Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/09/2026, 04:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://hotelvaldecans.com.br/docsign/page.html
Resource
win11-20260911-en
windows11-21h2-x64
26 signatures
150 seconds
General
- Target https://hotelvaldecans.com.br/docsign/page.html
- Sample260928-e61vbsvcqf
Score
8/10
Malware Config
Signatures
-
pid Process 2356 powershell.exe 5308 powershell.exe 400 powershell.exe 5752 powershell.exe 4420 powershell.exe 972 powershell.exe 3468 powershell.exe 552 powershell.exe 5320 powershell.exe 5492 powershell.exe 5652 powershell.exe 5900 powershell.exe 2284 powershell.exe 1080 powershell.exe 5192 powershell.exe 4040 powershell.exe 4228 powershell.exe 1752 powershell.exe 2280 powershell.exe 5228 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 22 3604 chrome.exe - Executes dropped EXE 6 IoCs
pid Process 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe 5992 fleetdeck_agent_svc.exe 1416 fleetdeck_agent_svc.exe 5384 fleetdeck_agent_svc.exe 5560 fleetdeck_agent_svc.exe 2980 fleetdeck_agent.exe - Loads dropped DLL 3 IoCs
pid Process 4036 MsiExec.exe 6028 MsiExec.exe 2980 fleetdeck_agent.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\S: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\O: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 checkip.amazonaws.com 32 checkip.amazonaws.com - Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\FleetDeck Agent\latest.json fleetdeck_agent_svc.exe File opened for modification C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe powershell.exe File created C:\Program Files (x86)\FleetDeck Agent\credentials.json fleetdeck_agent.exe File created C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe msiexec.exe File created C:\Program Files (x86)\FleetDeck Agent\deployment.json fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe fleetdeck_agent_svc.exe - Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\e591217.msi msiexec.exe File opened for modification C:\Windows\Installer\e591217.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\wix{F50AF01E-F174-4B1F-8AFA-1059A924993A}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{F50AF01E-F174-4B1F-8AFA-1059A924993A} msiexec.exe File created C:\Windows\SystemTemp\~DF361083292D351266.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF4D1067D464770E31.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF0F7C8D7389BFE93.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI142B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI260E.tmp msiexec.exe File created C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File created C:\Windows\SystemTemp\~DF516B0D2367FE202B.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI13FB.tmp msiexec.exe File created C:\Windows\Installer\e59121b.msi msiexec.exe File opened for modification C:\Windows\SystemTemp\FleetDeck\fd_agent.log fleetdeck_agent.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe:Zone.Identifier chrome.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3604 chrome.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a0ced4dedd8b0f9b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a0ced4de0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a0ced4de000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa0ced4de000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da0ced4de000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe - Modifies registry class 23 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3\MainApplication msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductName = "FleetDeck Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\PackageName = "2406434489.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\PackageCode = "4396C18A14041E649AE5993E00E2B92F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductIcon = "C:\\Windows\\Installer\\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\\fleetdeck.ico" msiexec.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe:Zone.Identifier chrome.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5144 chrome.exe 5144 chrome.exe 4292 msiexec.exe 4292 msiexec.exe 5992 fleetdeck_agent_svc.exe 5992 fleetdeck_agent_svc.exe 5900 powershell.exe 5900 powershell.exe 5900 powershell.exe 5992 fleetdeck_agent_svc.exe 5992 fleetdeck_agent_svc.exe 2284 powershell.exe 2284 powershell.exe 2284 powershell.exe 4040 powershell.exe 4040 powershell.exe 4040 powershell.exe 4228 powershell.exe 4228 powershell.exe 4228 powershell.exe 5560 fleetdeck_agent_svc.exe 5560 fleetdeck_agent_svc.exe 5560 fleetdeck_agent_svc.exe 5560 fleetdeck_agent_svc.exe 5192 powershell.exe 5192 powershell.exe 5192 powershell.exe 5560 fleetdeck_agent_svc.exe 5560 fleetdeck_agent_svc.exe 1080 powershell.exe 1080 powershell.exe 1080 powershell.exe 4420 powershell.exe 4420 powershell.exe 4420 powershell.exe 972 powershell.exe 972 powershell.exe 972 powershell.exe 3468 powershell.exe 3468 powershell.exe 3468 powershell.exe 552 powershell.exe 552 powershell.exe 552 powershell.exe 2356 powershell.exe 2356 powershell.exe 2356 powershell.exe 5308 powershell.exe 5308 powershell.exe 5308 powershell.exe 5320 powershell.exe 5320 powershell.exe 5320 powershell.exe 5492 powershell.exe 5492 powershell.exe 5492 powershell.exe 400 powershell.exe 400 powershell.exe 400 powershell.exe 5752 powershell.exe 5752 powershell.exe 5752 powershell.exe 1752 powershell.exe 1752 powershell.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5144 chrome.exe Token: SeCreatePagefilePrivilege 5144 chrome.exe Token: SeShutdownPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeIncreaseQuotaPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeSecurityPrivilege 4292 msiexec.exe Token: SeCreateTokenPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeAssignPrimaryTokenPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeLockMemoryPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeIncreaseQuotaPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeMachineAccountPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeTcbPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeSecurityPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeTakeOwnershipPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeLoadDriverPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeSystemProfilePrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeSystemtimePrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeProfSingleProcessPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeIncBasePriorityPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeCreatePagefilePrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe Token: SeCreatePermanentPrivilege 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe - Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe 5960 fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe 5144 chrome.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 5144 wrote to memory of 5188 5144 chrome.exe 80 PID 5144 wrote to memory of 5072 5144 chrome.exe 81 PID 5144 wrote to memory of 5072 5144 chrome.exe 81 PID 5144 wrote to memory of 3604 5144 chrome.exe 82 PID 5144 wrote to memory of 2528 5144 chrome.exe 85 PID 5144 wrote to memory of 2528 5144 chrome.exe 85 PID 5144 wrote to memory of 3396 5144 chrome.exe 86 PID 5144 wrote to memory of 3396 5144 chrome.exe 86 PID 5144 wrote to memory of 4040 5144 chrome.exe 84 PID 5144 wrote to memory of 4040 5144 chrome.exe 84 PID 5144 wrote to memory of 2032 5144 chrome.exe 87 PID 5144 wrote to memory of 2032 5144 chrome.exe 87 PID 5144 wrote to memory of 4988 5144 chrome.exe 89 PID 5144 wrote to memory of 3024 5144 chrome.exe 91 PID 5144 wrote to memory of 3024 5144 chrome.exe 91 PID 5144 wrote to memory of 5384 5144 chrome.exe 92 PID 5144 wrote to memory of 5960 5144 chrome.exe 93 PID 5144 wrote to memory of 3068 5144 chrome.exe 97 PID 5144 wrote to memory of 4736 5144 chrome.exe 98 PID 5144 wrote to memory of 2360 5144 chrome.exe 99 PID 4292 wrote to memory of 4380 4292 msiexec.exe 101 PID 4292 wrote to memory of 4036 4292 msiexec.exe 103 PID 4292 wrote to memory of 5992 4292 msiexec.exe 104 PID 5992 wrote to memory of 5900 5992 fleetdeck_agent_svc.exe 105 PID 5992 wrote to memory of 2284 5992 fleetdeck_agent_svc.exe 107 PID 4292 wrote to memory of 6028 4292 msiexec.exe 109 PID 1416 wrote to memory of 4040 1416 fleetdeck_agent_svc.exe 111 PID 5384 wrote to memory of 4228 5384 fleetdeck_agent_svc.exe 114 PID 5560 wrote to memory of 1272 5560 fleetdeck_agent_svc.exe 117 PID 5560 wrote to memory of 5192 5560 fleetdeck_agent_svc.exe 119 PID 5560 wrote to memory of 2980 5560 fleetdeck_agent_svc.exe 121 PID 2980 wrote to memory of 1080 2980 fleetdeck_agent.exe 123 PID 2980 wrote to memory of 4420 2980 fleetdeck_agent.exe 124 PID 2980 wrote to memory of 972 2980 fleetdeck_agent.exe 125 PID 2980 wrote to memory of 3468 2980 fleetdeck_agent.exe 126 PID 2980 wrote to memory of 552 2980 fleetdeck_agent.exe 127 PID 2980 wrote to memory of 2356 2980 fleetdeck_agent.exe 128 PID 2980 wrote to memory of 5308 2980 fleetdeck_agent.exe 129 PID 2980 wrote to memory of 5320 2980 fleetdeck_agent.exe 130 PID 2980 wrote to memory of 5492 2980 fleetdeck_agent.exe 131 PID 2980 wrote to memory of 400 2980 fleetdeck_agent.exe 132 PID 2980 wrote to memory of 5752 2980 fleetdeck_agent.exe 133 PID 2980 wrote to memory of 1752 2980 fleetdeck_agent.exe 134 PID 2980 wrote to memory of 2280 2980 fleetdeck_agent.exe 138 PID 2980 wrote to memory of 5652 2980 fleetdeck_agent.exe 140 PID 2980 wrote to memory of 5228 2980 fleetdeck_agent.exe 141 PID 5144 wrote to memory of 5684 5144 chrome.exe 143 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hotelvaldecans.com.br/docsign/page.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3b7bc728,0x7fff3b7bc734,0x7fff3b7bc7402⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,2820839370109589299,1194956800884164490,262144 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1996 /prefetch:22⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,10590676551161264058,18144995454320367849,524288 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3036,i,11612742230825683881,17339623713165867484,2097152 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,6008648639405192189,11352734167841611841,524288 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2592 /prefetch:132⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3040,i,44267735302903145,11601898900811280795,2097152 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3112 /prefetch:12⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,2959621827127704200,13777331005217220823,2097152 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4320 /prefetch:92⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,1575989503674014415,17986727940698494364,524288 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5740 /prefetch:142⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5124,i,16358432184528987843,13764708869038600456,2097152 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,84557474244971255,3175121867214220121,524288 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3664 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5384
-
-
C:\Users\Admin\Downloads\fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe"C:\Users\Admin\Downloads\fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3036,i,6645149974661405703,4126569931891926304,524288 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3920 /prefetch:142⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,10386366673741573310,15675246326317145488,524288 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=212 /prefetch:142⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,16535608117295927348,17829018593737197771,524288 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6832 /prefetch:142⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5068,i,2579974531707380610,14582400804861034250,262144 --field-trial-handle=2000,i,10559359004670574320,14149630763967541624,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5416 /prefetch:102⤵PID:5684
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4744
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4380
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4FCCD33ACAF405D8C4CE2594072E81752⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4036
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID 27663db8-c14c-4c90-b17a-c5f7cc6fe3e2 -askForName=02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5900
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3A03BE4D903D640A7E1694CEC130A68B E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6028
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2968
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4228
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service2⤵
- System Location Discovery: System Language Discovery
PID:1272
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5192
-
-
C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1080
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4420
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:972
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:552
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2356
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5308
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5320
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5492
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5752
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).NdisMedium | Select-Object -First 1 "3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1752
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).MacAddress "3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2280
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty OSArchitecture))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5652
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " function Test-PendingFileRename { [OutputType('bool')] [CmdletBinding()] param() $operations = (Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\').GetValue('PendingFileRenameOperations') if ($null -eq $operations) { $false } else { $trueOperationsCount = $operations.Length / 2 $trueRenames = [System.Collections.Generic.Dictionary[string, string]]::new($trueOperationsCount) for ($i = 0; $i -ne $trueOperationsCount; $i++) { $operationSource = $operations[$i * 2] $operationDestination = $operations[$i * 2 + 1] if ($operationDestination.Length -eq 0) { } else { $trueRenames[$operationSource] = $operationDestination } } $trueRenames.Count -gt 0 } } if (Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending\" -EA Ignore) { return 1 } if (Get-Item \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\" -EA Ignore) { return 1 } if (Test-PendingFileRename) { return 1 } try { $util = [wmiclass]\"\\.\root\ccm\clientsdk:CCM_ClientUtilities\" $status = $util.DetermineIfRebootPending() if(($status -ne $null) -and $status.RebootPending){ return 1 } }catch{} return 0 "3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5228
-
-
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
3System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59121a.rbs
- Size 219KB
- SHA256 3ae35686b40b2954645c8402a43227e0748b8c5055303aa0c5f426611b9ad61a
- MD5 e3cb3c39ce466fbd7b5580be936ccd1f
- SHA1 12f79588bb620571c7bde31e6636495fd74f862b
- SHA512 e76b6cb588cbc18aa4b2c87c785268caf7560d29034223a42d680d24397cc9f74fc1130c3449ae4f4e3b2987e8d600ff0f1ee89add6c068197a474bd86b7e73a
- SSDEEP 3072:uJz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaD:ut/kE1jOZy2KL4GBiwQtEa4L2sU
- TLSH T1C0249D216090847EEBFA0936993ED671BF7DF2241760C99EC3848C1E5D644C06BB7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll
- Size 1.8MB
- SHA256 a075919c65120a8a92d3a11895ea456ccbee501717ddb17b29578c029f0c0051
- MD5 39b34a26dc09ffa1b2923d5cdd473eb5
- SHA1 a706ee87242c0597fae398eafdeaf0d9ac940903
- SHA512 930409f08616ae33b3534ad580c349160f77a8b8ea0e077debfae420888855138730ea284377b7b3fca878644d7b2bce7de2dfef0d5b2354a5cab5ae439ae7c3
- SSDEEP 49152:WhX2UquWo4tPAmyI0wxJ1hbL9gghWGE1hKk:WhX+K4iEbL9LhWGU
- TLSH T10D858D22FC41C035F9EA10BAC2FDAEBE98AC8520037806D757D518B69E615D3773D29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe
- Size 6.3MB
- SHA256 7ae8daaa4639ea38723ea77b67ce22e5312e8ac7dd20c016c41b2a88432ba989
- MD5 e3fb748bfdcaecd85775077589aab08e
- SHA1 a491e836d76989d343627f12e6c2669fd38b03e2
- SHA512 503aaeb6631ff6fab157d48ca83c50ca44eac075f9ece9e9574be44c1d6176ee1c4f92388fdf54067120f9dbda725174e5f82df05c0891eb1fcf03f8f44e8398
- SSDEEP 98304:El8YgLZng+nOMxdgiI+yy4UI6fXmkiv7PK9:vYgdgQxyhNkou
- TLSH T19C664B91F9DB40F5D903183044AB623F67306D0A8B35CFD7EA507F6AE9779E20A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 d07d47dbfe061158592097c738528a808eddb1d05d02459b4fb5d01cde4a735d
- MD5 78bec61d72609ad32b5c92b12b5acdf8
- SHA1 88375de8357133ceaef024a32247d8cc5ae7fa07
- SHA512 ba2de1335cd28a4e80a12217e5f074001f3371a5a23f65fb93ed7e7bfe6240637822fd0c32074dbb35ba7f59ded91e441455ecf46b76eefa2b36cdff7947318c
- SSDEEP 49152:N5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQ4:N5wTWNupq+w67Y8ZQmBKYUWaBtTHk
- TLSH T16B562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
- Size 69B
- SHA256 40809e9077e89ecd3458c4d8b42bb6fecc205fed6c07616a568cd091da028280
- MD5 936f04082ef38e14be7b906027ec3eb7
- SHA1 e3f959937dafe6c2cbc31ddf4614563a141d6fdd
- SHA512 08582b6e3d46dbe66701d81480878e811d3f99ef9c738c190874caaf6ad12bf3d30935c09c47a9a101c3b92125865e2f074a02219d92ccdcafbf93e2bab1e68f
- TLSH T1EFA0220020003CC3E08082EC2038038203AEB038208008C2C00B0CB28228CA00A83330
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 f7d793f458450f8da205887757af84967848fd42c8be78dfcd00524e6cf2ab65
- MD5 2854313d8826aab27a90611b85ef3671
- SHA1 6bcda85950590ced34406062000ffb1bf36b58e4
- SHA512 3ec36105f398f36cbeae2cb3ab5949e4d408c1b2417ce8fb2f9c88c99f72822fb96011849a61db28991fd91ebd5bc0e2c2ca681ebe9672d70b4bda91d1610d7a
- SSDEEP 49152:85wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQy:85wTWNupq+w67Y8ZQmBKYUWaBtTH2
- TLSH T1AB562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\latest.json
- Size 102B
- SHA256 564623c3fd47db24a7cdc9e4e31cdeb7ff0d42d2de527fcd1f2dc7b4b3ab017c
- MD5 9f75b0938a972c6fa01dff8e83d4fa59
- SHA1 6685900a7fa4f2ec4e050eebc550859e317d93e7
- SHA512 7eb8a43c317123ffe128ba31db9787c45aac9541764f4ae2bab8e8f76b5f16ea6d0eb815de57533c7f3d78eb3fc42642b2dc996927350269678f985e614e5c61
- TLSH T1A4B012F20C963073C27201D014F450B852038AAB4182680DF1824300E88C2BAF48327F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 765B
- SHA256 43942ab85dec018f72d092c839ba6b0f10ac9da1169de200392c6effb6d893df
- MD5 040bdc663bd4871e02afce8c6c2be564
- SHA1 c91a7232f6511599cd546c77f474c1f14627e264
- SHA512 609dca63556597c1c817b854250f80ef1f329892f7593dad137e318f3558b3b894453fc663ba88d6e8f5a10124f73a5043a9b3992ee82e3d7d9165f9e188addd
- TLSH T197017521CD76C961F31556B00C79E076613431A934D34F593C54D848150DF69B34A848
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_C7279CCC51A16695E97940FE002F16B3
- Size 638B
- SHA256 04e7e0fe0377ddd5a43e30f16c4f8760c744fbe0d1b87e301964f41e46adf113
- MD5 68bc18a89a14c7da2626e5d2da7ec98e
- SHA1 010ba8e073da8308e4eda13abd114cffea050b7b
- SHA512 22adedd01ef3ab46d6ab4570c43de4982d451c955d82ce27a89f7f6b684fc9562ac77c57963f6d02bd061557c0f5edcbf135f30b7de2f59e142bfa6a1905d143
- TLSH T146F0DD034935C8106FA044090CA5F05D124054C618D7661BA929AE892FB6793BE8F45C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 1KB
- SHA256 03ba8ebfadf730c8b0b81ebf3a8267f666840ebe5de1aa0d4922bfe30f5bb9b0
- MD5 3860828001d90029f170327de360c177
- SHA1 4fdb846de662b3239360409ec3fb6f129983c27f
- SHA512 a288ff5fd79455268bf8033e3df16c718dc8b1e186a912734f77f73ec6d57f710c483837cb89ae8b64470b11df70459610ea3e073e6dc02b9d3dc216edecddcd
- TLSH T17531C9D36FB4B8119E165C9898DCCB627CB038A6B8640C783865419AD077F64548880D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 484B
- SHA256 3655035a25ccfa5fa2d8a8d15d377607069a1b1ed259fdba700e21a14d635c66
- MD5 f6d1f2b79f4354f39038bddb956533d8
- SHA1 454233488eb9be88b7f9188aa65dc642c70b0b89
- SHA512 c4f019fce6b90a82aaf2ed792f7f7e1892ef45b24502645fecb2c8425ca8fc0bd8d08efce96bcec05af5c033185fe98b3d5ea089a11edea7ebb31fc099d2c94a
- TLSH T10BF0A33409FA423FF174DCB415DCB126AC1AF216100181B91AE517045B07D00ECD046D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_C7279CCC51A16695E97940FE002F16B3
- Size 484B
- SHA256 d83d9d1de7baed98240fde7277b3789e31337ef72927427475206b4d0b1527f3
- MD5 5186f28bab6a2076b009b218151a90d4
- SHA1 9b502201278fc8a31ed753cff2ea556eeb436588
- SHA512 b7d5c61cea096aa0c9bac4bb37c94064f96d6b5232b41b8ef243a84cc880ec42f8ffb4c36365e1bc3fc94d51ab5c04fae60a64c30d1fda802df9d6c21fc09fc8
- TLSH T1EFF0A3202EFB006AF4F5993A87D451C34D75F1253406C76F2792070997026028C51D75
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 482B
- SHA256 1a5fe8fc8ef91889af5bced84d9596d4cbfc2d8e5e7825c87da5c20244925609
- MD5 ad229f951cb5377bf8d136528c58dcac
- SHA1 2e4e6f822561d3822ccb043d003fac18849c6050
- SHA512 c9f3d2460f3515c384ae561c478db32bfbb7a849dd0cd8d7dd4f42adfa575be8e966c58044398abc5d18adc669032ef0511096a0f57f2cabde410d594d6dd272
- TLSH T164F0AB282ABA003EE236CE7587D8A2AD6CFDFB1378411A620668430A670E9425D60937
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 8959c6549697a2fe5ba55085e05f793513e6279b99c2d9891cd68c9c3a74d6fe
- MD5 c29c008520c623379803fe7d25bda2d1
- SHA1 c4c08fed3cc9453eb3523f01ba4abe917bd2aa9c
- SHA512 d1f74703118f01885bc973e8b00a0cba86bf0c13e55a623d25fea0b9532568dea4208c007b1a4a4cdda0f42f7a4d185b2d8df992f0ab3a530c48a180293f16a0
- TLSH T175F0F4F5DC21EC2B18FD0B1960A50A46EB55132B2B81895F3B3D910D8FB5A3B459989C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aa662b8b-ef99-4373-b2c3-cedd37357cc0.tmp
- Size 3KB
- SHA256 5aa41fd378d99253002e41d32caf64aaf10b839f5991fae36e25adc6d345cd18
- MD5 dd7a7e3c563e59a0d5c79cae014e8837
- SHA1 3f88a739f7471d9ef278f4b7da32405d14ca28f8
- SHA512 623696ac82f469d6c152ec1554662293712ad4bfcafbc50c83dc99a9c709c1936f9203eec4d7ab598437937173a97cd342263817fb07b4ff97410447ff65013b
- TLSH T14C818EF7C3E8867DC91196F8AB256E6BCE690914532C3C57C8D89E1B93E28B1D24064F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bdb2be39c45e7cece01c7f6087788e5f30702110051989021b778978bb7d4fcb
- MD5 7db5bbb7ccd4885f7c088a4a1480876c
- SHA1 618edab763cba6ae187a2cae7745deb20f085745
- SHA512 1408b798dd73ef00cb2fe6e9ac20db178f228d5af2986553ddedff472c9a3565f0a10a1980305e733ab0483655a45d7c9dc8ff9d27d5139456e690f768b6eda0
- SSDEEP 192:xRimfrKLhbxHv7fpAPRp2+39UHsb+WNn0JIi5e2ORxMkw2yR3VyIsnAUge:xRim23PjUXDWwcIV2bhTe
- TLSH T1E742C72EAD10797F5CEBD22AFA267B63E7F5102164A42E84EAFC883C15D75CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9db54cb543c16521f4d05224c8e7bb618cf8b30e4548b9ecd70ff049bb0fa659
- MD5 c2af489c40c566e713aa7e5fb6655f64
- SHA1 b98ce954549d665810129a79ebee9ac6923eb5ce
- SHA512 482fb56e171e830196555dc48eabf666dca4a6f7a4a15c436b0fb1dd3b9b6b21849a3ee73be0c1e5a486671543b6c850f9e1fd2e48bf6a34b445c03b1ed2f90a
- SSDEEP 192:xRi2frKLhbxIv7fpAPRp2+39UHsb+WNn0JIiIPe5RxMkw2yR3VyIsnAUge:xRi223UjUXDWwcI1eShTe
- TLSH T1A642C62EAD10797F5CEBC22AFA267B63E7F5102164A42E84EAFC883C15D75CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9c0dc80b75ad9b357a3a70934c4f33ad89aa94689b28a7b77c8b122a9ba2510c
- MD5 f20dd634df547f5f159ab1b18241cff9
- SHA1 3e8f596682bf2acc51cc768096f9f88c8fd017fd
- SHA512 22b716f1589467454acae7ac172a3c394d675c5d7b0b1c10a09f2fd5e71c3d5705bcc4d6b8f6001618db1aa66a50553765895d9999c431bdd938eae0619db604
- SSDEEP 192:xRi2frKLhbxbqv7fphPRph+39UHsb+WNn0JIiIPeiRxMkw2yR/VyIsnAUgE:xRi223bmjjXuWwcI1eXhTE
- TLSH T10252D82EAD10797F5CEBD22AFA267B63E7F5102160A42E84E6FC893C15E75CC2113457
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 00b1f5e3f2ee15e41635cc5776beecab26489b83cc8da1b01e578cec0f125545
- MD5 4c845b2618eefdd47280df258df1e5fa
- SHA1 90d6142c1453e2f700bea476669cfb9e36befbb6
- SHA512 4f4b1bf9d6b776e477d3ad3578fd52d3bab53a83694fa9eecdba8eabeff22ee1e9679f0c42ddd6998d0b7c0b64c1dbe2a8235c40f3d2f87323a4df5053bd2ddf
- SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLuLceSOPXODU/+ErU36GHGiGTE9t:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7pT
- TLSH T11872FA67AC4C9E3B0F94CACDDC167A4FACB5024B65E9886443FA5C2903D5ADF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 75d0635fe518c65f18ecc5a44bf4571b71a7db4faba9761d348aaecd1d089d12
- MD5 809db73038fed81cb602d0f9da8c74f2
- SHA1 ae42d1c8b0dcd5dccf86279d1b838b5d303fb929
- SHA512 71fbccee5fba5567d23fe34bc42d9f8a696c0bef1d41d082162680dbcf32c7b7d915a70811de9d42a926edc46df7b86e20216660208a3d8bdd095be8bb4c7a4d
- TLSH T194B01205D0433745C01303F11154985536608F34D212138A51E01D419C31150405714C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d358.TMP
- Size 96B
- SHA256 765e7b8054f3a19a0fc85114f8a10393067c74ddeb0da5c11eebdfdb33180f07
- MD5 48cf644df775b5fb1f8cee51d3eb9cf5
- SHA1 774e55300b15f1f4fb62e2bc4fac08e183fd2f4f
- SHA512 d74063c49d0887d5c1def3f476a49c1d02544a0afa17df954ca7ff5b6da8402eee90c9f2a5be47b2b685b1b8bd5d401c461075db0372fca6738567c3ebc32a7b
- TLSH T14BB022E8C003A203C08223B02AA880CA3020CF20C303032A83E00B22FC3022000220A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 afa316996107ef4c290ef1cb7b4e78168323742c647501d966cb876157daaf1a
- MD5 d33e37847c0b699a40a7186b34bae888
- SHA1 31d5c72b6504dc6c6011479cb4d68fb7a26de9ff
- SHA512 9478b0ee3780b36c1b86956f963facd41afa7cd2c18696e0c295bbc43261733be166dc11271355f71f05ac9c78d92dcf37d006ca2c6f9a530af3107eef1a13f6
- SSDEEP 3072:rjNH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:rjDt4fLJ0L6nGJxi3bzqapJjP
- TLSH T1FBD302F1D1A06C7ACBF7EE5145756E908EB1D5C289CDBE2409ED8D1806CEA344E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 02c1919825946d9a166209246c8485dcd50c90f69b46958d93c5a8ed163d6f1a
- MD5 0e81b0f85f3dc10e8a70a72e91857a09
- SHA1 7d1aa6a01f30509399950b0360df0bfd402746c0
- SHA512 bae84745db8ee4b8cd3e69882f551dc304c6c173d1f4fd78dc571cd033a33dd8526fab3bb48f21de7dc9aeb0a70d9b0a352593c614663a8e1f8738c7a3454313
- SSDEEP 3072:OHDH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:OHRt4fLJ0L6nGJxi3bzqapJjP
- TLSH T106D302F0C5A06C7ACFF7EE4145756E908EB1D5C749CDBE2409ED8C5806CAA394A13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 e510d1cce077de705fd30649fdd317c5b6421ec2049350762e85365579f2325f
- MD5 dcbdecf595caf122fcf611c30a3b25e6
- SHA1 eb89d36fdd98943f02bf6b54a2f498d4e50ca5da
- SHA512 52729687ea24fa91044baf03a264b0bacd8fcad40c3cd00355e3bed1139f95aa81f29da9854eeae0ee2415fec84bcccbadffaea557b71490db82811547295d11
- SSDEEP 3072:f1H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:fbt4fLJ0L6nGJxi3bzqapJjP
- TLSH T161D312F1D1E0AC7ACBB7EE4145755E908E72D5C289CDBE2408ED8C1816CEA354E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 2392a8503aff6d417a98b11204d046210d418a5d6102189c9a029b38624200c2
- MD5 0dad6900572aab6a3d143eca7833fca2
- SHA1 332c9db5c4ae4fdfd40effbbc43fdcfc11b7a80c
- SHA512 c968c96e5b82c34803b7d4307f2dee7031d642f6fcca54666f05ad69f29eef2eccf6387bfbe827f16b840e042c5866f7648f1d52892604bcc71bf9616d9f2164
- SSDEEP 3072:qjNH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:qjDt4fLJ0L6nGJxi3bzqapJjP
- TLSH T1D1D302F1D1A06C7ACBF7EE5145756E908EB1D5C289CDBE2409ED8D1806CEA344E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 19e575c84fb7dfbff60a5a56d3c0a6fbaff80b8684088993ef99c9c65e989375
- MD5 677fd75b2d967840828c1871cf9fd0fb
- SHA1 b97f56b13e70618f07651bb968ea77a318a2e910
- SHA512 e2349e3a174d52cb5f4975c6708b53309f0f5ed1e9df6bdc7790c6d26bee054feb2c36c2513261126890f4161ee5af23867e102e22cbd0fd77b7fedd71f1e71f
- SSDEEP 3072:ijNH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:ijDt4fLJ0L6nGJxi3bzqapJjP
- TLSH T136D302F1D1A06C7ACBF7EE5145756E908EB1D5C289CDBE2409ED8D1806CEA344E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2406434489.msi
- Size 2.3MB
- SHA256 0eb3b3136035ed9b30c1071cdbb69db06a871e04feda8a9cfe8e13ee82aa4d4b
- MD5 64de8b74901084b6c96a4a47fc97d564
- SHA1 8012fe251350dbb961070d6e84036b1bca6e13c5
- SHA512 7512e03df8359c9cfccc096aa77dba17fd453f35c4a8ec2169ccae25c1441622a3f28c707b1f7b22d146ab4b2ece707bf4824656f931568299141085bb3cc1e2
- SSDEEP 49152:3+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA2:ELaeoi+0QFfXp4O
- TLSH T119B523213548917DC7FA0D31952FEF62BE38FE180E20C56A93807A5E2D715906B77BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 90880.crdownload
- Size 4.2MB
- SHA256 c026a6819186ac2fa27d0b225874cf72e179cfc68851c9b8b3f03259f818132f
- MD5 2883b003f26dda7ef2cdeac9912204bd
- SHA1 c5688f8260b310e662731b8c10ea61044408c325
- SHA512 b4ded5a288a65ac609577e8f5acb57b96c38fc292246ebfd96cd2496da87420b53ea5c4a8cd93531978e5ef8a2e6f3fa995c8c6b0f18d788056dc2586f4dc504
- SSDEEP 49152:FP0dfmVfyr+CU8D1i+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA26YuX:FPt6Laeoi+0QFfXp4OiX
- TLSH T12B16CF90FCDB54B5E603553158AB62BF2734AD094F31CBC7D6407BAEAC73AE10936229
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\fleetdeck-agent-5sBYYxdBrX4efazfLaTWbT.exe:Zone.Identifier
- Size 156B
- SHA256 bf771f77df984f06050ed6b03a2f091b3eb517a9a6d0d254d261ac4faaaee973
- MD5 ff2ebc091a4dd26280b205569e7c2444
- SHA1 8e45f743abc7990eb69e58552887f23d6793098c
- SHA512 74c0be6f1e0c194af16944369804c023b755010cbce26401532467bb77d10bf3846afbf3595d968efd00efaa2613883b173b0c19fa5bf1729d2d2f98e18e3cdb
- TLSH T1A2C080625E0072305B3813981C65E5A6574FA545C4D24390F84045499F458E86DD5417
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI142B.tmp
- Size 211KB
- SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
- MD5 a3ae5d86ecf38db9427359ea37a5f646
- SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
- SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
- SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
- TLSH T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 947B
- SHA256 15ce6a8f1e0693d9c720a821596627a1d2dcbec0c14d41a804c2b48780419fea
- MD5 6976079d4a0e3793ef6ad50bbcaffd12
- SHA1 5db470dc5756b612f7a2871eb997fc41cea67934
- SHA512 a55fabc02e9c348fe2b98773f799163b5788a01bf8c47b9e28c2cc3800c9ad555efd8ee86da6a81b10e979db16e60a7779048fd15df7af0f6e661a50d426496b
- TLSH T1DF119CD22D0160FEC9320A93CDB21AA3D7250751BF1EED25B7402181158257BC4F50EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 1KB
- SHA256 468a9fd874603909c4b8c1bd4363db7a9704d6ab40e434cf6a7ea562e5638568
- MD5 d63389263df8272e04576b9071610908
- SHA1 649d95b67f8cd87c857a4e2f2b12b7d0931887c3
- SHA512 b3c0e36c7555866f4141a5b1e4dd8124b930e9bdbd94f19258eb76032f2799ad1a98760f758abb1ed5ade82b34bb06b0b3261613d93a4ba78e150ee1935796b4
- TLSH T127317D862D51A1FEC9221A93DDB31EE3E71647527F1EED2477402181158257FC8F50EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_rkzqr1vp.tnm.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 97ccdff47a34337e54bf2df535a2c54070b0e2e8b7e07934ecd7f6d83140efd9
- MD5 d5f91e31fad63859fd0448f9d920a8fb
- SHA1 2cbca9e8dbbae365bd098b63711d5b4faeabdc3f
- SHA512 326596b74b4843753ef821e37aa6b2a244494a30edfc1851bd3109ff0e520f5ec282857a45711fc85e2ea0745555e576ecd4741b2d283f1ae0f47e1ee320e1f9
- TLSH T19181CE323375B0D489563F07192C19C463AF4396EA54AF4CB65C620EE92B14BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 121f10e5fa54b6733d841560734f41cdefcdadf76c5ec90afbda33c383a7e409
- MD5 9f4b0b05d7de29077eb741a23b371200
- SHA1 32f0b8f943d3615f3daa0f766e283294b3378d09
- SHA512 286f079afe65d507db0f4dba36b6afdc0de20df6e0d846f6b9a7762e783d89a08c76172c51608d9789c3315856c1b8fb5767da81f02c9aafa1f7c07e57a81a17
- TLSH T122214833B3ECC526C8D9117A208CAD0071B5C7D7449E8F8B7B84C619957F9D9DB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a29e41a61fd234beb8581e8ae8b7bb78d698b8d7962e14a0feadc9cca2ab41ab
- MD5 d30b757ec847294d76879db597484791
- SHA1 a3bbbbff114d8bd26680988f9f60e58a09feeee8
- SHA512 1ccdf78046cc50cedbd897e309475b6d3d147e4e24b9c5f4a1a830451d35bb0b817f87dbc8ae85f088b68fed6bb627b5059d35480e30cb5e8bdb9825b8db1d10
- TLSH T173219A33B3DCC026C8D9117A208CAD0072B5C7C7449ECF8B7B84C6289A7F9C9DB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 31071e86b230341d3cdc05698bae6ce56123c6959f013f890606e8bf1d3947eb
- MD5 4c3b5aec90667224172fe394033273a1
- SHA1 c34affae419346afd94967be4df53a87c73d5eb8
- SHA512 f4520b8e47f766c7da57a9b29a2da49d9c04351ea5bf302fb520d4e4c6850e3b4548fedcff4245f664f4d60700f5225bddf1a75c5bbfad02cfe5c1ccc91c74c0
- TLSH T193218737B3ECC1B4C8D9027A1088AC01B1B6C3C7449FCECB7B84C408A6BF999DB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0463ceda029d1c9004126b0342af96da50eb1be2327012b3119f22ad9cf4cb1b
- MD5 33a62ca531557bd99780595f1c716315
- SHA1 79dd1e4296c5b0ce643ae085f5af29ca4b243e24
- SHA512 c997d0d19708e2707a8d2448c99d1b32a6adb31c8cd1ba64aa06276aeeef98fc84f2f4f059ef98d7cd0cab7e317955cd429d333f345b01349707f33afcfc85d7
- TLSH T176219733B3ECC125C8D9117A208CAD00B2B9C3C7449ECFCB7A84C618957F9DACB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5d2881758eea7912f0037405831f962d385737cfd6f58bcf190538553b7e310d
- MD5 6a2fe7f8795ba8d150aaf61af00e154f
- SHA1 90235d36aac5baadf1ca5d569e274e9e64daf980
- SHA512 3a5746f35829bb9d3f4cc9880549dfea02a99b2936023473955e5539078811556381850eed414288f874336457873ead35f2d855c88809ed13aec7e5c4ad1c6e
- TLSH T10021A833B79CC134C8D9017A108CAD01B2B1C3CB049ECECB7B84C508A17F99ADB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a7dd972424019b0668bf196b34e30295110a5c9378ea780675fd8f5a7caa4067
- MD5 6ff68ca130fbf845f7c96be4f56f948a
- SHA1 b8b3e8e95bdadb0cf3bb816987fba434b15b0e75
- SHA512 2cf787777a2024802c319a480e71684ed174319551fd5d02a54ba77bbc9dcb49bd188b9b2bfa0669ce3257fa5d4613c0784c9bafdeef0d64b7733529c8c575b9
- TLSH T16821A833B39CC135C8D9017A108CAD01B2B5C3CB449ECECB7B84C508A57F99ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b70c5f6cb630103fa7a96bdde12ab6a2fd0ff0fd026b61dc1123e46f9fdc44c4
- MD5 30e02b803a8a3a143eea476d7ab245a1
- SHA1 d3bf1f568172e8125effe5b29bb57a8f9483fbb7
- SHA512 2a1dcf83e601c0b6969898767d2f85689f9e483922658f6e4a09f993cda75106f46a8e3a0cdd787710a203c162b4b508f84bd05585b3d18377c9491eb08e0dee
- TLSH T18121A833B3ACC135C8D9017A208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b9b64dbc0c0554d158ac1391f6ad1ffcbd05d872f371a2212c260237819f69ea
- MD5 507b3fcfe6b8ffccb71ea0d5f9ec3fb1
- SHA1 dc2327468b207e3594ed7cbdee07719dfa65653f
- SHA512 1278f7a736564657ad91544f58b1835b52f59cecc78544db928323187339fd7872616a1c6fd54316a34b2947fc4b2c2e21aaeb5f739ceb8e4b5220c0e687d2c2
- TLSH T11C215633B3ACC135C8D9117A1088AD11B1B5C3CB449E8E9B6B84C508A57F99ADB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9baeae692e8a8d11f50d120ef6813b5320297b9d9cab42f08b0e9d757bce683d
- MD5 f3ac3d6d29c3ec361d7e4812b8c14b46
- SHA1 e208ed5297a999f666bf72d967375d518d097adc
- SHA512 47675d81f36efb240a1d0d77d0f869bc8fa823d96b0b5c0de578676be034482e29507a43313d5bbeffd3ac20fdb54fb4a3203f6b88eb72d21c6985984f946642
- TLSH T1FF31C03BBBDCC1A9C8AE057910DDAD0072F5C3C744EE8ECB7644C1045AAF4C9D7689A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7647fd2c87446151dbd7a7872878dd79c4c36a975e514aa3e481438a33775b90
- MD5 9d7cfeca1163573a16c5ce4cb7c55b12
- SHA1 7eb2a5728c1b8741ad03617da03ba700d1a5053e
- SHA512 620a1b0b937aa0f381d2e4733f6e688b4ecb0eef873c755ca8154092ed462cb411fb372ccfd1a5c640ad9c9e3979189167dfb4d93c4e586e70b6959ccc79300c
- TLSH T1F331C23B7B9C8169C59D157610DC6D00B1F5C3C78BDECECB7644C008BABF989D6649A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5f07be4dc76f6004cd5dbd26f176fd55a5ee69869f8e216200a27343bed8df1d
- MD5 5c5a0f8d8f38b9a0e39059ae28088aa6
- SHA1 30aa610db06f7511090e64bd6a8c3019365325d7
- SHA512 b18a6e5736597383c4a8f031fe8650a9e6cccc731aaa16bbf69d8cd3ba5bf7277548d85b2a704118f69261d746dd4c75de8dfcf2bf14bb82249c29624e0b037e
- TLSH T124216533B3ECC165C8D9117A208CAD00B2B5C3C7449E8F8B7A84C619957FADADB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 873cdcb3d220cd4d0c10de4fd360e1692b91bc5a31f8bd3cee46f13f72e5381e
- MD5 e10a16596a40bfd770832b19b53168d5
- SHA1 a1fe66b4d4634d69c18416f18f6a8e7833b4a0f7
- SHA512 3f13599627c3272936006a581fd86e24c85e934c763639fc889b0d882b34c99268ff8b6769272ea47b88e86c9d0e797064de1a5b44e09c41ac409b25cefd74fa
- TLSH T1C3216533B79DC025C8D9117A208CAD00B2B5C3C7449E8F8B7AC4C52995BF9DADB681A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5b1ca5bda4121b63d9b33be57a1351a661c46e4c204e6ec4a45da074d7db45e5
- MD5 ca785a4b662958b43be534c5f40cbc9a
- SHA1 ded159747c0e782e6341952a9a702fc165b4e841
- SHA512 9b7f35dba8b2c850246b0f84bb482bc6fe026e79c52b21eae5b644c29e0752a9e87b2f31463155de6f46529aca7b148134d3d912fd97dc1846187795b870f036
- TLSH T15521A833B39CC134C8D9017A108CAD01B2B1C3CB449ECECB7B84C508A17F99ADB641A4
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 2adb4eaec94183f832f0ae434401b8e3e94948656ecdf3bd82fc57bd8c798497
- MD5 5527c3399ba51d58f88b1e8d13380883
- SHA1 6f0ba936813a573a2b4dc09b20df25d1a8b3f8e3
- SHA512 185e8bb00a1ddf3dfc11a4526f890e9eb75bc62d966a81b3b9afeef8004907bc5c1d1fda04d7bd9c8934411a7135fb97b5566d074019663590df185f20c5bb0a
- SSDEEP 24576:L2gmSp1tdoO/vvTLrmAuhUHqf6JrQYkq2WTdXJEwpbaIkM0VoLBnrd6nh:T
- TLSH T12847A12436F92240E7F79E7CA8F06A234D3A7D5B9C199E8D45411F4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ded4cea0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4453bfdf-574c-47d4-a4fd-d90802c0d169}_OnDiskSnapshotProp
- Size 6KB
- SHA256 22842f86872298a79d3441a56dab9c734dbbac3e752cc540185d53afc1dc24e4
- MD5 e067d906bac46511664757a2e7cb04f7
- SHA1 83c8c7945a07b47b257958ee652dcd07cce739d6
- SHA512 a9ec5ae1a2f437bcb51ee716d5f94e9b703faed360f041491d8ab7a64aca3e8855b500c869e43572f02be9559eeb0f59dfce04497fd7649a1d379aa040cecfdb
- SSDEEP 96:FWLTylJI+vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:oHyMEb++ZVm
- TLSH T134D199085AE54711E2F3AB7129F14557A877B811EF33CB8E0298638E2670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH