Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/10/2026, 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fleet-agent-0.10.17.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
fleet-agent-0.10.17.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target fleet-agent-0.10.17.exe
- Size 6.7MB
- Sample261007-3p7hjsxvft
- SHA256 b6e63facef8c4b9a908846779dff36f65ffee2e014c10bf939614fbd8f770057
- MD5 cc838079ec1bdf5be9ec360273b532e5
- SHA1 032cfe04580187d886dc96dd66f39fbb723030e3
- SHA512 0a79f743b4b70a4250ae9c60feb5883cc01a7333496ca15096467831fab665ed622f3af92d34df6fd50dca217238a54cd2321c7909f632809e13e89bb5ecd778
- SSDEEP 49152:J+qIoRVSGHZGT2cHJlkouDygRRuZaSNTHZvTvv6Rwnsb1d55Nlbgw/erGjJ5E1ry:rhVvHZ6xgaNT5736isb5mkE7LZ3GSC
- TLSH T106664A47ECA441A8C0BDD634CA729263BA717C984B3163D72B50F7292F77BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Windows security bypass 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Fleet\fleet-agent.exe = "1" reg.exe - Enumerates VirtualBox DLL files 2 TTPs 2 IoCs
description ioc Process File opened (read-only) C:\Windows\System32\VBoxHook.dll fleet-agent-0.10.17.exe File opened (read-only) C:\Windows\System32\VBoxHook.dll fleet-agent.exe - Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\Windows\System32\drivers\VBoxGuest.sys fleet-agent.exe File opened (read-only) C:\Windows\System32\drivers\VBoxSF.sys fleet-agent.exe File opened (read-only) C:\Windows\System32\drivers\VBoxGuest.sys fleet-agent-0.10.17.exe File opened (read-only) C:\Windows\System32\drivers\VBoxSF.sys fleet-agent-0.10.17.exe - Looks for VMWare drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\Windows\System32\drivers\vmmouse.sys fleet-agent.exe File opened (read-only) C:\Windows\System32\drivers\vmhgfs.sys fleet-agent.exe File opened (read-only) C:\Windows\System32\drivers\vmmouse.sys fleet-agent-0.10.17.exe File opened (read-only) C:\Windows\System32\drivers\vmhgfs.sys fleet-agent-0.10.17.exe - Executes dropped EXE 7 IoCs
pid Process 4636 fleet-agent.exe 4232 fleet-agent.exe 3804 fleet-agent.exe 4784 fleet-agent.exe 3992 fleet-agent.exe 2284 fleet-agent.exe 3000 fleet-agent.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 2520 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FleetAgentGuard = "\"C:\\Program Files\\Fleet\\fleet-agent.exe\" -guard" fleet-agent-0.10.17.exe - Maps connected drives based on registry 3 TTPs 12 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum fleet-agent-0.10.17.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance fleet-agent-0.10.17.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum fleet-agent.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum fleet-agent.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum fleet-agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count fleet-agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance fleet-agent.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 fleet-agent.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Fleet\fleet-agent.exe.new fleet-agent-0.10.17.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 fleet-agent-0.10.17.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 fleet-agent-0.10.17.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleet-agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleet-agent.exe - Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe - Enumerates system info in registry 2 TTPs 36 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion fleet-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct fleet-agent.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fleet-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fleet-agent.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer fleet-agent.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor fleet-agent.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion fleet-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fleet-agent.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct fleet-agent-0.10.17.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName reg.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fleet-agent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\FleetAgentGuard = "\"C:\\Program Files\\Fleet\\fleet-agent.exe\" -guard" fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs fleet-agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust fleet-agent.exe - Modifies registry key 1 TTPs 16 IoCs
pid Process 2328 reg.exe 1340 reg.exe 4776 reg.exe 3520 reg.exe 1724 reg.exe 3424 reg.exe 3428 reg.exe 2608 reg.exe 5032 reg.exe 5020 reg.exe 4724 reg.exe 2888 reg.exe 1036 reg.exe 2380 reg.exe 952 reg.exe 1640 reg.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 fleet-agent-0.10.17.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2400 fleet-agent-0.10.17.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe 4636 fleet-agent.exe - Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2520 2400 fleet-agent-0.10.17.exe 86 PID 2400 wrote to memory of 4776 2400 fleet-agent-0.10.17.exe 91 PID 2400 wrote to memory of 5088 2400 fleet-agent-0.10.17.exe 93 PID 2400 wrote to memory of 1020 2400 fleet-agent-0.10.17.exe 95 PID 2400 wrote to memory of 4412 2400 fleet-agent-0.10.17.exe 97 PID 2400 wrote to memory of 3776 2400 fleet-agent-0.10.17.exe 99 PID 2400 wrote to memory of 1036 2400 fleet-agent-0.10.17.exe 102 PID 4232 wrote to memory of 3944 4232 fleet-agent.exe 106 PID 4232 wrote to memory of 1464 4232 fleet-agent.exe 108 PID 4232 wrote to memory of 4180 4232 fleet-agent.exe 112 PID 4636 wrote to memory of 1724 4636 fleet-agent.exe 119 PID 4636 wrote to memory of 3424 4636 fleet-agent.exe 121 PID 4636 wrote to memory of 2124 4636 fleet-agent.exe 123 PID 4636 wrote to memory of 748 4636 fleet-agent.exe 125 PID 4636 wrote to memory of 2460 4636 fleet-agent.exe 127 PID 4636 wrote to memory of 5064 4636 fleet-agent.exe 129 PID 4636 wrote to memory of 752 4636 fleet-agent.exe 131 PID 4636 wrote to memory of 2380 4636 fleet-agent.exe 133 PID 4636 wrote to memory of 2260 4636 fleet-agent.exe 135 PID 4636 wrote to memory of 3564 4636 fleet-agent.exe 137 PID 4636 wrote to memory of 4776 4636 fleet-agent.exe 139 PID 4636 wrote to memory of 2020 4636 fleet-agent.exe 141 PID 4636 wrote to memory of 3520 4636 fleet-agent.exe 143 PID 4636 wrote to memory of 952 4636 fleet-agent.exe 145 PID 4636 wrote to memory of 5032 4636 fleet-agent.exe 147 PID 4636 wrote to memory of 4536 4636 fleet-agent.exe 149 PID 4636 wrote to memory of 2780 4636 fleet-agent.exe 151 PID 4636 wrote to memory of 2488 4636 fleet-agent.exe 153 PID 4636 wrote to memory of 4088 4636 fleet-agent.exe 155 PID 4636 wrote to memory of 832 4636 fleet-agent.exe 157 PID 4636 wrote to memory of 3428 4636 fleet-agent.exe 159 PID 4636 wrote to memory of 3804 4636 fleet-agent.exe 162 PID 4636 wrote to memory of 4784 4636 fleet-agent.exe 163 PID 4636 wrote to memory of 3992 4636 fleet-agent.exe 164 PID 4636 wrote to memory of 2284 4636 fleet-agent.exe 173 PID 4636 wrote to memory of 3000 4636 fleet-agent.exe 174 PID 4636 wrote to memory of 5020 4636 fleet-agent.exe 178 PID 4636 wrote to memory of 1640 4636 fleet-agent.exe 180 PID 4636 wrote to memory of 4532 4636 fleet-agent.exe 182 PID 4636 wrote to memory of 1040 4636 fleet-agent.exe 184 PID 4636 wrote to memory of 884 4636 fleet-agent.exe 186 PID 4636 wrote to memory of 2260 4636 fleet-agent.exe 188 PID 4636 wrote to memory of 3520 4636 fleet-agent.exe 190 PID 4636 wrote to memory of 2328 4636 fleet-agent.exe 192 PID 4636 wrote to memory of 2608 4636 fleet-agent.exe 194 PID 4636 wrote to memory of 1036 4636 fleet-agent.exe 196 PID 4636 wrote to memory of 3040 4636 fleet-agent.exe 198 PID 4636 wrote to memory of 3200 4636 fleet-agent.exe 200 PID 4636 wrote to memory of 3924 4636 fleet-agent.exe 202 PID 4636 wrote to memory of 2476 4636 fleet-agent.exe 204 PID 4636 wrote to memory of 2452 4636 fleet-agent.exe 206 PID 4636 wrote to memory of 4724 4636 fleet-agent.exe 208 PID 4636 wrote to memory of 2888 4636 fleet-agent.exe 210 PID 4636 wrote to memory of 1340 4636 fleet-agent.exe 212 PID 4636 wrote to memory of 4896 4636 fleet-agent.exe 214 PID 4636 wrote to memory of 4504 4636 fleet-agent.exe 216 PID 4636 wrote to memory of 1672 4636 fleet-agent.exe 218 PID 4636 wrote to memory of 3928 4636 fleet-agent.exe 220 PID 4636 wrote to memory of 4496 4636 fleet-agent.exe 222 PID 4636 wrote to memory of 4776 4636 fleet-agent.exe 224 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fleet-agent-0.10.17.exe"C:\Users\Admin\AppData\Local\Temp\fleet-agent-0.10.17.exe"1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\icacls.exeicacls C:\ProgramData\FleetAgent /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F /grant:r *S-1-5-32-544:(OI)(CI)F /grant:r *S-1-5-32-545:(OI)(CI)RX2⤵
- Modifies file permissions
PID:2520
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuard2⤵PID:4776
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardLogon2⤵PID:5088
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardUser2⤵PID:1020
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuard2⤵PID:4412
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardLogon2⤵PID:3776
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardUser2⤵PID:1036
-
-
C:\Program Files\Fleet\fleet-agent.exe"C:\Program Files\Fleet\fleet-agent.exe" -server wss://light-manager.fly.dev/agent -token epEl-ZtuYKwo1RyV1kp27kgJ2PsAQWk51⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer2⤵
- Enumerates system info in registry
- Modifies registry key
PID:1724
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName2⤵
- Enumerates system info in registry
- Modifies registry key
PID:3424
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName2⤵PID:2124
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion2⤵PID:748
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId2⤵PID:2460
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild2⤵PID:5064
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR2⤵PID:752
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString2⤵
- Checks processor information in registry
- Modifies registry key
PID:2380
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files\Fleet\fleet-agent.exe" /t REG_SZ /d 1 /f2⤵
- Windows security bypass
PID:2260
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuard2⤵PID:3564
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardLogon2⤵PID:4776
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardUser2⤵PID:2020
-
-
C:\Windows\system32\reg.exereg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v FleetHidden /f2⤵
- Modifies registry key
PID:3520
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer2⤵
- Enumerates system info in registry
- Modifies registry key
PID:952
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName2⤵
- Enumerates system info in registry
- Modifies registry key
PID:5032
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName2⤵PID:4536
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion2⤵PID:2780
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId2⤵PID:2488
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild2⤵PID:4088
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR2⤵PID:832
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString2⤵
- Checks processor information in registry
- Modifies registry key
PID:3428
-
-
C:\Program Files\Fleet\fleet-agent.exe"C:\Program Files\Fleet\fleet-agent.exe" -worker -hub 127.0.0.1:49870 -mode screen -want 1 -width 1920 -fps 60 -quality 852⤵
- Executes dropped EXE
PID:3804
-
-
C:\Program Files\Fleet\fleet-agent.exe"C:\Program Files\Fleet\fleet-agent.exe" -worker -hub 127.0.0.1:49870 -mode screen -want 2 -width 1920 -fps 60 -quality 852⤵
- Executes dropped EXE
PID:4784
-
-
C:\Program Files\Fleet\fleet-agent.exe"C:\Program Files\Fleet\fleet-agent.exe" -worker -hub 127.0.0.1:49870 -mode banner -want 3 -banner-corner top-center -banner-mode bar -banner-ox 0 -banner-oy 02⤵
- Executes dropped EXE
PID:3992
-
-
C:\Program Files\Fleet\fleet-agent.exe"C:\Program Files\Fleet\fleet-agent.exe" -worker -hub 127.0.0.1:49870 -mode screen -want 4 -width 1920 -fps 60 -quality 852⤵
- Executes dropped EXE
PID:2284
-
-
C:\Program Files\Fleet\fleet-agent.exe"C:\Program Files\Fleet\fleet-agent.exe" -worker -hub 127.0.0.1:49870 -mode banner -want 5 -banner-corner top-center -banner-mode bar -banner-ox 0 -banner-oy 02⤵
- Executes dropped EXE
PID:3000
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer2⤵
- Enumerates system info in registry
- Modifies registry key
PID:5020
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName2⤵
- Enumerates system info in registry
- Modifies registry key
PID:1640
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName2⤵PID:4532
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion2⤵PID:1040
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId2⤵PID:884
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild2⤵PID:2260
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR2⤵PID:3520
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString2⤵
- Checks processor information in registry
- Modifies registry key
PID:2328
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer2⤵
- Enumerates system info in registry
- Modifies registry key
PID:2608
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName2⤵
- Enumerates system info in registry
- Modifies registry key
PID:1036
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName2⤵PID:3040
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion2⤵PID:3200
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId2⤵PID:3924
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild2⤵PID:2476
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR2⤵PID:2452
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString2⤵
- Checks processor information in registry
- Modifies registry key
PID:4724
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer2⤵
- Enumerates system info in registry
- Modifies registry key
PID:2888
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName2⤵
- Enumerates system info in registry
- Modifies registry key
PID:1340
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName2⤵PID:4896
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion2⤵PID:4504
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId2⤵PID:1672
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild2⤵PID:3928
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR2⤵PID:4496
-
-
C:\Windows\system32\reg.exereg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString2⤵
- Checks processor information in registry
- Modifies registry key
PID:4776
-
-
C:\Program Files\Fleet\fleet-agent.exe"C:\Program Files\Fleet\fleet-agent.exe" -guard1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuard2⤵PID:3944
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardLogon2⤵PID:1464
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN FleetAgentGuardUser2⤵PID:4180
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\FleetAgent\fleet-agent.exe.new
- Size 6.7MB
- SHA256 b6e63facef8c4b9a908846779dff36f65ffee2e014c10bf939614fbd8f770057
- MD5 cc838079ec1bdf5be9ec360273b532e5
- SHA1 032cfe04580187d886dc96dd66f39fbb723030e3
- SHA512 0a79f743b4b70a4250ae9c60feb5883cc01a7333496ca15096467831fab665ed622f3af92d34df6fd50dca217238a54cd2321c7909f632809e13e89bb5ecd778
- SSDEEP 49152:J+qIoRVSGHZGT2cHJlkouDygRRuZaSNTHZvTvv6Rwnsb1d55Nlbgw/erGjJ5E1ry:rhVvHZ6xgaNT5736isb5mkE7LZ3GSC
- TLSH T106664A47ECA441A8C0BDD634CA729263BA717C984B3163D72B50F7292F77BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\fleet\agent.log
- Size 551B
- SHA256 afa24f431e7f8465b52cb6349ff87d40af308c7a62fecbcef0ab0b37392712c0
- MD5 1a7835b736512c5a37fe6f7c28d8c8b5
- SHA1 bbab709258ccd07dd8205845e931808118c800ac
- SHA512 a5f2f3d966e09e93a84e1f180069b988c3049cd18a2d22f2928dbc732d962238f635b750107db3129d047471bc4074deb7cc36cadc7d1685e876d86733da1a53
- TLSH T12CF08B72ABF9757ADF9A02CF2214B1888F56A427B11C120D77CC9335EEA71011C35698
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\fleet\agent.log
- Size 1KB
- SHA256 63f0cab9e0e5541f5b0194f9558f84b6ed8cfefd929ff657eae5349fab5915df
- MD5 4751f9cadf9d7f2c4be9ef9f1b9ebe74
- SHA1 c07108f4e5f9bc7ea0dfd50b26a5cb449f572359
- SHA512 dac9fed12af2ccebe3a281a9b295c79d4be459282d288e4a3543c428910c1453fb107b228bca2b404213d027b1c77be5ee51be09e2395e2c75b9c0aff30f9614
- TLSH T13941DB769379947C1B49414F6620B2A8CF297477F64C230D77ECE3716DEB00A2F25A94
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\fleet\agent.log
- Size 2KB
- SHA256 e6a645719fefdeca9f87d8a20579361f46a34143bb16ab83be9e72cf7e286017
- MD5 82d3f5aece12303840c80b3ec7cf0f04
- SHA1 6876993a03630d7b77f7691bd719c727de1ef34d
- SHA512 e0b3376146b6cf94f8ad3eaa2c08f1395e40f7e7936446310800551fd2de4f57f1ddd158be52ed5e5b3d04e36d7766af647b00f8248d5795bf1c6c0587a0dc63
- TLSH T12641D972427A943D2B89018F663072A9CF697437E64C230D77ECE3B16DFB0062E25AD0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\fleet\agent.log
- Size 3KB
- SHA256 2d37a7ae50768166efcbcfa2f4fe5a4b2a33f70314d1417014e5f1d019663920
- MD5 aaf62cd0a96e1029710248af64124478
- SHA1 bcdc2c97a77320b31a7077b84e5a88fc88a8605c
- SHA512 de8c71e9d7bdd1d963b18c39a27867dea7ffe5972750d47654c44201130882bb610c75f13321c29baad5a0e00f17dd84f7ec794eb0fd60fd895cf9f7c6c470df
- TLSH T1AC61CB72637A907C1B49454F5720B2A5CF697837E69C230D76E8E3716DFF00A2E26AC4
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\fleet\agent.log
- Size 3KB
- SHA256 357fedc442a5de3c3e73a685c03732179929c41649e11922145c00853751fc6d
- MD5 114b55c3d86ecdd0ae098000214c9cbb
- SHA1 c492ec5073bf752ba3f22f55e3a16bce9f17701c
- SHA512 7df321e47d2194107151117d70395f0ed54abf4e5a965d0b24f1226500e2f8a79b45ce367a5ed8293781817a0a4caaf2128881d528d4a17655c61300359bffec
- TLSH T1F871CB72533A947C1B49454F573072A5CF697437E69C23097AE8E3712DFF00A2E26AC0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\fleet\agent.log
- Size 490B
- SHA256 7acb2bb0f695210e481b6d7f2f62fea72080791b94814b3d93f217c92c370687
- MD5 6eb72127109abe00f02695012a4e055b
- SHA1 21858a944f9c49b11916c5b1ea2144c374907285
- SHA512 39b361a2402cb68117d0a12be1e51a745c099eb9bbf621204a35283ebd06cf12e841c9ebc4ad555ceb79934b5c66a460ec7803912679d17169e2bf3ac033fcca
- TLSH T1B4F05972ABF96176DF9A02CF2214B1888F56A427B14C120977CC9335DE931010C36288
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\fleet\id.txt
- Size 33B
- SHA256 ee60380bd8a7699191dc4867ac5128628ece79c00b9b3775c33ff1cc1003c622
- MD5 b3c78b1e5db89daf3fee7d9c95ecc882
- SHA1 84b1daaa53a8cec692eb3a931726f79d7b70b32e
- SHA512 74b6b6b24d7b9e47b40dbc06ba3cd5e4cddc9d6b3b56c075ceba2db506c9f5f770f48fcc7fee7c7e123927d7a8ada5af75e778e96739edc6d8e62a45b5285222
- MD5 SHA1 SHA512