatReader_Update.exe
  • Size 76.4MB
  • Sample260817-mrt28sag84
  • SHA256 8b2ccee907b301920a897661d59c2442cbee4cb63ef2e91a83a2a19d3fe3ad10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 26 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 37 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AcrobatReader_Update.exe
    "C:\Users\Admin\AppData\Local\Temp\AcrobatReader_Update.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2924
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:724
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1332
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3724
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 86E9DE6C827499A2203455FEAE1378A9
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /IM FWAInstallMonitor.exe /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:1100
      • C:\ProgramData\FWAInstallMonitor.exe
        "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 816
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2368
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5664
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU System /tn LaunchStartUpFWAInstallHelper /tr "\"C:\ProgramData\FWAInstallMonitor.exe\" /StartMonitorAtStartUp 5 /MsiPath C:\Users\Admin\AppData\Local\Temp\FaronicsDeployAgent.msi" /sc onstart
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:5200
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1196
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn LaunchFWACleanupHelper /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:804
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\FWACleanupScheduler.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn LaunchStartUpFWAInstallHelper /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1236
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D7D52CF1133B91E7CCD50E0961C69080 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:5408
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2932
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3736
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5500
      • C:\Windows\SysWOW64\wbem\mofcomp.exe
        "C:\Windows\system32\wbem\mofcomp.exe" "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1712
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1348
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /RU System /SC ONSTART /tn FWASvcHelperMonitortask /tr "'C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe' /CHECKSVCHEALTH" /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:6136
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\\" LaunchFromInstaller
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe
        "C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4560
        • C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe
          "C:\Users\Admin\AppData\Local\Temp\SUDLLUpdaterPatch.exe" -installProgress
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1136
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
        C:\ProgramData\Faronics\StorageSpace\FWA\modules\FTAgent.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3068
  • C:\Users\Admin\AppData\Local\Temp\AcrobatReader_Update.exe
    "C:\Users\Admin\AppData\Local\Temp\AcrobatReader_Update.exe" -r
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:6140
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:848
  • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
    "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:8
  • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
    "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5780
      • C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe
        "C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4848
        • C:\Windows\TEMP\SUDLLUpdaterPatch.exe
          "C:\Windows\TEMP\SUDLLUpdaterPatch.exe" -installProgress
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3696
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2984
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHSVCSTOP
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1436
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FaronicsSA.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:2600
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FRCServer.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:2928
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM NotificationHelper.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:236
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM NotificationHelperEx.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      PID:1664
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 2544
      2⤵
      • Program crash
      PID:5712
  • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
    "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2156
  • C:\ProgramData\FWAInstallMonitor.exe
    "C:\ProgramData\FWAInstallMonitor.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5608
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1864 -ip 1864
    1⤵
      PID:4532
    • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
      "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
        "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe" 1.31.8110.282 "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6036
      • C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
        "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe" /WATCHDOG
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5116
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:5172
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:6092

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e592331.rbs
              • Path C:\Config.Msi\e592331.rbs
              • Size 2.3MB
              • SHA256 4cd7093e434b0aa041b30f04afa8b9cf87071ff9edd2678b69132e23a4e32764
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FRCServer.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
              • Size 1.8MB
              • SHA256 bffc018b68ef16b4fea63ab34d1cf0a9878f7fb3c8a67d598c166416e1d649a9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FSSInstaller.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe
              • Size 409KB
              • SHA256 17743d623e6233b1eae704029e727be95e6ef60de9e50beeb9ece73fc0491f05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FTAgentTmp.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FTAgentTmp.exe
              • Size 348KB
              • SHA256 378734ead0ab162de6a49fc35e31e04b8f2908abb371e61864ef4699fd2b2191
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FWAMigrator.dll
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAMigrator.dll
              • Size 409KB
              • SHA256 16f38d265c199915637f57b69d52dbe788fdef9bb069bff498ef1e0ef5365e5b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FWAService.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
              • Size 489KB
              • SHA256 9769f3949ba8b5d7c3350bf259be87730de34acc89adc7098f9d8daa78e03071
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FWAWmiProvider.dll
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAWmiProvider.dll
              • Size 171KB
              • SHA256 4ffa7e291d9ce9fac6ddd5de6fa32ac65c47c8c01317c55eea5065ff82a63442
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FWA_UI_Agent.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
              • Size 388KB
              • SHA256 21ed2bbfc2af29005d9bb38a7d5ac290a5294c336a8ce45e19312706a243ada4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FarWsClient.dll
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FarWsClient.dll
              • Size 1.9MB
              • SHA256 b7f1a65f41005424fd903bab57fa3e77733c43ebd5b5bfe47ff21e84ffdf8f2e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FaronicsSA.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe
              • Size 687KB
              • SHA256 72d27a92b088420da85cba5accf133848755afab335fde2094d69ac57b4e9ab6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FaronicsWebProduct.mof
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct.mof
              • Size 719B
              • SHA256 ad81deda391bacdb17148de21b56281308c557ef998bdbcda71186b786ac2503
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              FaronicsWebProduct_v2.mof
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsWebProduct_v2.mof
              • Size 4KB
              • SHA256 1d3936d0973b63a09159e1f18227ffa34c0d7d5b4752ad1fa183dc1d6819ebd6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FwaCore.dll
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FwaCore.dll
              • Size 4.0MB
              • SHA256 15191574dde522a9c58fa108774d93023ac12be6ca7a66c6b2230956286282bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MigrationHelper_32.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe
              • Size 142KB
              • SHA256 5e8888cf9c6deadde3c629cb42f8db81cdb2c7dc2c907fab740822c2ac12ff9e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MigrationHelper_64.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe
              • Size 156KB
              • SHA256 4f88f9d7edb9d12e6e978d47367a9af1b3ae63aae725376302246ae4bef6eeab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ModulesUpgradeMgr.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
              • Size 675KB
              • SHA256 d9d176116043efb53969d74e5364ba0e65a0bf48d7b5ac5658a2489b999a853d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotificationHelper.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe
              • Size 722KB
              • SHA256 438784b9444c41b1d1b30e2d9e3a4b49f2dbb5981c2c19a4bbb0da20b60058f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenCapture.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ScreenCapture.exe
              • Size 433KB
              • SHA256 0125d4b61056147b566a44c214e4c6ce931b3da411530d6d7b0e14307dd5918b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StorageSpaces.dll
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.dll
              • Size 309KB
              • SHA256 c7ad31e8e674c80393f318861faa97145d8dfe5643dcdf4a911f4a4ae5cbaa7d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StorageSpaces.mof
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\StorageSpaces.mof
              • Size 6KB
              • SHA256 835d7a0cc6a5b5828db951848deb043df0711f59875d2e8790d3bb39a8b3f390
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UserNotificationHelper.exe
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe
              • Size 306KB
              • SHA256 cf75ba27e212c515ae69d08e6a90f801e7854d122957babd2c84bc179187cb7f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WebAgent.mof
              • Path C:\Program Files (x86)\Faronics\Faronics Deploy Agent\WebAgent.mof
              • Size 14KB
              • SHA256 9010345865e39a11773936549afd0f10000a9c8d0cf55062e0fa90161c4557f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CloudAgentCleanupHelper.LOG
              • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
              • Size 19KB
              • SHA256 6361b4d5a4a260b8d541fd7a5b7044666d86c67f9d9ae1a5a9200e69da4d017b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CloudAgentCleanupHelper.LOG
              • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
              • Size 3KB
              • SHA256 35a5b57f61faa8dc7bf3d4c788c670313e4f92f1d2fd67fffb57ddc7db34cd8d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CloudAgentCleanupHelper.LOG
              • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
              • Size 26KB
              • SHA256 c5d6950d766858b9c3d6750912bc78669474b02dfaa3e5e354145e7692e41707
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FWAInstallMonitor.exe
              • Path C:\ProgramData\FWAInstallMonitor.exe
              • Size 611KB
              • SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 39KB
              • SHA256 50917a038de1e14e0c307b21675d1b3acddb8e4562e871d8e1c3b79ae53ad608
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 39KB
              • SHA256 84e43f40be6c1e504a95a51be1fc4505b9771a260d20b80934bcd57f71e14baf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 39KB
              • SHA256 0048b4a03bacafb002c5eac1c1879738f43250f29feb599d8b024be511687a50
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 47KB
              • SHA256 f533575c4458aa7bcd0fafdacd892c871128e03b8ac86001f6a43bd8eb6a2b9b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 48KB
              • SHA256 67602bbf0181c17104ace0e81ca276e9e1d1e0940d88a428875f4c25491f06d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 55KB
              • SHA256 faf8dcda6a9680a76d95bca01b824df2b474df9bb7b0415fefa172fdc9d2594b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 54KB
              • SHA256 4deae25afbe4c23d94f4a9482056a4280f3668d4d7316d8a88726a2fdb74a267
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 54KB
              • SHA256 329562f91cc490bdc5fe070117ce77a804477a49d86e820a7860d998845fb6eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 18KB
              • SHA256 390ff20fe9efd62f3835ed3bf980ec44493c4602c3c74455c506c36c7496c96a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 18KB
              • SHA256 2aafcb21cf743914440c23d682e8c054d1d056c0444683264511a887c580af4f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 31KB
              • SHA256 43b00d038793937143b2620894012c159b2ef6edd51053645ec79c2eca74329b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 31KB
              • SHA256 059b9defb5e9c66fdb65208297559dd7f60b5ed6c67afe3ee5eaaba8ec2a5ff7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 38KB
              • SHA256 2f8d34f15c109cf5ce0644e31993897ee3a4330b56697c76b42447291ec2689f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 35KB
              • SHA256 33bcbb885c1c6652dccf513ff744cd71bc004721194f6852b378508bf074b800
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 42KB
              • SHA256 cbfd6b343849a378b6fb728d16b54e5af6a7b8686e225233e7de11b4e539dfff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              State.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\State.dat
              • Size 39KB
              • SHA256 dd2d3e1b96ef5f785ccd3cc1abc8d944049882bad1f1c63365bb249881f98f97
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 28KB
              • SHA256 7dfc01d70a94217caeeff4076e1042a4d6d0ae8815e77009c5950c82f23bde13
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 29KB
              • SHA256 e3f31c41368bcaafc44a254e1bfd852200903f2db766a8dba5124a8167faa74b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 27KB
              • SHA256 4fec06027513920fbc1274becaf47068f63894a28938aafd07c0932f3ec84edd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 27KB
              • SHA256 d5073806fe1b84cd98a887aa787a89ee736e45074c374ecd68ec8d1a8ec2adf0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 29KB
              • SHA256 ee4788b8d0a1135e257d81416203b162b0c860db518ea7f9652cfe2471705589
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 23KB
              • SHA256 a1339811528b9abe4046461712d2666b41865fa2c822180be82b4cfb5ed74f8c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 23KB
              • SHA256 7b5531fe1a1fda26d251a70e3176ae6a32b3dff9a80e72bd14267227374b2dbb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 24KB
              • SHA256 65aae45d23bcf81cf9e5ceff2b036437494d4f26671be22e0ab83780dd8114a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 24KB
              • SHA256 b3eefb3ae2de985618590522e528242626b304defc4a1c84567c2e9033fe95af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 24KB
              • SHA256 2bc2d5f8391b030a0c8f5e67e5c07c371b62131dd03c9afc56f8be92976eb524
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 24KB
              • SHA256 54a5cc1e657e7145e4b1a063529d45154461a7bbc69f032ac4111c6737b38287
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 24KB
              • SHA256 e982a5d6c87e0b71dd469fdcafb3564a793bb79b5aece9cf634d5b5e31d36f58
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tasks.dat
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\Tasks.dat
              • Size 24KB
              • SHA256 e22493d0cdff1867d73487420b31f9d039b513a37970f2dc7d7768678287e57e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WMIProviderLogs.log
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\WMIProviderLogs.log
              • Size 4KB
              • SHA256 2801fb2c04fd527a08bfea04bd80235607e5c6c9eea94e6f41293e6112a1428d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WebAgentConfig.xml
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
              • Size 5KB
              • SHA256 140174dc150e623d2ea2fb57866fd0fe23cc95361fa95074fbf54abc43ce7c67
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WebAgentConfig.xml
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
              • Size 5KB
              • SHA256 c7bbaa450dd606321a649cb7da84d3c3bc9e0b1ccbdd61e48d961cfd6674d22b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WebAgentConfig.xml
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
              • Size 5KB
              • SHA256 6cf9b9971b8d08f58d38f743861fc02fa8dce269ad00732ec6bab90b4c770e94
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WebAgentConfig.xml
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
              • Size 5KB
              • SHA256 255d4b8d5b8635b3a9d1b4cf84d46c81be29c806a082ca21fc1b81742f289f73
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WebAgentConfig.xml
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\WebAgentConfig.xml
              • Size 5KB
              • SHA256 179ca4bfa3ed3662be115183acf483778a846baf1578b3237abb3e20eaac6ba2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SUDLLUpdaterPatch.log
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.log
              • Size 2KB
              • SHA256 0b6817342cf9c219d8f3e4bdcc41d26ed7da0833a2d884789cb0c0856d1237fa
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              SUDLLUpdaterPatch.log
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\modules\SUDLLUpdaterPatch.log
              • Size 4KB
              • SHA256 9ef2a7516d8617679dbfadb9280d0a776c06b9b595499f95f2d2a29d028e0ee6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FwaCore.dll
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\FwaCore.dll
              • Size 4.1MB
              • SHA256 01e1d3690eef51e391b042f580cbb44a11ba8b51596b8f6e0a24218a65e1f994
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotificationHelper.exe
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\NotificationHelper.exe
              • Size 722KB
              • SHA256 273be5f8a0e4d12a2c9485c7b05f56f271ec641f311ccfd0d5349b193fd86c49
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SUDLLUpdaterPatch.exe
              • Path C:\ProgramData\Faronics\StorageSpace\FWA\tempModules\SUDLLUpdaterPatch.exe
              • Size 6.2MB
              • SHA256 b95a0687b8708acd587bbecc91b0e9e415984a0f1f860a54a6cf34eeddc7c862
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI91dfe.LOG
              • Path C:\Users\Admin\AppData\Local\Temp\MSI91dfe.LOG
              • Size 1KB
              • SHA256 48ae0c246cc3c2afc77d74650b3e78507659b4e0615b6b3e0fce55ba05626c67
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Cloud Agent_C64.msi
              • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
              • Size 9.5MB
              • SHA256 816a2a97ce1615dd6f42881d559512db69358428fd1458edc22038842273c6b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Imaging Client_C64.msi
              • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
              • Size 3.3MB
              • SHA256 b05e10c05b76be08cdcca8a9114bda8d5cb0dd602506bab4d947cd8a0b209ee3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Software Updater_C64.msi
              • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
              • Size 8.6MB
              • SHA256 a5879faec858ff303af8cfd0773f0ef75e0954c36d3cb0c1537950b4fd94909a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Usage Stats_C64.msi
              • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
              • Size 4.3MB
              • SHA256 c2268fcb56576633f4d0292d32c94e911da139d6d67247e414cbe6cfe1495608
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI2570.tmp
              • Path C:\Windows\Installer\MSI2570.tmp
              • Size 57KB
              • SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI2C66.tmp
              • Path C:\Windows\Installer\MSI2C66.tmp
              • Size 138KB
              • SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI2CE4.tmp
              • Path C:\Windows\Installer\MSI2CE4.tmp
              • Size 1.1MB
              • SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI61B7.tmp
              • Path C:\Windows\Installer\MSI61B7.tmp
              • Size 147KB
              • SHA256 8ea9e3b1bcde24b779bf93d9c622239b4a7f28b733be9dd653fec4ec751f882d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Products.ini
              • Path C:\Windows\Products.ini
              • Size 380B
              • SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
              • MD5 SHA1 SHA512 TLSH
              Submit Download