Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
898s - max time network
897s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/09/2026, 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
900 seconds
Behavioral task
behavioral2
Sample
fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
900 seconds
General
- Target fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe
- Size 4.2MB
- Sample260901-s3aevsdd59
- SHA256 9b6900d748cccd0052687b6c49e17829a0e646e8bf32cc6df247773ef95541ed
- MD5 9e6e54f556cbc049fb2fe25f1e16cd9c
- SHA1 578d0f8501b35b26446d15d5a69adbc60ee69d43
- SHA512 dd0a31a7beb0c39c990f4e990b933d821e9676c28355d7dfdbca873a9c1533a623fa6f55f23b4cf40288f711dd60f180927655faf3cf4f31ef499744c2a14885
- SSDEEP 49152:bP0dfmVfyr+CU8D1i+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA26Yu8:bPt6Laeoi+0QFfXp4Oi8
- TLSH T11C16CF90FCDB54B5E603553158AB62BF2734AD094F31CBC7D6407BAEAC73AE10936229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs
Run Powershell and hide display window.
pid Process 3496 powershell.exe 3008 powershell.exe 1620 powershell.exe 544 powershell.exe 3732 powershell.exe 704 powershell.exe 3552 powershell.exe 1824 powershell.exe 4044 powershell.exe 4144 powershell.exe 2388 powershell.exe 1940 powershell.exe 3600 powershell.exe 4524 powershell.exe 976 powershell.exe 5100 powershell.exe 4204 powershell.exe 4456 powershell.exe 1580 powershell.exe 4348 powershell.exe - Executes dropped EXE 5 IoCs
pid Process 2356 fleetdeck_agent_svc.exe 3672 fleetdeck_agent_svc.exe 4696 fleetdeck_agent_svc.exe 1772 fleetdeck_agent_svc.exe 3632 fleetdeck_agent.exe - Loads dropped DLL 3 IoCs
pid Process 4280 MsiExec.exe 448 MsiExec.exe 3632 fleetdeck_agent.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 28 3768 msiexec.exe 30 3768 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 49 checkip.amazonaws.com 50 checkip.amazonaws.com - Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe powershell.exe File created C:\Program Files (x86)\FleetDeck Agent\credentials.json fleetdeck_agent.exe File created C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe msiexec.exe File created C:\Program Files (x86)\FleetDeck Agent\deployment.json fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\latest.json fleetdeck_agent_svc.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA8AF.tmp msiexec.exe File created C:\Windows\Installer\wix{F50AF01E-F174-4B1F-8AFA-1059A924993A}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e589f6c.msi msiexec.exe File opened for modification C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File opened for modification C:\Windows\Installer\e589f68.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{F50AF01E-F174-4B1F-8AFA-1059A924993A} msiexec.exe File opened for modification C:\Windows\Installer\MSIA92D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBF75.tmp msiexec.exe File created C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File created C:\Windows\Installer\e589f68.msi msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe - Modifies registry class 23 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3\MainApplication msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductName = "FleetDeck Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Version = "16777216" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductIcon = "C:\\Windows\\Installer\\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\\fleetdeck.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\PackageCode = "4396C18A14041E649AE5993E00E2B92F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\PackageName = "1294636410.msi" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3768 msiexec.exe 3768 msiexec.exe 2356 fleetdeck_agent_svc.exe 2356 fleetdeck_agent_svc.exe 4044 powershell.exe 4044 powershell.exe 4044 powershell.exe 2356 fleetdeck_agent_svc.exe 2356 fleetdeck_agent_svc.exe 4144 powershell.exe 4144 powershell.exe 4144 powershell.exe 1620 powershell.exe 1620 powershell.exe 1620 powershell.exe 544 powershell.exe 544 powershell.exe 544 powershell.exe 1772 fleetdeck_agent_svc.exe 1772 fleetdeck_agent_svc.exe 1772 fleetdeck_agent_svc.exe 1772 fleetdeck_agent_svc.exe 4348 powershell.exe 4348 powershell.exe 4348 powershell.exe 1772 fleetdeck_agent_svc.exe 1772 fleetdeck_agent_svc.exe 4204 powershell.exe 4204 powershell.exe 4204 powershell.exe 2388 powershell.exe 2388 powershell.exe 2388 powershell.exe 1940 powershell.exe 1940 powershell.exe 1940 powershell.exe 3600 powershell.exe 3600 powershell.exe 3600 powershell.exe 4524 powershell.exe 4524 powershell.exe 4524 powershell.exe 4456 powershell.exe 4456 powershell.exe 4456 powershell.exe 1580 powershell.exe 1580 powershell.exe 1580 powershell.exe 976 powershell.exe 976 powershell.exe 976 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 704 powershell.exe 704 powershell.exe 704 powershell.exe 3552 powershell.exe 3552 powershell.exe 3552 powershell.exe 3732 powershell.exe 3732 powershell.exe 3732 powershell.exe 3496 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeIncreaseQuotaPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeSecurityPrivilege 3768 msiexec.exe Token: SeCreateTokenPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeAssignPrimaryTokenPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeLockMemoryPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeIncreaseQuotaPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeMachineAccountPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeTcbPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeSecurityPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeTakeOwnershipPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeLoadDriverPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeSystemProfilePrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeSystemtimePrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeProfSingleProcessPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeIncBasePriorityPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeCreatePagefilePrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeCreatePermanentPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeBackupPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeRestorePrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeShutdownPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeDebugPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeAuditPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeSystemEnvironmentPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeChangeNotifyPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeRemoteShutdownPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeUndockPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeSyncAgentPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeEnableDelegationPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeManageVolumePrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeImpersonatePrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeCreateGlobalPrivilege 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe Token: SeBackupPrivilege 4168 vssvc.exe Token: SeRestorePrivilege 4168 vssvc.exe Token: SeAuditPrivilege 4168 vssvc.exe Token: SeBackupPrivilege 3768 msiexec.exe Token: SeRestorePrivilege 3768 msiexec.exe Token: SeRestorePrivilege 3768 msiexec.exe Token: SeTakeOwnershipPrivilege 3768 msiexec.exe Token: SeBackupPrivilege 2292 srtasks.exe Token: SeRestorePrivilege 2292 srtasks.exe Token: SeSecurityPrivilege 2292 srtasks.exe Token: SeTakeOwnershipPrivilege 2292 srtasks.exe Token: SeBackupPrivilege 2292 srtasks.exe Token: SeRestorePrivilege 2292 srtasks.exe Token: SeSecurityPrivilege 2292 srtasks.exe Token: SeTakeOwnershipPrivilege 2292 srtasks.exe Token: SeRestorePrivilege 3768 msiexec.exe Token: SeTakeOwnershipPrivilege 3768 msiexec.exe Token: SeRestorePrivilege 3768 msiexec.exe Token: SeTakeOwnershipPrivilege 3768 msiexec.exe Token: SeDebugPrivilege 4044 powershell.exe Token: SeAssignPrimaryTokenPrivilege 4044 powershell.exe Token: SeIncreaseQuotaPrivilege 4044 powershell.exe Token: SeSecurityPrivilege 4044 powershell.exe Token: SeTakeOwnershipPrivilege 4044 powershell.exe Token: SeLoadDriverPrivilege 4044 powershell.exe Token: SeBackupPrivilege 4044 powershell.exe Token: SeRestorePrivilege 4044 powershell.exe Token: SeShutdownPrivilege 4044 powershell.exe Token: SeSystemEnvironmentPrivilege 4044 powershell.exe Token: SeUndockPrivilege 4044 powershell.exe Token: SeManageVolumePrivilege 4044 powershell.exe Token: 31 4044 powershell.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe 4068 fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2292 3768 msiexec.exe 100 PID 3768 wrote to memory of 4280 3768 msiexec.exe 104 PID 3768 wrote to memory of 2356 3768 msiexec.exe 105 PID 2356 wrote to memory of 4044 2356 fleetdeck_agent_svc.exe 106 PID 2356 wrote to memory of 4144 2356 fleetdeck_agent_svc.exe 108 PID 3768 wrote to memory of 448 3768 msiexec.exe 110 PID 3672 wrote to memory of 1620 3672 fleetdeck_agent_svc.exe 115 PID 4696 wrote to memory of 544 4696 fleetdeck_agent_svc.exe 118 PID 1772 wrote to memory of 1348 1772 fleetdeck_agent_svc.exe 121 PID 1772 wrote to memory of 4348 1772 fleetdeck_agent_svc.exe 123 PID 1772 wrote to memory of 3632 1772 fleetdeck_agent_svc.exe 127 PID 3632 wrote to memory of 4204 3632 fleetdeck_agent.exe 130 PID 3632 wrote to memory of 2388 3632 fleetdeck_agent.exe 132 PID 3632 wrote to memory of 1940 3632 fleetdeck_agent.exe 134 PID 3632 wrote to memory of 3600 3632 fleetdeck_agent.exe 136 PID 3632 wrote to memory of 4524 3632 fleetdeck_agent.exe 138 PID 3632 wrote to memory of 4456 3632 fleetdeck_agent.exe 140 PID 3632 wrote to memory of 1580 3632 fleetdeck_agent.exe 142 PID 3632 wrote to memory of 976 3632 fleetdeck_agent.exe 144 PID 3632 wrote to memory of 5100 3632 fleetdeck_agent.exe 146 PID 3632 wrote to memory of 704 3632 fleetdeck_agent.exe 148 PID 3632 wrote to memory of 3552 3632 fleetdeck_agent.exe 150 PID 3632 wrote to memory of 3732 3632 fleetdeck_agent.exe 152 PID 3632 wrote to memory of 3496 3632 fleetdeck_agent.exe 156 PID 3632 wrote to memory of 1824 3632 fleetdeck_agent.exe 158 PID 3632 wrote to memory of 3008 3632 fleetdeck_agent.exe 160 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe"C:\Users\Admin\AppData\Local\Temp\fleetdeck-agent-Qcsr8VuGrEgqGRL4sdyfrD.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4068
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8C026D20AA578EAE8DB3A6101AFDEDB62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4280
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID bf448e86-a047-48b8-89f8-bd4f9981e6fe -askForName=02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AFA9E4D7B2693D4B42C0BD102E897F5B E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:448
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:544
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service2⤵
- System Location Discovery: System Language Discovery
PID:1348
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4204
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:976
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:704
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).NdisMedium | Select-Object -First 1 "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).MacAddress "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty OSArchitecture))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1824
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " function Test-PendingFileRename { [OutputType('bool')] [CmdletBinding()] param() $operations = (Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\').GetValue('PendingFileRenameOperations') if ($null -eq $operations) { $false } else { $trueOperationsCount = $operations.Length / 2 $trueRenames = [System.Collections.Generic.Dictionary[string, string]]::new($trueOperationsCount) for ($i = 0; $i -ne $trueOperationsCount; $i++) { $operationSource = $operations[$i * 2] $operationDestination = $operations[$i * 2 + 1] if ($operationDestination.Length -eq 0) { } else { $trueRenames[$operationSource] = $operationDestination } } $trueRenames.Count -gt 0 } } if (Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending\" -EA Ignore) { return 1 } if (Get-Item \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\" -EA Ignore) { return 1 } if (Test-PendingFileRename) { return 1 } try { $util = [wmiclass]\"\\.\root\ccm\clientsdk:CCM_ClientUtilities\" $status = $util.DetermineIfRebootPending() if(($status -ne $null) -and $status.RebootPending){ return 1 } }catch{} return 0 "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3008
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589f6b.rbs
- Size 219KB
- SHA256 235e6f8b279dca0bdcce68617e5961d3a0823101345da2854e3eee7aa1cbde62
- MD5 6592556ccf305f64bf997e9ad87afb50
- SHA1 0315b5a94b652634438576bf0660fff26c8bc355
- SHA512 bd6ce8e9d01596b38a412da6f276317c8f95cc0b46251ddca212def4022e4bd3c72e378888ca2c4d76f3158626ad3c6931bd16d62e270e649ece3956e769d13f
- SSDEEP 3072:KJz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxag:Kt/kE1jOZy2KL4GBiwQtEa4L2sJ
- TLSH T1DE249D216090847EEBFA0936993ED671BF7DF2241760C99EC3848C1E5D644C06BB7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll
- Size 1.8MB
- SHA256 a075919c65120a8a92d3a11895ea456ccbee501717ddb17b29578c029f0c0051
- MD5 39b34a26dc09ffa1b2923d5cdd473eb5
- SHA1 a706ee87242c0597fae398eafdeaf0d9ac940903
- SHA512 930409f08616ae33b3534ad580c349160f77a8b8ea0e077debfae420888855138730ea284377b7b3fca878644d7b2bce7de2dfef0d5b2354a5cab5ae439ae7c3
- SSDEEP 49152:WhX2UquWo4tPAmyI0wxJ1hbL9gghWGE1hKk:WhX+K4iEbL9LhWGU
- TLSH T10D858D22FC41C035F9EA10BAC2FDAEBE98AC8520037806D757D518B69E615D3773D29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe
- Size 6.3MB
- SHA256 7ae8daaa4639ea38723ea77b67ce22e5312e8ac7dd20c016c41b2a88432ba989
- MD5 e3fb748bfdcaecd85775077589aab08e
- SHA1 a491e836d76989d343627f12e6c2669fd38b03e2
- SHA512 503aaeb6631ff6fab157d48ca83c50ca44eac075f9ece9e9574be44c1d6176ee1c4f92388fdf54067120f9dbda725174e5f82df05c0891eb1fcf03f8f44e8398
- SSDEEP 98304:El8YgLZng+nOMxdgiI+yy4UI6fXmkiv7PK9:vYgdgQxyhNkou
- TLSH T19C664B91F9DB40F5D903183044AB623F67306D0A8B35CFD7EA507F6AE9779E20A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 d07d47dbfe061158592097c738528a808eddb1d05d02459b4fb5d01cde4a735d
- MD5 78bec61d72609ad32b5c92b12b5acdf8
- SHA1 88375de8357133ceaef024a32247d8cc5ae7fa07
- SHA512 ba2de1335cd28a4e80a12217e5f074001f3371a5a23f65fb93ed7e7bfe6240637822fd0c32074dbb35ba7f59ded91e441455ecf46b76eefa2b36cdff7947318c
- SSDEEP 49152:N5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQ4:N5wTWNupq+w67Y8ZQmBKYUWaBtTHk
- TLSH T16B562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
- Size 69B
- SHA256 af68f70900a69a76cd3b08c5654f189828841c50cba7b138737e6a1d86524bd0
- MD5 819d85dd320d51b82e8861360a1a5196
- SHA1 92521c332298ae16e56bfadcb54e73bed35d94c3
- SHA512 e10805e97fc3bfc52408bddc921bcbcf2e7edc3f3b89da0fdc8da0a2b2c94cb08f67b61b409beb53ca3da8cc70216d709cb906891eee711a6617acd1beefbdfa
- TLSH T12EA0024976881D16E236C0AC581C6AEE0E89922856E378F0C2250E3B874A9510991B25
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 f7d793f458450f8da205887757af84967848fd42c8be78dfcd00524e6cf2ab65
- MD5 2854313d8826aab27a90611b85ef3671
- SHA1 6bcda85950590ced34406062000ffb1bf36b58e4
- SHA512 3ec36105f398f36cbeae2cb3ab5949e4d408c1b2417ce8fb2f9c88c99f72822fb96011849a61db28991fd91ebd5bc0e2c2ca681ebe9672d70b4bda91d1610d7a
- SSDEEP 49152:85wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQy:85wTWNupq+w67Y8ZQmBKYUWaBtTH2
- TLSH T1AB562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\latest.json
- Size 102B
- SHA256 564623c3fd47db24a7cdc9e4e31cdeb7ff0d42d2de527fcd1f2dc7b4b3ab017c
- MD5 9f75b0938a972c6fa01dff8e83d4fa59
- SHA1 6685900a7fa4f2ec4e050eebc550859e317d93e7
- SHA512 7eb8a43c317123ffe128ba31db9787c45aac9541764f4ae2bab8e8f76b5f16ea6d0eb815de57533c7f3d78eb3fc42642b2dc996927350269678f985e614e5c61
- TLSH T1A4B012F20C963073C27201D014F450B852038AAB4182680DF1824300E88C2BAF48327F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1294636410.msi
- Size 2.3MB
- SHA256 0eb3b3136035ed9b30c1071cdbb69db06a871e04feda8a9cfe8e13ee82aa4d4b
- MD5 64de8b74901084b6c96a4a47fc97d564
- SHA1 8012fe251350dbb961070d6e84036b1bca6e13c5
- SHA512 7512e03df8359c9cfccc096aa77dba17fd453f35c4a8ec2169ccae25c1441622a3f28c707b1f7b22d146ab4b2ece707bf4824656f931568299141085bb3cc1e2
- SSDEEP 49152:3+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA2:ELaeoi+0QFfXp4O
- TLSH T119B523213548917DC7FA0D31952FEF62BE38FE180E20C56A93807A5E2D715906B77BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA92D.tmp
- Size 211KB
- SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
- MD5 a3ae5d86ecf38db9427359ea37a5f646
- SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
- SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
- SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
- TLSH T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 1KB
- SHA256 fa40892716d7f657c65d13d4cd82a3bfbe57af73a41dc8f489a679b676957d3d
- MD5 3dd36deab156361ddee0402e1bbdb434
- SHA1 3fc62e77e2977230974d40c6e9364f91b7a01ed6
- SHA512 0995d2e52f99ce7c14bf8f2555e5cba63ef92c547bee6d23905a77fcf6bcc6f88c7fcdf947f4258d828c07fc94f9ff05fab3a7c04c323abf9fa66f93163736ae
- TLSH T1A4219B0307C399FEEA930A918C931DE323566E33771CE51EB2E071829492559E8A50D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 1KB
- SHA256 d921ac0c3e611c1c6590d1ce1904403db6c9e1445ea097c0e493b759f96d57af
- MD5 c959d2415347d94be5b7c20c3f199322
- SHA1 f8948daa44c92e7df45a94815e2daa551979642b
- SHA512 fbad832a18aea0b5b78b9866f29bdc2cedbbd03ca493bfdadc6f0e6fb08d204d5a9b290a6210d8f93b77072727f4fb1103b161db788d55519238b20a80ea7250
- TLSH T1A121880307D399FEA9D20E91CC931DE323566E23770CE51EB2F0318294A255DE8E50D6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_1kvrmxdw.iv3.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 3924113f27f3ad2ebe752cf27a50523b9f05382776f88ad4c6172df175bd25a3
- MD5 53169e560f94b03247bdd6bd752445e1
- SHA1 b6efc96de828a2bb21d659e3fcbc16a871ba5e71
- SHA512 9d9250339f36c1584090cb58df895e81d8344c1133f659c416d4eb3e0f68214c5aafec75257e1643127cd69a94c854903f2719ba5b5bf83fd16ee3a261d8c334
- TLSH T18B81FE323375B0D4C9567F062A2819D063BF4386EA98AF4CB25C621EDD2640BDB122F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0a939f9d4ed44399f41bfa70a015b24c2dc4646a93f6ad06efd0717029bb1311
- MD5 6db42ef38ba97e28bc9b43a83d014653
- SHA1 3a693694defb2572200ef662cac7e9e79b423baf
- SHA512 a1f0bd1dd59c0f2795596cd91ac88c3bd861ca61b82122dabab844bd7a34ba67d176e55f7edaaf2e4ee2e0ee01b9ebdae8d40298193839dacb431e381592b310
- TLSH T16B219727B3DC8822DCD9123A509D9C1136AA87C7849ECF9B6BC0D324957FAC8CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f2deec074bcbf2b04405c375c83961c640e2f71890edcfd4bcdf556f2d27ae4c
- MD5 0128aedaeb8148d99b53ef75e24013d2
- SHA1 f41b985d21df6c7dde491e66be560388e829c820
- SHA512 73c6342ca740c429ad24cd7fb8e3cbe7bc91fe6c4de593f4fad378634c3f4ee4f10d885c92625a55fc976aa95da1aa68b4182f90dc0b345179ac094e790f399a
- TLSH T146217B27F38C8A31CC95153A109D9C11767182D7809EDF9F6FC0D201A5BF599CB61190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 42d8dc14f2187f5583099d7d1b1ed209acd2f7097e257eae7d98e3bc0c4f46bb
- MD5 9258f83f8f21306870ba2cefda5f2713
- SHA1 ffba512932ee402cd4b68f6362ba3ffd172f6cff
- SHA512 5ba244eea39accdace715746c57a891b0b167be6de2d37d0aa13b716e84e151cd8d929f02766dfc0a9d3627d091c3c879a0138a713f96bae93c60b476e920b21
- TLSH T194217827F38C8A21CC96163A109D9C2176B283D7819FDF9F6BC0D211A5BF999CB61190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1397d9466be7fec3138eb9c3d13f4b17e5d3db188ca3d4e97c77f2715d60b888
- MD5 61985144e8490188613738ef905b43b5
- SHA1 ef1dcd930bbefbdd38c852dbe859d67273b844dd
- SHA512 9d6702dae0c92141d868a655f1b86f2d38702883c6200e46c18ed2fe3006bd2cb2006e66920c7d2544cbde3a31ca2bd9537a4f0f4c88f038e2b5b57133ee92ae
- TLSH T1D9219727B3DC8921DCD6163A509D9C1036AA83D7849EDF9B6BC0D32491BFAC8CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 db90b33c8b016e2ed1b108c9becdbc08bd8b46afb38dad0102bf0b299ca60bd6
- MD5 673eea550d918f51010e08432b064982
- SHA1 5553fc47e018533954a01dc47b71c30db82d3d50
- SHA512 1c3373adb88b2e041b768a66a9bc078a6a8fb3b7e562ebd699cacb517d5c8417128c01128d61515c1e1302460b92fb0d76e0c3e2d4204d953d6554636bbcce5b
- TLSH T1E021A827B3DCCA21CC96123A009D9C1172B6C3C7809ECF9F6BC0D610A0BF999CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 35076ea62c75739f2f1434d3cdde5f975e332a13210ffab2ab63a975f300fbc9
- MD5 1c6fde2dec167fbabaa0168aebc5e3ef
- SHA1 ee72f321c123219f5c411cca491333af848512e1
- SHA512 59221096ca0c2311844e5a845bddc0e1050224f1c094592216654342aa90cfd4f15e72927f63412b3b1d3b1960df960dbd6a371fb3d5a113998c7bda72eb07d5
- TLSH T16F217827B3DCCA21CC96163A109D9C1176B683C7819EDF9F6BC0D614A07F999CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 931a2eaa61178581995773a9da78f4bfd76ad27c29b44442fa1329b384a0cd96
- MD5 91a39b91c2b22ff00c12e56878baa09b
- SHA1 e19e669a9c2c8fec9fb699c4c76384a105471bda
- SHA512 59df651f9cab1c7b960e22d8207766cef07393b33d42f2b759bf4043cd63f2abaf08f9e1b419c6a126fb51a98468d15d34ba09caac46dfbc1a1b658c513aa2b0
- TLSH T10A21A827B3DCCA21CC86163A009D9C1172B683C7809EDF9F6BC0D600A07F998CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 21927689c7ecab2b7af7611474c2e2b20d72d05a941afec01b42337f432dc2fa
- MD5 63f3daf3ebf7daaa3416a431d50ff3b2
- SHA1 cd95e25992a7da97a5cc8b48a47e157867721a04
- SHA512 9f6e37a407af1b6fdeaa89f8753b5b7db087c32b3f9b2b2bd7af027ec3606ab534ad7dc16e179e3e784c04af27cd77befd45d4ef68c2d1af09830b311177f29f
- TLSH T145217827B3DCCA21CC96163A109D9C1176B683C7819EDF9F6BC0D614A07F999CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 04d13143574f6d4509f85f4167043c35a90f773d4feb381b8e30554f7a0fec06
- MD5 b8cc62845543a6b9f1a4b2e64dedf2d7
- SHA1 6e29b6362ad8972f3b80071eb8a2e4de79870f16
- SHA512 7a924a1f903dd08939e49978298af99d2214b1ad6537237ca8b774a2fde2b0ec198a5c787d1049de499e4b876a429930144815619767d5fc700e1c282329a157
- TLSH T1BC218627B3DC8921CC86123A109D9C1072A283C7819ECFAF6BC0D604A07F988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 cc6dc58f1d7bb6a3dc70a1ea7cae87d46af1f843e581299392896dec867764c6
- MD5 903dd097e8b2c8bb426ed99a913c2821
- SHA1 4ecc4a94d7c88faf53fe12897bc0c8112ed57016
- SHA512 3045f7c42371c01675b45277d66d7cf3069c2967107f3cbedff28691a980f3d0f15663bb9e19de91e3306776d9a1549c5894708d6e7ccfb176e807bcea6ff48d
- TLSH T1E821A837B3DCC921CC86163A109D9C1072B683C7819EDF9F6FC0D604A07F988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b38f8d61f8ca3ce38f350283faedb3c708057b92da698f70677c666c6f1e33cb
- MD5 fca92ab2a9a966d18256e22e0602541f
- SHA1 b4abf5d2f5577c6c5f5ccf02faa30a21c26eccb5
- SHA512 9f0ab434209144d39e1baa9a70262a9077f671bde400e733ae78131581cfff6638c2d9325c257e075a9ed368ced3de336c725e9373ec6606a322e93406c5aa4b
- TLSH T13331AE2ABB9C8995CC9E153910DD9C1072F1C2DBC4EECF9F7A80C21495AF5C4C765E94
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7e501a2e5c6f9311353dd61edc103f16574d29d2846446c4c82d8aa542d8fb98
- MD5 ac343beccce3cec3b8942eee35557cf0
- SHA1 9a797b5d29b427e6728c3a0d7026ba0ceaa5276a
- SHA512 07706fee7ecad674594a82d5a80cacabbae0b8f02a2a86154705ba8a81141055d04017a1caf37ba0e1e074f9067de3f0d4765d515e3d9e7d63df48100515446a
- TLSH T15431CE2AB79C8999CC8A113A009D9C0071B5C2D7CBDEDF9F7AC0D204B9AF984C724954
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c4f386466994fca179b1e467b3032cc552f5277121447fcb4ddc415874d621b0
- MD5 48f3096e807964de142d0bbd12060519
- SHA1 b67a2124a6c9089aef6dd3e0f8370145ec1521a0
- SHA512 983eb2187b9c8f76e57da5741bf687e8df728b5bb9ba67ff1c80859209fd9adfaa8640f0346caad00c4e66298e4ea5ead7da7d47eace2e7f8be6e5c6291949a1
- TLSH T179216527B3DDC921DC9A123A509D9C1076B682C7809ECF9F6BC4D615907FAC8CB21194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 bb7f01914feaa4afd6b2ff636ea46cae8346407f7e917970380df074dd486d67
- MD5 8d57051f5de85b9d706ea42e28c7f65e
- SHA1 884392aa33b659d0426d3c66eb7ab0d14e0e4d4f
- SHA512 ac72c79c0d6dc94710aa68bc7d9c5a880b96ebfc9cf4f6c0ad79e633ca6163840d7ca0293aa266c0b3f2216e46d19f97d3cdb6632fa8cf178a4ac9a7c75663de
- TLSH T169216227B3DDC921DC9A123A609D9C1076B682C7819ECF9F6BC0D62590BFAC8CB21194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 869a6585e850d8d84c0c873dbb279fa8b560f7cc7bc07f9b7ad2ffbbf8b1fbd1
- MD5 49fe5d1ed87103ea1c635849c18b5a74
- SHA1 2efb05fc6c0d893e5aa03a9f00ef2a84cdee9012
- SHA512 136ee3b4536c049621c39d2fb456c74d922fe72c69662e4a512cebfe6bfcdb37cda97376f897e8561cd650b8657df5e20c2bf760fefabe50b500c01292bface7
- TLSH T18D21A827B3DCCA21CC96123A009D9C1172B2C3C7809ECF9F6BC0D610A0BF999CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2c254aea8085a2dd4eb91fef354d485a2910bf3c5b5c40526011ad3986025293
- MD5 d37b991dc6daa6b0919e933d28d3c4a1
- SHA1 115e2a3e7d750859841ed0193c7309a0c40f7688
- SHA512 675ca15b4d805e0f9da359bb4d5fba602ffe3796dd1f4764ebc71d79ea8b629b5c85d757bd2d572dbd60db63ffed9904e1e7d871fb4b8c5f3efc82dbb1aafab2
- TLSH T16421A927B3DC8922DCD9163A109D9C1136AA83C7849EDF9F6FC0D324957FAC8CB21190
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 130837d325e52bdb0c396e455905db622a528c20fca56abe23e4cb40997560d0
- MD5 06c9835fa847cf002df56aa4012b1aa4
- SHA1 ea479eb66aea215c368b5520af36dd8b09299f59
- SHA512 eed873ec076cb068a7b4b319fadddd122ed9c6ab8627b9aec4fa8e2258b6ce758a0b69434d24b94d20961696dcb4ee11580018311c2b4e17efefa83af4118df8
- SSDEEP 24576:eu8m+1zydoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:7
- TLSH T11F47C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{eeef3555-7946-4e51-9e1e-af200824e03a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e3420457c4620c35d0a8868304af560bbe01e040d9b87b63e76e86dc7035f2d5
- MD5 cff652a120f587d38a767189e3cfd24b
- SHA1 65da388e5592ad8af99105e5b8107e345574bec3
- SHA512 07d41f242199b3a8523380a0f67ea01974322ee8a1ba39b2ebf36eb70689238dd4f0e786f6ce0132e250054d74f7ec056cbf8a8194693df4ccbfed4185c668de
- SSDEEP 96:FdylBA2vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Typb++ZVm
- TLSH T1EFD188085AE54711E2B3AB312DF54557A877B911EF33CB8E0298238E2671A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH