Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
51s - max time network
73s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/09/2026, 03:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ptai.in/dsb/page.html
Resource
win11-20260911-en
windows11-21h2-x64
26 signatures
150 seconds
General
- Target https://ptai.in/dsb/page.html
- Sample260930-ed5mtaz13p
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell and hide display window.
pid Process 1928 powershell.exe 576 powershell.exe 4548 powershell.exe 696 powershell.exe 560 powershell.exe 652 powershell.exe 4984 powershell.exe 5076 powershell.exe 2156 powershell.exe 3856 powershell.exe 1744 powershell.exe 2960 powershell.exe 2980 powershell.exe 5032 powershell.exe 4544 powershell.exe 2952 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 14 4108 chrome.exe - Executes dropped EXE 7 IoCs
pid Process 5008 e-sign_Review.exe 4540 fleetdeck_agent_svc.exe 2452 fleetdeck_agent_svc.exe 2280 fleetdeck_agent_svc.exe 4980 fleetdeck_agent_svc.exe 2056 fleetdeck_agent_svc.exe 3732 fleetdeck_agent.exe - Loads dropped DLL 3 IoCs
pid Process 3576 MsiExec.exe 3732 MsiExec.exe 3732 fleetdeck_agent.exe - Enumerates connected drives 3 TTPs 35 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\J: msiexec.exe \??\F:\ msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\E: msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\H: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 checkip.amazonaws.com 32 checkip.amazonaws.com - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\latest.json fleetdeck_agent_svc.exe File opened for modification C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe powershell.exe File created C:\Program Files (x86)\FleetDeck Agent\credentials.json fleetdeck_agent.exe File created C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe msiexec.exe File created C:\Program Files (x86)\FleetDeck Agent\deployment.json fleetdeck_agent_svc.exe - Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{F50AF01E-F174-4B1F-8AFA-1059A924993A} msiexec.exe File opened for modification C:\Windows\Installer\MSI1D13.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C29.tmp msiexec.exe File created C:\Windows\Installer\wix{F50AF01E-F174-4B1F-8AFA-1059A924993A}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e591b43.msi msiexec.exe File created C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File opened for modification C:\Windows\Installer\e591b3f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1D34.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE0EEFAE9A5FDAC38.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB91D60D07C124B76.TMP msiexec.exe File opened for modification C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File created C:\Windows\SystemTemp\~DF767B6F2B915B0635.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp\FleetDeck\fd_agent.log fleetdeck_agent.exe File created C:\Windows\Installer\e591b3f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF67AA4F7B13C77B69.TMP msiexec.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\e-sign_Review.exe:Zone.Identifier chrome.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent_svc.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e-sign_Review.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4108 chrome.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001bba0f2662a0d4530000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001bba0f260000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001bba0f26000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1bba0f26000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1bba0f26000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe - Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\PackageCode = "4396C18A14041E649AE5993E00E2B92F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductIcon = "C:\\Windows\\Installer\\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\\fleetdeck.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\PackageName = "189224215.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductName = "FleetDeck Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3\MainApplication msiexec.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\e-sign_Review.exe:Zone.Identifier chrome.exe - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4492 msiexec.exe 4492 msiexec.exe 4540 fleetdeck_agent_svc.exe 4540 fleetdeck_agent_svc.exe 2960 powershell.exe 2960 powershell.exe 2960 powershell.exe 4540 fleetdeck_agent_svc.exe 4540 fleetdeck_agent_svc.exe 696 powershell.exe 696 powershell.exe 696 powershell.exe 1928 powershell.exe 1928 powershell.exe 1928 powershell.exe 576 powershell.exe 576 powershell.exe 576 powershell.exe 2056 fleetdeck_agent_svc.exe 2056 fleetdeck_agent_svc.exe 2056 fleetdeck_agent_svc.exe 2056 fleetdeck_agent_svc.exe 2952 powershell.exe 2952 powershell.exe 2952 powershell.exe 2056 fleetdeck_agent_svc.exe 2056 fleetdeck_agent_svc.exe 2980 powershell.exe 2980 powershell.exe 2980 powershell.exe 5032 powershell.exe 5032 powershell.exe 5032 powershell.exe 4544 powershell.exe 4544 powershell.exe 4544 powershell.exe 560 powershell.exe 560 powershell.exe 560 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 5008 e-sign_Review.exe Token: SeIncreaseQuotaPrivilege 5008 e-sign_Review.exe Token: SeSecurityPrivilege 4492 msiexec.exe Token: SeCreateTokenPrivilege 5008 e-sign_Review.exe Token: SeAssignPrimaryTokenPrivilege 5008 e-sign_Review.exe Token: SeLockMemoryPrivilege 5008 e-sign_Review.exe Token: SeIncreaseQuotaPrivilege 5008 e-sign_Review.exe Token: SeMachineAccountPrivilege 5008 e-sign_Review.exe Token: SeTcbPrivilege 5008 e-sign_Review.exe Token: SeSecurityPrivilege 5008 e-sign_Review.exe Token: SeTakeOwnershipPrivilege 5008 e-sign_Review.exe Token: SeLoadDriverPrivilege 5008 e-sign_Review.exe Token: SeSystemProfilePrivilege 5008 e-sign_Review.exe Token: SeSystemtimePrivilege 5008 e-sign_Review.exe Token: SeProfSingleProcessPrivilege 5008 e-sign_Review.exe Token: SeIncBasePriorityPrivilege 5008 e-sign_Review.exe Token: SeCreatePagefilePrivilege 5008 e-sign_Review.exe Token: SeCreatePermanentPrivilege 5008 e-sign_Review.exe Token: SeBackupPrivilege 5008 e-sign_Review.exe Token: SeRestorePrivilege 5008 e-sign_Review.exe Token: SeShutdownPrivilege 5008 e-sign_Review.exe Token: SeDebugPrivilege 5008 e-sign_Review.exe Token: SeAuditPrivilege 5008 e-sign_Review.exe Token: SeSystemEnvironmentPrivilege 5008 e-sign_Review.exe - Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 5008 e-sign_Review.exe 5008 e-sign_Review.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4892 wrote to memory of 1288 4892 chrome.exe 80 PID 4892 wrote to memory of 3376 4892 chrome.exe 81 PID 4892 wrote to memory of 4108 4892 chrome.exe 82 PID 4892 wrote to memory of 3376 4892 chrome.exe 81 PID 4892 wrote to memory of 4068 4892 chrome.exe 83 PID 4892 wrote to memory of 4068 4892 chrome.exe 83 PID 4892 wrote to memory of 3384 4892 chrome.exe 85 PID 4892 wrote to memory of 3384 4892 chrome.exe 85 PID 4892 wrote to memory of 2836 4892 chrome.exe 86 PID 4892 wrote to memory of 2836 4892 chrome.exe 86 PID 4892 wrote to memory of 776 4892 chrome.exe 88 PID 4892 wrote to memory of 776 4892 chrome.exe 88 PID 4892 wrote to memory of 228 4892 chrome.exe 89 PID 4892 wrote to memory of 4256 4892 chrome.exe 91 PID 4892 wrote to memory of 5008 4892 chrome.exe 92 PID 4892 wrote to memory of 1160 4892 chrome.exe 96 PID 4892 wrote to memory of 2524 4892 chrome.exe 97 PID 4892 wrote to memory of 4848 4892 chrome.exe 98 PID 4492 wrote to memory of 1068 4492 msiexec.exe 100 PID 4492 wrote to memory of 3576 4492 msiexec.exe 102 PID 4492 wrote to memory of 4540 4492 msiexec.exe 103 PID 4540 wrote to memory of 2960 4540 fleetdeck_agent_svc.exe 104 PID 4540 wrote to memory of 696 4540 fleetdeck_agent_svc.exe 106 PID 4492 wrote to memory of 3732 4492 msiexec.exe 122 PID 2452 wrote to memory of 1928 2452 fleetdeck_agent_svc.exe 112 PID 4980 wrote to memory of 576 4980 fleetdeck_agent_svc.exe 115 PID 2056 wrote to memory of 660 2056 fleetdeck_agent_svc.exe 118 PID 2056 wrote to memory of 2952 2056 fleetdeck_agent_svc.exe 120 PID 2056 wrote to memory of 3732 2056 fleetdeck_agent_svc.exe 122 PID 3732 wrote to memory of 2980 3732 fleetdeck_agent.exe 124 PID 3732 wrote to memory of 5032 3732 fleetdeck_agent.exe 125 PID 3732 wrote to memory of 4544 3732 fleetdeck_agent.exe 126 PID 3732 wrote to memory of 560 3732 fleetdeck_agent.exe 127 PID 3732 wrote to memory of 652 3732 fleetdeck_agent.exe 128 PID 3732 wrote to memory of 4984 3732 fleetdeck_agent.exe 129 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ptai.in/dsb/page.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98c7dc728,0x7ff98c7dc734,0x7ff98c7dc7402⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,5650877827308905736,16801482393510758478,262144 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1820 /prefetch:22⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,11465847505569999634,691436925870184478,524288 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,16002754535760600272,8696470483072981450,524288 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2400 /prefetch:132⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4834247697264695905,8130987455648097426,2097152 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,6609624497836426953,7521423114612023358,2097152 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5336,i,15461165967988709943,4658245268088550487,2097152 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,1383600463516826058,7162916779127109452,524288 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:142⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,7190992660391915498,3763020607344081781,524288 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5604 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:4256
-
-
C:\Users\Admin\Downloads\e-sign_Review.exe"C:\Users\Admin\Downloads\e-sign_Review.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6576,i,5137783499729129838,16695610803119184495,524288 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6480 /prefetch:142⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,4072546268716336438,11111086572651237439,524288 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6508 /prefetch:142⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,6619970906388927106,5776162896171277207,524288 --field-trial-handle=1864,i,16114354757100183298,134940199787661710,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6588 /prefetch:142⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3936
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1068
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9B7216EAAABDDA9848D1CC4B16B978582⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3576
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID 02a79d6c-cc73-41fe-bdde-146960e8e41e -askForName=02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2960
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:696
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AB191AB8C9714A54657939C796644D7D E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3732
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3792
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:576
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service2⤵
- System Location Discovery: System Language Discovery
PID:660
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:560
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:652
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"3⤵
- Command and Scripting Interpreter: PowerShell
PID:5076
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"3⤵
- Command and Scripting Interpreter: PowerShell
PID:4548
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"3⤵
- Command and Scripting Interpreter: PowerShell
PID:2156
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
PID:3856
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
PID:1744
-
-
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
3System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e591b42.rbs
- Size 219KB
- SHA256 222ce55f0290a921c236934525bb72122aff1d592cd7037cba6ff5a58432ad2b
- MD5 1ec4ebeec3ff1ab2b9415f74b0749a52
- SHA1 048a2259011688c5a5b81bf7a2560a1a47f4a228
- SHA512 bcc1f568565c9c8a31f221edcbe560a7a1254efdad3ad39078216fb9858e12d16c077d1284853e4f9e08a2bab674b2dbd357d749b884e377a0b61fe17572b181
- SSDEEP 3072:sJz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaw:st/kE1jOZy2KL4GBiwQtEa4L2sd
- TLSH T1E9249D216090847EEBFA0936993ED671BF7DF2241760C99EC3848C1E5DA44C06BB7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll
- Size 1.8MB
- SHA256 a075919c65120a8a92d3a11895ea456ccbee501717ddb17b29578c029f0c0051
- MD5 39b34a26dc09ffa1b2923d5cdd473eb5
- SHA1 a706ee87242c0597fae398eafdeaf0d9ac940903
- SHA512 930409f08616ae33b3534ad580c349160f77a8b8ea0e077debfae420888855138730ea284377b7b3fca878644d7b2bce7de2dfef0d5b2354a5cab5ae439ae7c3
- SSDEEP 49152:WhX2UquWo4tPAmyI0wxJ1hbL9gghWGE1hKk:WhX+K4iEbL9LhWGU
- TLSH T10D858D22FC41C035F9EA10BAC2FDAEBE98AC8520037806D757D518B69E615D3773D29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe
- Size 6.3MB
- SHA256 7ae8daaa4639ea38723ea77b67ce22e5312e8ac7dd20c016c41b2a88432ba989
- MD5 e3fb748bfdcaecd85775077589aab08e
- SHA1 a491e836d76989d343627f12e6c2669fd38b03e2
- SHA512 503aaeb6631ff6fab157d48ca83c50ca44eac075f9ece9e9574be44c1d6176ee1c4f92388fdf54067120f9dbda725174e5f82df05c0891eb1fcf03f8f44e8398
- SSDEEP 98304:El8YgLZng+nOMxdgiI+yy4UI6fXmkiv7PK9:vYgdgQxyhNkou
- TLSH T19C664B91F9DB40F5D903183044AB623F67306D0A8B35CFD7EA507F6AE9779E20A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 d07d47dbfe061158592097c738528a808eddb1d05d02459b4fb5d01cde4a735d
- MD5 78bec61d72609ad32b5c92b12b5acdf8
- SHA1 88375de8357133ceaef024a32247d8cc5ae7fa07
- SHA512 ba2de1335cd28a4e80a12217e5f074001f3371a5a23f65fb93ed7e7bfe6240637822fd0c32074dbb35ba7f59ded91e441455ecf46b76eefa2b36cdff7947318c
- SSDEEP 49152:N5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQ4:N5wTWNupq+w67Y8ZQmBKYUWaBtTHk
- TLSH T16B562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
- Size 69B
- SHA256 83b234909b94d6582acdc27550e254b126657696cff9cd8c702baf1f0f942f1d
- MD5 1e4414c0a3b84093d91c63d85b3cd058
- SHA1 731e764237e94fa0309d80f34dd1853bb18ef749
- SHA512 27616204229050a35a2c5f09850182b7772518cdaca5dded6851ab9e6ec5e4775a55ff3a481045bba4869544f4462b7f1329269449b9357f06eccdde9855dbc6
- TLSH T13EA02200228A0802C08000CF88A0A38C028C020022820ECCE32088B08BE8C03CA30A32
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 f7d793f458450f8da205887757af84967848fd42c8be78dfcd00524e6cf2ab65
- MD5 2854313d8826aab27a90611b85ef3671
- SHA1 6bcda85950590ced34406062000ffb1bf36b58e4
- SHA512 3ec36105f398f36cbeae2cb3ab5949e4d408c1b2417ce8fb2f9c88c99f72822fb96011849a61db28991fd91ebd5bc0e2c2ca681ebe9672d70b4bda91d1610d7a
- SSDEEP 49152:85wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQy:85wTWNupq+w67Y8ZQmBKYUWaBtTH2
- TLSH T1AB562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\latest.json
- Size 102B
- SHA256 564623c3fd47db24a7cdc9e4e31cdeb7ff0d42d2de527fcd1f2dc7b4b3ab017c
- MD5 9f75b0938a972c6fa01dff8e83d4fa59
- SHA1 6685900a7fa4f2ec4e050eebc550859e317d93e7
- SHA512 7eb8a43c317123ffe128ba31db9787c45aac9541764f4ae2bab8e8f76b5f16ea6d0eb815de57533c7f3d78eb3fc42642b2dc996927350269678f985e614e5c61
- TLSH T1A4B012F20C963073C27201D014F450B852038AAB4182680DF1824300E88C2BAF48327F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 765B
- SHA256 aaa2d30c87ccd12a8cf54a2b8669dd2810eb1af9eafd00b09f583c91ea9c05a7
- MD5 eef3ccdd22dea06667f9ae531d145503
- SHA1 b2930935f06fafdc8174dc0340e3834d3f9af75e
- SHA512 611e01c27394a0869cc0324b14d9d90e5bcee20446ee06073c562344e360017443fff5ea8c8047e3a1d1c20f3d557946753b76e93581452cee9d15e26d365fdd
- TLSH T1AC01200B0E33DD9AEF647B830974D2B63824702538805A4675FB91752995F182F53C28
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_C7279CCC51A16695E97940FE002F16B3
- Size 638B
- SHA256 04e7e0fe0377ddd5a43e30f16c4f8760c744fbe0d1b87e301964f41e46adf113
- MD5 68bc18a89a14c7da2626e5d2da7ec98e
- SHA1 010ba8e073da8308e4eda13abd114cffea050b7b
- SHA512 22adedd01ef3ab46d6ab4570c43de4982d451c955d82ce27a89f7f6b684fc9562ac77c57963f6d02bd061557c0f5edcbf135f30b7de2f59e142bfa6a1905d143
- TLSH T146F0DD034935C8106FA044090CA5F05D124054C618D7661BA929AE892FB6793BE8F45C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 1KB
- SHA256 03ba8ebfadf730c8b0b81ebf3a8267f666840ebe5de1aa0d4922bfe30f5bb9b0
- MD5 3860828001d90029f170327de360c177
- SHA1 4fdb846de662b3239360409ec3fb6f129983c27f
- SHA512 a288ff5fd79455268bf8033e3df16c718dc8b1e186a912734f77f73ec6d57f710c483837cb89ae8b64470b11df70459610ea3e073e6dc02b9d3dc216edecddcd
- TLSH T17531C9D36FB4B8119E165C9898DCCB627CB038A6B8640C783865419AD077F64548880D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 484B
- SHA256 b4fa36a444d1ba17ade478ddd5f21e1bddd769729d1db394dfdfa91782e37738
- MD5 2f4a84547d54c23d40c9d68fc5e95b13
- SHA1 bfde7f3d3582e09b73e15dd433df75b74786f206
- SHA512 aacfd8408d1004ac69113fa7d7560f728c43ff7fccaf30ff6894a463a873b3262cbee05bce48296247a26c9211f8fe0aa355e8dc8e6eaa22ff37c892b7f60f73
- TLSH T1F4F02B3815F6403FF0AC9CB4AAF06177981AF21324024BBD476713186E13F059CD1565
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_C7279CCC51A16695E97940FE002F16B3
- Size 484B
- SHA256 356e517a2c1d49fbcbd280b80a48e0e988a8771dc2b9f9ae1a60aa7328e99b28
- MD5 25632aed9b2e783187c4c22ac4bfa749
- SHA1 d5c18ac9d13fbb1007a528664cd9e14b331ba892
- SHA512 c262201da433fb5132a9ab27db8e65d27c43f59b9060fc87b37ee368f34e9f1c21c7c3e5b17b07b6ca6b351d1014620fcff99b6927fdb8f57094643729d727cc
- TLSH T12CF0A3706EFB005AE8F599378BE591834E75F2353406C76E2751070DA7026028C51E75
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 482B
- SHA256 3f5e222eff4be648068e0219ec6794d5f7408bcbfd98c62642c25cbac184ad79
- MD5 01ed0604d1ede0fe81d7737ae8b7c2b4
- SHA1 34983ffe1b49a4f67686cb152bb930062ec047f1
- SHA512 ce1dfab166d448eb36357e80f6806be61ec1da671e04c1aaa843db51809a182eb82ae30c5501825b6af1121ce4ed163fb71ad79b917138e6aeddb192dd0d3a72
- TLSH T1A7F0AB282AB9003EE237CE7587D9A19A6CFDF72374441AA20764530B671E9421D50937
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 deb0f1426814262e6652872f6422499bd704e7340f4f6f5660b3ee47abba8ea4
- MD5 9b45482ec50adaf807b6486ed706ea49
- SHA1 d9b693e807616e4f3ec701b3eb679b65ab519f8d
- SHA512 1e2afe5343b081b4204799a688d5f3968c9303de063cc96cb6c5678496431b09372afc2beb17e0ca4ff381acacac79cdb5ef192a13839878e78c05ecc405519e
- TLSH T1E5F078B5DC20EC3728FD0B5C2064074BEB50136B2A80999B3A3C910C4F71A3B0A86C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 6373ac609bdbb26dd887a3115abf21cff1d7db96d51cd283c6fffb8b35c3987b
- MD5 82aacb737fea71030182cc21ec07af8e
- SHA1 ac056fd8a37144dbf2d154cade0c5b506dbc179e
- SHA512 9dd5bbc8655f13907be74bef598f01588d82140be292aed1332d04d95c506a1f07f3308c198dc2e939f77f6aa76411f7dd24d620287d4b8c9cba09162e8cd4fa
- TLSH T11B6180F7C3E8867DC90296F4AB156F1BCD6D0919536C3C5688D4AE1F93E58B1D20064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 cf66d6b39c7bedde4b92c046cf48ca80a6a3c9559a27bc06968ffa50b2a1b83b
- MD5 c30ac2fbeb5869d29b7e3659e5850ab1
- SHA1 456fdc50352c8a8ab7048b1fdb8381a789f7fdb7
- SHA512 561f4af04b9311ed219711c2ac8e31ff31dfe2c30f2e33ab7726a8ba0f00f21dd0421a05c59e49a1dd9b99c1e0562fdfa2ede0f35696d9c468689adaf798fd32
- SSDEEP 192:6RtpRInv7A3pAPRp2PC9mHsb+WNn4AZR22iE2He1OSVyIsnAUge:6Rtpevk3UXJgwL2232tSe
- TLSH T12132B52DAD20757B5CDBD25AFA61BB63D7F9002260953E84EAFC883C11E79CC221740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 16e5ebe9ebb351ac27510b7b6152d22a13af0991a789daf52808f43568ff3db3
- MD5 094f11c6f21d52c0786f0423adb39863
- SHA1 1307549e7c0695c9b077264557a0c5ee19f4dde4
- SHA512 e9507e3e1bf43a3eeacf221384e8907aeadd748db29bfe7327632e2e2e2cab351de46140c75e862fa8bae360915c506d330e9365de4ec5c1f03b0d2cc86bce30
- SSDEEP 192:6RtpRISv7A3pAPRp2PC9mHsb+WNn4AZR22iE2He1OSVyIsnAUge:6Rtpe+k3UXJgwL2232tSe
- TLSH T1B232B52DAD20757B5CDBD25AFA61BB63D7F9102260953E84EAFC893C11E79CC221740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 63fcb48a9213c9bb07ac29723a1ae39a46a390e580c8ac7e3f6a7d03ee48d820
- MD5 f062aefdde9923a8e7ff0c8751e45f73
- SHA1 7fe265d679ae00c2cb460da0f0a7e9eef50e8ea2
- SHA512 2cd6c28929a5d3769ec0d736859bcc7a45237bf61f24133cb5a7b351e2eb1becf07fcdcd175e585b6fbcd1be497bbe6edbd1b34c4efeb46cb37224a1541cee35
- SSDEEP 192:6RtpRIav7A3pzPRpXPC9mHsb+WNn4AZR224E2He1xSVyIsnAUgE:6Rtpe2k3JXqgwL22h2MSE
- TLSH T18642B62DBD20797B5CDBD25AFA65BB63D7F9102260903E84EAFC892C11E79CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 183080ab87b58b695e03979ec4d826a874606e28a558a00578c46ede242e7bf3
- MD5 39a15f899b72a397b11f40acfbc1cab5
- SHA1 54ea4d4be93f1b6a15ebebef9ff229a0e0838199
- SHA512 ae62798f9b7b81e80405e993f6a7544bedbadc35071157fe0803ce0777504d53675849ce53ae3c5baed5676cd4fd0e8f6fd749ac3f569ce5cb24b1aa748ea364
- SSDEEP 384:FPjxk7KxkXqKf/pUZNCgVLH2Hfgsli2XODxM+ErU3ucHG4YiBknjE:F7xk7KxkXqKf/pUZNCgVLH2HfgsgcOdJ
- TLSH T13752F827684C9A7F4FC8CA8DE8536F4FADF50147A168093856FB9C0903957CE124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 178KB
- SHA256 f2bb57e80065ab6af84e773957580b4e36ad420abc4b73996ae0aa390e241fda
- MD5 810fd8c31d1c101dcd1006dc74f8df9a
- SHA1 c9168cbeba5df0099eb710ceacd44645c9486ba1
- SHA512 da2dff6d9547cd1216d3d54484c88e6b33bfb4aef975e8c923530faf9fc3036d53c637685d85f90d2f62489788f1a3c760bb71df87d215911db49c86b1b449a5
- SSDEEP 3072:BYxP+mJmBqX7lMAkbbBvH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApV:28UX3kPB9t4fLJ0L6nGJxi3bzqapJjv
- TLSH T1700412F1D4A0ACA7CFFBEF8245B52D948EB1E6D348CDBE2405F48D580289A254916E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 c693466e522644fa8afd490a1cfc6bf58546cf66c6ca417f4079ac6a8f9673a9
- MD5 f1abc0758e15d0265b8470c09df248a9
- SHA1 090418aa99cfe55778b00e93a1637032bcd6a6f0
- SHA512 faedaabfc9dc7990b79a4c888459cd4e2f31c70dcee76a2ae7325f899572d388acd2e9e4abc7dfd8ec997bc71d22bcd126a13f137c032dcdef9b6a16a5948fd8
- SSDEEP 3072:JH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjv:ft4fLJ0L6nGJxi3bzqapJjv
- TLSH T1F5D302F1C5E06C7ACBF7EE8145756E948FB1D5C689CDBE2409F98C18028AA341A17E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 0b76f51d4f7b660e455b29a4b1bc53156245f6b46c3c7c47dbe44eff5a81424f
- MD5 28b8eada4e8de61aad09d9bf1005fe2d
- SHA1 2bbf89dd0711ffa21115fabe47a23d32039de8bb
- SHA512 e9ab55ed31081f360d9fd37d851d8f1ccf240f539deab1dfbced2cbaa37b7d1ecfeb937e50391cec0887ca1042200c4d6de982591e313040263863c7f0e4cf0a
- SSDEEP 3072:0H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjv:Mt4fLJ0L6nGJxi3bzqapJjv
- TLSH T112D312F1C1E06C7ACBB7EE8145755E948E71D5C689CDBE2405ED8C18068EA740D17EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 eff6b1e3289a88872e982e9603a9e4b970c08c8eca1f3868b763817533820eec
- MD5 018836b646385d1d97078a2dba4117c5
- SHA1 12ed581e2ac0912abdbf6123e86294dee60c8c46
- SHA512 251a0dd6a4a08d75f6eded1527c7083553ab5841e197d4eeb19fd780abb0d823b9e63e1a8642a2d688888d856b55b2a63fbe21db1fc0b6cd4a042b0a6ae9ca7c
- SSDEEP 3072:mH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjv:Gt4fLJ0L6nGJxi3bzqapJjv
- TLSH T122D302F1C5E06C7ACBF7EE8145756E948FB1D5C689CDBE2409F98C18028AA341A17E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\189224215.msi
- Size 2.3MB
- SHA256 0eb3b3136035ed9b30c1071cdbb69db06a871e04feda8a9cfe8e13ee82aa4d4b
- MD5 64de8b74901084b6c96a4a47fc97d564
- SHA1 8012fe251350dbb961070d6e84036b1bca6e13c5
- SHA512 7512e03df8359c9cfccc096aa77dba17fd453f35c4a8ec2169ccae25c1441622a3f28c707b1f7b22d146ab4b2ece707bf4824656f931568299141085bb3cc1e2
- SSDEEP 49152:3+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA2:ELaeoi+0QFfXp4O
- TLSH T119B523213548917DC7FA0D31952FEF62BE38FE180E20C56A93807A5E2D715906B77BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\FleetDeck\FleetDeck Agent Service.log
- Size 754B
- SHA256 d9205eadb1ad474ac3feb04cdb3b22109f0dfeb587b0103d136c2679415f8c32
- MD5 3bd799046dc4498c69ede38411eafba7
- SHA1 ce9f916e5105a506e5c20995321428c874a15fc9
- SHA512 aaa410c5068fdabc0199d1fd4f98515dceaab7f5e7bc90e827b41b2a04e94a3da78ebc0be31a6d07b1dbe4cb568a9cb0cd07c77e354f432e56739c68fd307605
- TLSH T11101490054F5D6FDB6134B52BE033EE1224B696F373C3698B7E425D944C4914E42618B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 293811.crdownload
- Size 4.2MB
- SHA256 f9f50f5d8e3f4d004e524eec344d325f244bea7c1b1bea176194a346d03d3839
- MD5 e59d1ac78af8b3faca02f004f3a97089
- SHA1 f2890d42a09d3d62d2963525b82af15da1f26200
- SHA512 6752bb0bd8f67a9c305188911b6f17e7de21126854f3c348341482018c5ff0b2a6bfed58265c912af4d445677c9727cb76a94dbc9341a370dd4e4938d69f6bbe
- SSDEEP 49152:TP0dfmVfyr+CU8D1i+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA26Yuq:TPt6Laeoi+0QFfXp4Oiq
- TLSH T11C16CF90FCDB54B5E603553158AB62BF2734AD094F31CBC7D6407BAEAC73AE10936229
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\e-sign_Review.exe:Zone.Identifier
- Size 135B
- SHA256 9df59bb7a57a20179d268adfe68419fb741835c2590b368e2fb0cc7f3db30088
- MD5 3aa483195b9a8800bee5aa38f01947c4
- SHA1 53b1c69c7756edb38c4579258b53b2921d0b173f
- SHA512 3308fa757d05f4585bfefa2c36108c64efc21ec89e082865c3226f14b68687d8c5025ceb291fa869b9ae5c83474d745fbec79d442f782f1553050c755d500c9b
- TLSH T188C02BD34517400002C613D8C6958D4EF14FFE845CE50140CB4480A2241899C8254412
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI1D34.tmp
- Size 211KB
- SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
- MD5 a3ae5d86ecf38db9427359ea37a5f646
- SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
- SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
- SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
- TLSH T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 947B
- SHA256 8ec3ede5565a86099fcbef5463cc41baafaa3bbd283fca20a9f4d72a4148f48a
- MD5 1ebe8d91bf299589936ee3602297fe54
- SHA1 5f160b9dde43291e5cdb187a6ffaad97174eb3a6
- SHA512 a4dd2f67a8c0c73e2ed6a2a719458c692771546a1fb8d751169d5015f233b364e83e5827d671fddc1718b9833698a31b570e819f3be563af06be8ed063d40f73
- TLSH T19311D0728930E0FE8C0183D0C49E3EA25B637F197BAE9D08B3C0618D5480059E43C1DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 1KB
- SHA256 462d391be544d20feaae2bc13338a989ca810a83e89a50818862b6a6939d4a3b
- MD5 1cee1bc31d503556edf0bff2eb3b6bb2
- SHA1 baaa1a844af994fcd0b50a8c2c9b608505d96e34
- SHA512 fcf0339afac1dc693235fb1895281459bb991353065a61c743995535e82068e65e10e399f822b8408b22797900605ff3c16d2837eca915773a87c95fdff964d0
- TLSH T1DC21B8228871D1FE9D0283D0C89A3EA32757AE0A77BDAD08B3C0218E5480459E83C0DF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_ykqecls2.wp0.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 97ccdff47a34337e54bf2df535a2c54070b0e2e8b7e07934ecd7f6d83140efd9
- MD5 d5f91e31fad63859fd0448f9d920a8fb
- SHA1 2cbca9e8dbbae365bd098b63711d5b4faeabdc3f
- SHA512 326596b74b4843753ef821e37aa6b2a244494a30edfc1851bd3109ff0e520f5ec282857a45711fc85e2ea0745555e576ecd4741b2d283f1ae0f47e1ee320e1f9
- TLSH T19181CE323375B0D489563F07192C19C463AF4396EA54AF4CB65C620EE92B14BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 da665d24507f785499c4d4c425fa082cdf7400a82c14d30962961bab2f09f9c4
- MD5 72a049105cc8ebb917fd8a017769f3f7
- SHA1 f51e15dffdd3adb5624222c945e2e335fc6abee5
- SHA512 03005ff3c8a8c21e8f4fe5b85bd3d58b1140e27e3831e61dae7ea4e8edebbd73146021744c1aeb9c6e8eb7d1235a3a89900b16ef8c618dede064b5c42973ba58
- TLSH T142217533B3ECC426C8D911BA208CAD00B2A5C7C7449E8F8B7B84C619957F9CACB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 dacc38f5cc92e73b3b9be2448c8d2bfa458adb7fcdd59f9b236ec40924fed1e5
- MD5 52a0aa25517b5ce355f3ff783b70b211
- SHA1 9c7985b65f722d608ddfe48a701e9e3a7d1d48ac
- SHA512 86dfa4e9b91a34d636392f5ac6030973bd77f4b7a881cf86fbb8f7525e27942ab40dc33f8a511f1610b8440c9996bea5c0938a08e22aa13ef0f812f0179fef8d
- TLSH T164214533B3ECC426C8D911BA208CAD01B1A5C7D7449ECF8B7B84C619957F9DADB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5d7259d034fee72f891f7ff0eba166cd56375680b69025e936e2d08c7ea5a713
- MD5 988fe37d79c561fd277243655a3ba001
- SHA1 6670802073d04b5a643177c4d68d4f82790e84be
- SHA512 a0fd546c9758cf038402be66473731522d83ef66cd93d735d7df7fb58a347c2fcaa1d7bda63e6515b30787999f152af3de9ff1a9b654496d54d1bc3ac7c7f7d9
- TLSH T1C2213333B79CC234C899117A1098AD01B5B1C3D7449E9E9B7B84C108A67F99EEB601A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4671b556fa107608ada0682304bf07844cef99e87166690ebde6803784ecb975
- MD5 8be843388da64ecf2afcc33faa0b9d59
- SHA1 6be7b49d97936a9aaaca35d5974ba4cdf9af2104
- SHA512 575249e175099653b14a85a4013ed59c25da08ae4584788c02fa02f0c351fc96bfa2018ddf68ed3d13119278a52dc34954c0fe59e6fbc824f4fff7db73f2c5e5
- TLSH T141219773B3ECC125C8D9117A208CAD00B2B9C3C7449ECFCB7A84C619957F9DACB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 411a4a09c07037956100653e2d0ea97990845570e9ff3159bf66939ec22ea381
- MD5 1f876e1f66ed660a8489228fd3a7b88b
- SHA1 b6130f044a19d2d0aeba7432a826f1919c7197c8
- SHA512 442e840c323562f1aa2ca600b95e27dac41b57c3ff7cb801a21e4b7fdea4d136bbf3ce6cc35f9a13ce5297d4eb7e764869d7bb3d31102c992a4620f534351b0c
- TLSH T18721A833B39CC134C8D9017A108CAD01B2B1C3CB049ECEDB7B84C508A57F99AEB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a7dd972424019b0668bf196b34e30295110a5c9378ea780675fd8f5a7caa4067
- MD5 6ff68ca130fbf845f7c96be4f56f948a
- SHA1 b8b3e8e95bdadb0cf3bb816987fba434b15b0e75
- SHA512 2cf787777a2024802c319a480e71684ed174319551fd5d02a54ba77bbc9dcb49bd188b9b2bfa0669ce3257fa5d4613c0784c9bafdeef0d64b7733529c8c575b9
- TLSH T16821A833B39CC135C8D9017A108CAD01B2B5C3CB449ECECB7B84C508A57F99ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b70c5f6cb630103fa7a96bdde12ab6a2fd0ff0fd026b61dc1123e46f9fdc44c4
- MD5 30e02b803a8a3a143eea476d7ab245a1
- SHA1 d3bf1f568172e8125effe5b29bb57a8f9483fbb7
- SHA512 2a1dcf83e601c0b6969898767d2f85689f9e483922658f6e4a09f993cda75106f46a8e3a0cdd787710a203c162b4b508f84bd05585b3d18377c9491eb08e0dee
- TLSH T18121A833B3ACC135C8D9017A208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4c6de1b0d420c6f20e8cfb389f692e1615aea6e4cf09c20472dd0f0b9a73eafa
- MD5 0459dd327efe9b6b264891ff3d15333d
- SHA1 fc69b0ff3b98efdd739bf26c1583a91eaca891a4
- SHA512 70b5a0a887212e92ddf9aa44055deefbbe58a2d1ed62f7ba9ca7b558a5204e550a231c4ed261fa80d746a64a474de7cc2c153f4f807224bb43478107ff592de1
- TLSH T148217833B3ACC135C8D9117A108CAD01B2B5C3CB449ECEDB7B84C508A57F99ADB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6a6f7a56ec1088ade2c4018be88ae88bf1759de1efd9ac020fe14852d4e7f805
- MD5 e803a75b4e616c0a284067137e910f41
- SHA1 d80bd19bb0f1814b44a7cec0563d576f8908f784
- SHA512 8c43620f02c9734d98e7abd77667c6ffc9b1587f8b6fb440c23d88d0ede3a04930a4d17200cf793c3589a409b68d9e20f4170c0bfff9d0120b67d75ff458deff
- TLSH T1C9215633B39CC135C8D9117A1088AD01B2B5C3CB449E8E9B6B84C508A57F99ADB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 bce682a00f59ac1432bcf41bb92e7a0179cb358cd42068bef59014388f407977
- MD5 ede61044811376bb3765f7e59ec768ec
- SHA1 034ade0b9892f80ec5249faa6f5a3fff9af108e4
- SHA512 a3d7df407e247fc23ecdf83a06396b1e255f331486fe4c2150857585031b2ec3694a56637bc62d53555bbf0d2fdb8697503ce9f749ebbc9cfd8ab6ada3fb54b8
- TLSH T13521A833B3ACC135C8DA017A208CAD01B1B1C3C7449ECECB7B84C508A17F99ADB642E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9baeae692e8a8d11f50d120ef6813b5320297b9d9cab42f08b0e9d757bce683d
- MD5 f3ac3d6d29c3ec361d7e4812b8c14b46
- SHA1 e208ed5297a999f666bf72d967375d518d097adc
- SHA512 47675d81f36efb240a1d0d77d0f869bc8fa823d96b0b5c0de578676be034482e29507a43313d5bbeffd3ac20fdb54fb4a3203f6b88eb72d21c6985984f946642
- TLSH T1FF31C03BBBDCC1A9C8AE057910DDAD0072F5C3C744EE8ECB7644C1045AAF4C9D7689A4
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 588461fea15979879ddb06bef194a353a541b2699f9860f114e09b1a593d3fa5
- MD5 195115e07f62727b26d632dece2b6d4c
- SHA1 14ce5924a4b6515504113d5d8df48d29890a6bd6
- SHA512 b3c139d86668c8dabc1fecf3ca0f1b5905d553f30ce0855b3cdb119e7925a6de4c05777fff25a3f0e12e55bdb68a03ac875e105fc756b103904628921f4b5c54
- SSDEEP 24576:32gmSp1WdoO/vvTLn2suBknavK5Hwo4GGmPNXZ0sF36Y0wIZInN7LB2rR:g
- TLSH T18F47D52436F92140E7F79E3CA8F06A63493E7D5BAC16DE8D05411B4E0961FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{260fba1b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7cd8ff3a-78dc-4a53-ae31-2e3c876e18f2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a6f2b29f99a70028d53c225d7dcf43a963465c8695644e36f96f6f4ee1b10744
- MD5 b9744de6cda6dfa637ffcfa94d8a59d6
- SHA1 13cf6aa4fc57f7fb1e12a312dc9dcaa935fa0691
- SHA512 7a2a74f97070f4abda89f088ac4cedaf966280578e59d92c0255fe7f080e5e1e0baebb85ba2db3635bba6c86d52bb6b6f88b2e97492af8371a870e2c140dfd73
- SSDEEP 96:FSylfUvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Iykb++ZVm
- TLSH T14CD187085AE54711E2B3AB712DF58557A877B911EF33CB8E0198638E2670A10F835F5F
- MD5 SHA1 SHA512 SSDEEP TLSH