Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/11/2026, 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe
- Size 4.2MB
- Sample261113-2453lasz3n
- SHA256 71221ba23f1fbbf032641829a09878046494e5818014cd737f054ac13cb6feeb
- MD5 e99ddede0e2217a43d6e6c8a07a4b150
- SHA1 8ef88c449c0ee98ef46997df5eaceeb922f4edfc
- SHA512 520dc67e89aef9d80bec08050c62b36a447e59d198b3217561252141a3fa5fdcb773bc9602fa9567d7adc69f49c87bbc6698808779f4333687e52f50bac87633
- SSDEEP 49152:mP0dfmVfyr+CU8D1i+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA26Yu5:mPt6Laeoi+0QFfXp4Oi5
- TLSH T14B16CF90FCDB54B5E603553158AB62BF2734AD094F31CBC7D6407BAEAC73AE10936229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
-
pid Process 3692 powershell.exe 2860 powershell.exe 3496 powershell.exe 1032 powershell.exe 3764 powershell.exe 4652 powershell.exe 3768 powershell.exe 4996 powershell.exe 4380 powershell.exe 4852 powershell.exe 1992 powershell.exe 3312 powershell.exe 4664 powershell.exe 2208 powershell.exe 1908 powershell.exe 1396 powershell.exe - Executes dropped EXE 5 IoCs
pid Process 2212 fleetdeck_agent_svc.exe 3760 fleetdeck_agent_svc.exe 1728 fleetdeck_agent_svc.exe 4812 fleetdeck_agent_svc.exe 3484 fleetdeck_agent.exe - Loads dropped DLL 3 IoCs
pid Process 2952 MsiExec.exe 452 MsiExec.exe 3484 fleetdeck_agent.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 14 1832 msiexec.exe 16 1832 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 46 checkip.amazonaws.com 47 checkip.amazonaws.com - Uses WMI to collect hardware manufacturer information 2 TTPs 3 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
pid Process 1588 powershell.exe 2268 powershell.exe 2944 powershell.exe - Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\FleetDeck Agent\20261021023420\fd_agent.dll fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\FleetDeck Agent\latest.json fleetdeck_agent_svc.exe File opened for modification C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe powershell.exe File created C:\Program Files (x86)\FleetDeck Agent\credentials.json fleetdeck_agent.exe File created C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe msiexec.exe File created C:\Program Files (x86)\FleetDeck Agent\deployment.json fleetdeck_agent_svc.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e58a5c1.msi msiexec.exe File opened for modification C:\Windows\Installer\e58a5c1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{F50AF01E-F174-4B1F-8AFA-1059A924993A} msiexec.exe File opened for modification C:\Windows\Installer\MSIAA35.tmp msiexec.exe File created C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File opened for modification C:\Windows\Installer\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\fleetdeck.ico msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIAA84.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBBFA.tmp msiexec.exe File created C:\Windows\Installer\wix{F50AF01E-F174-4B1F-8AFA-1059A924993A}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e58a5c5.msi msiexec.exe - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 5068 powershell.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fleetdeck_agent_svc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fleetdeck_agent_svc.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe - Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Version = "16777216" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductIcon = "C:\\Windows\\Installer\\{F50AF01E-F174-4B1F-8AFA-1059A924993A}\\fleetdeck.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FA05F471FF1B4A8AF01959A4299A3\MainApplication msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\E10FA05F471FF1B4A8AF01959A4299A3 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\PackageName = "197158988.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\PackageCode = "4396C18A14041E649AE5993E00E2B92F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\ProductName = "FleetDeck Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FA05F471FF1B4A8AF01959A4299A3\SourceList\Net msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 msiexec.exe 1832 msiexec.exe 2212 fleetdeck_agent_svc.exe 2212 fleetdeck_agent_svc.exe 3768 powershell.exe 3768 powershell.exe 3768 powershell.exe 2212 fleetdeck_agent_svc.exe 2212 fleetdeck_agent_svc.exe 3312 powershell.exe 3312 powershell.exe 3312 powershell.exe 4652 powershell.exe 4652 powershell.exe 4652 powershell.exe 2860 powershell.exe 2860 powershell.exe 2860 powershell.exe 4812 fleetdeck_agent_svc.exe 4812 fleetdeck_agent_svc.exe 4812 fleetdeck_agent_svc.exe 4812 fleetdeck_agent_svc.exe 3692 powershell.exe 3692 powershell.exe 3692 powershell.exe 4812 fleetdeck_agent_svc.exe 4812 fleetdeck_agent_svc.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 4380 powershell.exe 4380 powershell.exe 4380 powershell.exe 1588 powershell.exe 1588 powershell.exe 1588 powershell.exe 2268 powershell.exe 2268 powershell.exe 2268 powershell.exe 4852 powershell.exe 4852 powershell.exe 4852 powershell.exe 4664 powershell.exe 4664 powershell.exe 4664 powershell.exe 2208 powershell.exe 2208 powershell.exe 2208 powershell.exe 5068 powershell.exe 5068 powershell.exe 5068 powershell.exe 1908 powershell.exe 1908 powershell.exe 1908 powershell.exe 2944 powershell.exe 2944 powershell.exe 2944 powershell.exe 1992 powershell.exe 1992 powershell.exe 1992 powershell.exe 3496 powershell.exe 3496 powershell.exe 3496 powershell.exe 1032 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeIncreaseQuotaPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeSecurityPrivilege 1832 msiexec.exe Token: SeCreateTokenPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeAssignPrimaryTokenPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeLockMemoryPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeIncreaseQuotaPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeMachineAccountPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeTcbPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeSecurityPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeTakeOwnershipPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeLoadDriverPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeSystemProfilePrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeSystemtimePrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeProfSingleProcessPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeIncBasePriorityPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeCreatePagefilePrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeCreatePermanentPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeBackupPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeRestorePrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeShutdownPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeDebugPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeAuditPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeSystemEnvironmentPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeChangeNotifyPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeRemoteShutdownPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeUndockPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeSyncAgentPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeEnableDelegationPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeManageVolumePrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeImpersonatePrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeCreateGlobalPrivilege 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe Token: SeBackupPrivilege 3960 vssvc.exe Token: SeRestorePrivilege 3960 vssvc.exe Token: SeAuditPrivilege 3960 vssvc.exe Token: SeBackupPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeDebugPrivilege 3768 powershell.exe Token: SeAssignPrimaryTokenPrivilege 3768 powershell.exe Token: SeIncreaseQuotaPrivilege 3768 powershell.exe Token: SeSecurityPrivilege 3768 powershell.exe Token: SeTakeOwnershipPrivilege 3768 powershell.exe Token: SeLoadDriverPrivilege 3768 powershell.exe Token: SeBackupPrivilege 3768 powershell.exe Token: SeRestorePrivilege 3768 powershell.exe Token: SeShutdownPrivilege 3768 powershell.exe Token: SeSystemEnvironmentPrivilege 3768 powershell.exe Token: SeUndockPrivilege 3768 powershell.exe Token: SeManageVolumePrivilege 3768 powershell.exe Token: 31 3768 powershell.exe Token: SeDebugPrivilege 3312 powershell.exe Token: SeAssignPrimaryTokenPrivilege 3312 powershell.exe Token: SeIncreaseQuotaPrivilege 3312 powershell.exe Token: SeSecurityPrivilege 3312 powershell.exe Token: SeTakeOwnershipPrivilege 3312 powershell.exe Token: SeLoadDriverPrivilege 3312 powershell.exe Token: SeBackupPrivilege 3312 powershell.exe Token: SeRestorePrivilege 3312 powershell.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe 3372 AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1376 1832 msiexec.exe 97 PID 1832 wrote to memory of 2952 1832 msiexec.exe 100 PID 1832 wrote to memory of 2212 1832 msiexec.exe 101 PID 2212 wrote to memory of 3768 2212 fleetdeck_agent_svc.exe 102 PID 2212 wrote to memory of 3312 2212 fleetdeck_agent_svc.exe 105 PID 1832 wrote to memory of 452 1832 msiexec.exe 107 PID 3760 wrote to memory of 4652 3760 fleetdeck_agent_svc.exe 109 PID 1728 wrote to memory of 2860 1728 fleetdeck_agent_svc.exe 112 PID 4812 wrote to memory of 4820 4812 fleetdeck_agent_svc.exe 115 PID 4812 wrote to memory of 3692 4812 fleetdeck_agent_svc.exe 117 PID 4812 wrote to memory of 3484 4812 fleetdeck_agent_svc.exe 119 PID 3484 wrote to memory of 4996 3484 fleetdeck_agent.exe 123 PID 3484 wrote to memory of 4380 3484 fleetdeck_agent.exe 124 PID 3484 wrote to memory of 1588 3484 fleetdeck_agent.exe 125 PID 3484 wrote to memory of 2268 3484 fleetdeck_agent.exe 126 PID 3484 wrote to memory of 4852 3484 fleetdeck_agent.exe 127 PID 3484 wrote to memory of 4664 3484 fleetdeck_agent.exe 128 PID 3484 wrote to memory of 2208 3484 fleetdeck_agent.exe 129 PID 3484 wrote to memory of 5068 3484 fleetdeck_agent.exe 130 PID 3484 wrote to memory of 1908 3484 fleetdeck_agent.exe 131 PID 3484 wrote to memory of 2944 3484 fleetdeck_agent.exe 132 PID 3484 wrote to memory of 1992 3484 fleetdeck_agent.exe 133 PID 3484 wrote to memory of 3496 3484 fleetdeck_agent.exe 134 PID 3484 wrote to memory of 1032 3484 fleetdeck_agent.exe 138 PID 3484 wrote to memory of 1396 3484 fleetdeck_agent.exe 140 PID 3484 wrote to memory of 3764 3484 fleetdeck_agent.exe 141 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe"C:\Users\Admin\AppData\Local\Temp\AdobeReaderV20261510-4xVJAqegbeFVg8vqESEmHa.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3372
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1376
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 593D50A4F58A7FBAB40D33F06DA80B3C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2952
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID 200ac2e9-98d3-4a6c-8d60-2503c787ff29 -askForName=02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DD1B15B309E3EBC55B61DA66B22F887D E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:452
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service2⤵
- System Location Discovery: System Language Discovery
PID:4820
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3692
-
-
C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe"C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4380
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"3⤵
- Uses WMI to collect hardware manufacturer information
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1588
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"3⤵
- Uses WMI to collect hardware manufacturer information
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2268
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4664
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"3⤵
- Drops file in System32 directory
- Queries system WMI classes for hardware identifiers
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"3⤵
- Uses WMI to collect hardware manufacturer information
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1992
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).NdisMedium | Select-Object -First 1 "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).MacAddress "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty OSArchitecture))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1396
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " function Test-PendingFileRename { [OutputType('bool')] [CmdletBinding()] param() $operations = (Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\').GetValue('PendingFileRenameOperations') if ($null -eq $operations) { $false } else { $trueOperationsCount = $operations.Length / 2 $trueRenames = [System.Collections.Generic.Dictionary[string, string]]::new($trueOperationsCount) for ($i = 0; $i -ne $trueOperationsCount; $i++) { $operationSource = $operations[$i * 2] $operationDestination = $operations[$i * 2 + 1] if ($operationDestination.Length -eq 0) { } else { $trueRenames[$operationSource] = $operationDestination } } $trueRenames.Count -gt 0 } } if (Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending\" -EA Ignore) { return 1 } if (Get-Item \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\" -EA Ignore) { return 1 } if (Test-PendingFileRename) { return 1 } try { $util = [wmiclass]\"\\.\root\ccm\clientsdk:CCM_ClientUtilities\" $status = $util.DetermineIfRebootPending() if(($status -ne $null) -and $status.RebootPending){ return 1 } }catch{} return 0 "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3764
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
2Discovery
Peripheral Device Discovery
2Query Registry
2System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a5c4.rbs
- Size 219KB
- SHA256 f1c9c409ca369109313ecb46cc88cd227d35accb1185a92e15ed3db5fab5edcc
- MD5 a12b1a4f653103d88a6950c78ac9f370
- SHA1 5f1ee04d8c14ae7ef86a709fa41b7687a825c16e
- SHA512 31439e20dbd542f2aacb1482c2cc888d0a129f68b7ac962d7fafd41c278f4851e4c2e69d24726bc4d7b3488d190476d2767179085fe9e16fcded558ce0cbf145
- SSDEEP 3072:5Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxar:5t/kE1jOZy2KL4GBiwQtEa4L2sk
- TLSH T173249D216090847EEBFA0936993ED671BF3DF2241760C99EC3848C1E5DA44C06BB7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fd_agent.dll
- Size 1.8MB
- SHA256 4ce08a6bf859b188ace0cf5aa61fd0e455d0baf34215369e561dc5fc6c315aac
- MD5 c3adda737beb39bf3fe721c80eb68e79
- SHA1 7159a7214267d43aeba4a836718a99b242d5da31
- SHA512 0825bb629c3dc433db6172028c868a72de64b4e8df9570c779766b455376ba6b0c256c98304e57aea34253f349c9f168940c9319fc266293756ede69745201fc
- SSDEEP 49152:eBXKkqGgYq8vNX7kb9hDqJCZIV/hWuVphsy:eBXysqeTCZI5hWuV
- TLSH T17A858E22FC41C035F9EA20BAC6FDABBE59AC8520037806D357D518B99E605D3773D29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe
- Size 6.3MB
- SHA256 08c5fc1cca98e77549f14d87abde0dda7a5d58076be6d88ceaaf26e3283b786d
- MD5 57c20b15518c4498f31dddace020cbb1
- SHA1 2fb038e48e33b04f6fb1309c1bc9a2f70d55a628
- SHA512 cf20c8a4a3b1cd89cadc338d26aa2c6fbffb6988b15d73d00e9ab891c5af5c36cc80ef76fecf5db778383e3d737500958945731b176c24e473e8a667cfbdd3d2
- SSDEEP 98304:Nl8YgLZng+nOMxdgiI+yy4UI6fXtkiv7PKT:sYgdgQxyh6koM
- TLSH T17E664A91F9DB40F5D903183044AB623F67306D0A8B35CFD7EA507F6AE9779E20A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 ded6bd6efa372d340d9f8b827cff4a8f90ca069d86011bac7443dd9785f292bd
- MD5 3715bf40e9519883fe72d1400c84d4a6
- SHA1 537e0e150fe89ba5f5fe79efd19435fbaf45eacb
- SHA512 f9f16def59a6f9a62535ac57ac1ea094fcc98b561b67786d2c49f3d35928c387219c7dea5c3c399a3ab6f15b026a7864e4a2797803ea11cd1cb1d7fd2f9ffb30
- SSDEEP 49152:X5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQW:X5wTWNupq+w67Y8ZQmBKYUWaMtTHZ
- TLSH T189562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
- Size 69B
- SHA256 d6a9dddfab1da8e698b8ecdd67a3c44ba37568e6c388871325f3066a432afaf4
- MD5 219da0c29776eb8573f6db63856dd182
- SHA1 d419f414a1b2efb0c8d2a39d1f977904a1acef83
- SHA512 1e67cb39d417049311278b139d6c06b467dd6a03dd30e218e3ea97a90d9005091258b6a01fd21741a6b3e194389321c7a0d1e57c481987f3e9b545ca6cf62005
- TLSH T15FA002012AE53716E31582EE5BDD694C8707971751411895F00E27726F5897B0CD7561
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
- Size 6.0MB
- SHA256 f7d793f458450f8da205887757af84967848fd42c8be78dfcd00524e6cf2ab65
- MD5 2854313d8826aab27a90611b85ef3671
- SHA1 6bcda85950590ced34406062000ffb1bf36b58e4
- SHA512 3ec36105f398f36cbeae2cb3ab5949e4d408c1b2417ce8fb2f9c88c99f72822fb96011849a61db28991fd91ebd5bc0e2c2ca681ebe9672d70b4bda91d1610d7a
- SSDEEP 49152:85wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQy:85wTWNupq+w67Y8ZQmBKYUWaBtTH2
- TLSH T1AB562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FleetDeck Agent\latest.json
- Size 102B
- SHA256 5660ebdc065d3a9fe7a4557daa71728a4b5b07980dd02e4b85812c2e2f7d9932
- MD5 c0094d81a0987a052557ba8457358cc8
- SHA1 e8a15b296be2bb76cd387543f129f6aef088dd86
- SHA512 3a3fe7f7e8e08005a063cdd49a9894c92cb20f4dbbb7d7270cfbfeab248248d4c92c3e19b0d048ec1d828adfd638adfd79a0c6497b0802281b60ce67effc141a
- TLSH T16EB012F798147033CA74025014F412B05B042A890182A409F3C243C0DC0C7F3FD8346F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\197158988.msi
- Size 2.3MB
- SHA256 0eb3b3136035ed9b30c1071cdbb69db06a871e04feda8a9cfe8e13ee82aa4d4b
- MD5 64de8b74901084b6c96a4a47fc97d564
- SHA1 8012fe251350dbb961070d6e84036b1bca6e13c5
- SHA512 7512e03df8359c9cfccc096aa77dba17fd453f35c4a8ec2169ccae25c1441622a3f28c707b1f7b22d146ab4b2ece707bf4824656f931568299141085bb3cc1e2
- SSDEEP 49152:3+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA2:ELaeoi+0QFfXp4O
- TLSH T119B523213548917DC7FA0D31952FEF62BE38FE180E20C56A93807A5E2D715906B77BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAA84.tmp
- Size 211KB
- SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
- MD5 a3ae5d86ecf38db9427359ea37a5f646
- SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
- SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
- SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
- TLSH T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 946B
- SHA256 c15f09917fcbd08449d74d192e52eecc3881a93fd61f60681e39c3ae04e052ef
- MD5 f980a130e463c89503b288ea0880a70a
- SHA1 b022aa8c2e6eab9ee86f65d4577b4a50ee767723
- SHA512 eb2be4260abf29d5f1d382f5188b31a735cfa6815f5233b6b28ce7efad376b442de5b9c3f8559c1b70a859056861e1088a45bd4aea3ef46f37931e6152d965a9
- TLSH T1C6113A5A43A2E07DBB1D0681CCDE17A35F150761B71DAC0CB7E1F2C538435EBC86819A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
- Size 1KB
- SHA256 b9d94b5d3f2495c55d7294af7effb1cf0293d08f60f818ab5cfeb242514f6cfe
- MD5 ac80c4bcfda9b1852d4a0d523c9acdd5
- SHA1 b5f4aefb90bad0737f64c5cbabb38bed557f8a99
- SHA512 a89ac4225728c6a5cea97b233c20754372167817448b33580f2920a1f5d3c051706fcc5b37cfcf8cc73209680c68fd31608ab3d2f475fe8d3c46eab3b9965356
- TLSH T18821355A02A2E1BEBB0A06418CDE1B936B150761771CA81CB3E1F2C538465EB88680DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_4u2fg02l.dg2.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 3924113f27f3ad2ebe752cf27a50523b9f05382776f88ad4c6172df175bd25a3
- MD5 53169e560f94b03247bdd6bd752445e1
- SHA1 b6efc96de828a2bb21d659e3fcbc16a871ba5e71
- SHA512 9d9250339f36c1584090cb58df895e81d8344c1133f659c416d4eb3e0f68214c5aafec75257e1643127cd69a94c854903f2719ba5b5bf83fd16ee3a261d8c334
- TLSH T18B81FE323375B0D4C9567F062A2819D063BF4386EA98AF4CB25C621EDD2640BDB122F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 55578aa985cb4c966646d2326ad1bb423a6c202bcb12c82395c94b75a9c31817
- MD5 63e361daabe26811d8edda897d45ef7c
- SHA1 8243c73639845d949538977efd27c1287e62a4de
- SHA512 51a9bc4576ae245149aca4a24666a098a2d7c55a13ef4d55134cc2af624eab3572f1da9004710e55bd6206d840fb8ceb4faa85c5586a1a8bdeb54aee3b17572a
- TLSH T18C217B27F39C8A20CC95153A109D9C11767183D7809FDF9F6BC0D205A5BF599CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 20de08818c8c805fe9a9829f1ddc85d67f1a8bca720c8c316a21b198a4fff317
- MD5 0cd2a0e0ab22b6e922d577c3cc356be5
- SHA1 3fa3ac7291d2daae6bf240076b087ed9189f1369
- SHA512 24c722d01c0000eef258b7732a7647e3d15b6c166f552df392656015cab5245fe53a9059c7ebb2bc275132d030c93f42c5f472150ca8eb025e7b7370d93beb00
- TLSH T1D4217827F38C8A21CC96163A109D9C2176B683D7849EDF9F6BC0D201A5BF999CB61190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 22074d71dbf4636080ee3b4af53612f2f1c6b0fd1dfb2e18893d267e60f3d06d
- MD5 96e66c6151c6ef0aa0810f6b2896f65b
- SHA1 0191114d00782a6fe104cb07f1797238ee5e0136
- SHA512 e7999e91eafe60a06366ec10565265f5517fd5f8f5fceb2ef86816752b6ed1700c80a49babd84e1beab63413e71a8637174438a4dfe6f0bcc846641d83fad982
- TLSH T16C219727B3DC8921DCD5163A509D9C1036AA83C7849EDF9B6BC0D324957FAC8CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 fc34b209980e8f6d3065efe6c6d80dbc449214659de95d7d0a7ac82cf4401c09
- MD5 98684057ce99e9b555543e51c7c0b335
- SHA1 9fa4306f7534dac3ca32d74f548d1158280a35a9
- SHA512 029c531fa06b8753f6981106500dd38e976541802484423f04102217b5d254678271a1fd9f15d1389015a845d713ae88950654f33207c93d12e7094b0406108a
- TLSH T16021A827B3DCC921CC96123A009D9C1172B283C7809ECFAF6FC4D610A0BF999CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 659f5725da2bae4a7d94dfa90af83b0e4054465ae8937e570473c1528866f03b
- MD5 32535a8d767830ad16830ddca0d7e844
- SHA1 91faee64f812c45f4f7e1dcab1b3fc8314446c6a
- SHA512 0716d3b0d92627de5c427ba1b0a7ced71a57c49077e27c65d3a8d65a4014145f586ecdade44df908aacfc38d445092f61864ff51a0b4ac0fe35d1bd5cb576e7b
- TLSH T197217827B3DCCA21CC96163A109D9C1176B683C7819EDF9F6BC0D614A07F9D9CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 35076ea62c75739f2f1434d3cdde5f975e332a13210ffab2ab63a975f300fbc9
- MD5 1c6fde2dec167fbabaa0168aebc5e3ef
- SHA1 ee72f321c123219f5c411cca491333af848512e1
- SHA512 59221096ca0c2311844e5a845bddc0e1050224f1c094592216654342aa90cfd4f15e72927f63412b3b1d3b1960df960dbd6a371fb3d5a113998c7bda72eb07d5
- TLSH T16F217827B3DCCA21CC96163A109D9C1176B683C7819EDF9F6BC0D614A07F999CB61194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 931a2eaa61178581995773a9da78f4bfd76ad27c29b44442fa1329b384a0cd96
- MD5 91a39b91c2b22ff00c12e56878baa09b
- SHA1 e19e669a9c2c8fec9fb699c4c76384a105471bda
- SHA512 59df651f9cab1c7b960e22d8207766cef07393b33d42f2b759bf4043cd63f2abaf08f9e1b419c6a126fb51a98468d15d34ba09caac46dfbc1a1b658c513aa2b0
- TLSH T10A21A827B3DCCA21CC86163A009D9C1172B683C7809EDF9F6BC0D600A07F998CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 cc6dc58f1d7bb6a3dc70a1ea7cae87d46af1f843e581299392896dec867764c6
- MD5 903dd097e8b2c8bb426ed99a913c2821
- SHA1 4ecc4a94d7c88faf53fe12897bc0c8112ed57016
- SHA512 3045f7c42371c01675b45277d66d7cf3069c2967107f3cbedff28691a980f3d0f15663bb9e19de91e3306776d9a1549c5894708d6e7ccfb176e807bcea6ff48d
- TLSH T1E821A837B3DCC921CC86163A109D9C1072B683C7819EDF9F6FC0D604A07F988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a3cd526171c1318c7824e97a2b569d2512526723072087ee7d20e2093f6d3be4
- MD5 b0537532ae1fd7cae7d92945f7ca20f4
- SHA1 d2d4891e1ea1138c6169bf2dc79a4d535508261f
- SHA512 488c16f9c53b71a6c7b7a3815481f4b76b9ca96ac4816632f2de4fe87a6ef550304a200fc5de90feb0e93dd3e526d524375ab697a93a67d2561c3dc994218417
- TLSH T1B021A827B3DCCA21CC86123A009D9C1172B283C7809ECFAF6BC0D600A07F9D8CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 bcbe6c8e5d6a01aa4ced4b8144cfa4307473a91f2f39ab939765052f5e0a1383
- MD5 7ecb68dc5d33e8f21a09fd3a952cbc40
- SHA1 435c1a8ab21e5555f58df7a8f3c705da6d18ac22
- SHA512 62be458cd4629d00df5b8b4f5af298e1e232ad6992844212788f22dbfbfe90d8c6c5b89f0a0b4cd57a9a4cdbc68754b26fa78e4450014adbcd56bfebb9bc5d70
- TLSH T171217B37B3DCC921CC96123A109D9C1176B583D7819EDF9F6BC0D614A0BF599CB71194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 39319b925401a80d0ae21f4939bef240b502cc3d5c7888d6b129e46e9725b766
- MD5 617d85ff0f001d274e6288cda18ca5a6
- SHA1 8c3a77941cd63b213d47e35774f4a21ef4ff92ed
- SHA512 ab580aa49f4c7f85afef78a24824b313148910c4e062e8bcde093c547bcbd04e1abff8b45a2740663c7483d1f938e9d70a5ede00ab0b11594fa15b343f8f170f
- TLSH T194215627B3DC8921CC96163A109D9C1176B683C7819EDF9F6BC4D614A07F999CB61290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ddd7914078e62ebe08c5c2bd13ff7d3c371d35a6545031c49af986811af93e1b
- MD5 7b1eeb83bd940f956b5ba34d51840b9c
- SHA1 a6b192b62270ce6a235b5084480b7cbeade555e1
- SHA512 b91f7fa82b64d57e1c161e7f4b6ef7974b40015701d1b2b9b1531fa74de053a0910a5d8711e2f923ab521ba54b2240c86634f462a6bf6849459ca1f394260e29
- TLSH T1BD31BC2ABB9C8995CC9E0539009E9C1032E182DBC4EECF9F7A80C20095AF5C4C725A84
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1641afe7f93c73ecf8f5b5224d261aa1650a8c54c1d9f329c3da31b19fd7925f
- MD5 ff5e3abc3c0703982322da96eeaa608a
- SHA1 e304d89ecc426f985696ec1a46c2ff9bfb9799d9
- SHA512 e68891be47be112ea770c828c097bd6c0c1a16b0b310c6a4ba6272da637dcf38192a1765b89b3df5c8c03c2cb4c63d85596b23da68eca3a71265286dc5c442c2
- TLSH T1A931CE2ABB9CC995CC9E053A009DAC0071F5C2D7C6DECFDF7AC0C200A9AF9C4CA65A44
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6c6ac96723e983194a7e53f8ce4cd92310b2cbb20d165963e9c68328c224b5cf
- MD5 5287087449ec0941c55001326a3d6568
- SHA1 80e2c83a0fd8cf25e2a280fd201203a0ac2a448d
- SHA512 1518cab9f5aca0fb674a964d2af01b4df8fcc1a8d9ad92f079f3d16b2cb873700837eea1943d92144531605d93ebd05fe5c3aa7bf4a3faa1b5f05cdc570f09d5
- TLSH T10B216527B3DDC921DC9A123A509D9C1076B692C7809ECF9F6FC4D615907F6C8CB21194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 125df37267fd668c8c76905436d74f0bd39efc7b1d8f3243c928286c9e9fc2f4
- MD5 3e67b26ba924a3026de70bc0b0ee9411
- SHA1 3a41f5c8f1ab109a87d7af009eed306b8f8e293f
- SHA512 740c2c1aaebc1227c88bde9ad2fa2cba5fca9372a423c14241f40e0da7ab9b82f3d4cebc81ded43bf700b42c68555d140fd896eff900a61d27485146d19d61cf
- TLSH T114216227B3DDC921DC9A123A609D9C1076B682C7819FCF9F6BC0D62590BFAC8CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f328b7c6e844c49ba29053501b9e9d1ee4850ff1984bb578aa946702e803b9f2
- MD5 793b3f6ff9f28e2b0b91178065df2558
- SHA1 5a2d12b86c1269123f8ae285dcf5d33129e742cb
- SHA512 fa41e74cf387527b2ba91ab02fa9e353973f05124c8201ba951fde5902a9e456e58e5312f46190a67087d8982eef084f42dcdc109bbda78278dd9c1b1462b672
- TLSH T17121A827B3DCC921CC86123A009D9C1176B283C7809ECF9F6BC0D610A0BF999CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2c254aea8085a2dd4eb91fef354d485a2910bf3c5b5c40526011ad3986025293
- MD5 d37b991dc6daa6b0919e933d28d3c4a1
- SHA1 115e2a3e7d750859841ed0193c7309a0c40f7688
- SHA512 675ca15b4d805e0f9da359bb4d5fba602ffe3796dd1f4764ebc71d79ea8b629b5c85d757bd2d572dbd60db63ffed9904e1e7d871fb4b8c5f3efc82dbb1aafab2
- TLSH T16421A927B3DC8922DCD9163A109D9C1136AA83C7849EDF9F6FC0D324957FAC8CB21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f22342072c504d22f11a12056a4a4c37f84052ad2d24461b7e9ebc9c5fadd323
- MD5 223f3b8ee380d772f1af27eb8493beb2
- SHA1 70d5029af6071e3e01b36df0ba1a25a245c0206a
- SHA512 ba4192a81480f55b943eb6a1d56040151f8612978a11b9c87214406bca40082091d908e039d5168de7ffa7734ded37a2aa9d13b8a5c35538793213700c1d3f7f
- TLSH T12C21A927B3DC8822DCD9123A509D9C1136BA97C7849ECF9F6FC0D224957FAC8CB21290
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 c20329a06a2044e460db5a100997a8abfc6405afd2ee628787fbace738c2efd7
- MD5 3cf14c5706e28d4183409ecd93257f49
- SHA1 66c1e5797c036349286bab43e58d63ec70d683b6
- SHA512 c71328d27d438f1425baa03670234099e2350f5813c86187fe5548b5f5f8314679b8c5ff8609f89855980e61ccf5242fd0062c3c4155516db79c0b3af916d43e
- SSDEEP 24576:8u8m+1zpdoO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:u
- TLSH T17F47A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bb3cec94-c11e-42e9-a7e6-4efa16fe6753}_OnDiskSnapshotProp
- Size 6KB
- SHA256 89b91c61b345bc5678f44dcd314d8bad94866e302ba7235a79542ac1c23b7ff2
- MD5 62a76ec36e233f9896f3ff57d006dfb7
- SHA1 6f7d281e192ebd216f526235a9e57db6cde50a83
- SHA512 ded685595ca6e0be06c60949d92663bdc6e07f036e6d9cd981f6a1b30f375eee74057b9133dc8357568efe505807e967c2c2d5ed24c92c6e8f459b20d4736a74
- SSDEEP 96:FEylI2vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:+yzb++ZVm
- TLSH T14DD189085AE54711E2B3AB312DF58557A877B811EF33CB8E0298638E2670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH