Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
25/08/2024, 12:13
Behavioral task
behavioral1
Sample
fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
leonardo-mesh.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
leonardo-mesh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
- Size 1.6MB
- Sample240825-pdvgystdlc
- SHA256 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373
- MD5 dc37d19933e5689c25bc6cce8c15d58c
- SHA1 5465ed40e9ce77663bcb5213cf7deb6bded25804
- SHA512 15ca53e95a2e74d17b87778354ed7508192fb2225ca6c40db7693909c35b02726472f19b060be878c02f5d89c17f99ffaf7600289f82930fdfd28507fa1b881d
- SSDEEP 24576:zadIJEV+Vz4OjRZMpM2wSZB8Q04KfA3NapQpN65NlwBy8rTx3ZmIkmu3ylHAhf8:WIii8uqMIBv09cNgHwBy8rVkUkyR+U
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000015d34-1.dat family_meshagent - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Mesh Agent\ImagePath = "\"C:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe\" " leonardo-mesh.exe - Executes dropped EXE 11 IoCs
pid Process 2712 leonardo-mesh.exe 2840 MeshAgent.exe 2984 MeshAgent.exe 1796 MeshAgent.exe 2804 MeshAgent.exe 2080 MeshAgent.exe 448 MeshAgent.exe 328 MeshAgent.exe 2976 MeshAgent.exe 892 MeshAgent.exe 2668 MeshAgent.exe - Loads dropped DLL 1 IoCs
pid Process 2864 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 25 IoCs
description ioc Process File created C:\Program Files (x86)\Mesh Agent\MeshAgent.msh MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File created C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File created C:\Program Files (x86)\Mesh Agent\MeshAgent.exe leonardo-mesh.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File created C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language leonardo-mesh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Modifies data under HKEY_USERS 30 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2668 wmic.exe Token: SeIncreaseQuotaPrivilege 2668 wmic.exe Token: SeSecurityPrivilege 2668 wmic.exe Token: SeTakeOwnershipPrivilege 2668 wmic.exe Token: SeLoadDriverPrivilege 2668 wmic.exe Token: SeSystemtimePrivilege 2668 wmic.exe Token: SeBackupPrivilege 2668 wmic.exe Token: SeRestorePrivilege 2668 wmic.exe Token: SeShutdownPrivilege 2668 wmic.exe Token: SeSystemEnvironmentPrivilege 2668 wmic.exe Token: SeUndockPrivilege 2668 wmic.exe Token: SeManageVolumePrivilege 2668 wmic.exe Token: SeAssignPrimaryTokenPrivilege 2668 wmic.exe Token: SeIncreaseQuotaPrivilege 2668 wmic.exe Token: SeSecurityPrivilege 2668 wmic.exe Token: SeTakeOwnershipPrivilege 2668 wmic.exe Token: SeLoadDriverPrivilege 2668 wmic.exe Token: SeSystemtimePrivilege 2668 wmic.exe Token: SeBackupPrivilege 2668 wmic.exe Token: SeRestorePrivilege 2668 wmic.exe Token: SeShutdownPrivilege 2668 wmic.exe Token: SeSystemEnvironmentPrivilege 2668 wmic.exe Token: SeUndockPrivilege 2668 wmic.exe Token: SeManageVolumePrivilege 2668 wmic.exe Token: SeAssignPrimaryTokenPrivilege 1892 wmic.exe Token: SeIncreaseQuotaPrivilege 1892 wmic.exe Token: SeSecurityPrivilege 1892 wmic.exe Token: SeTakeOwnershipPrivilege 1892 wmic.exe Token: SeLoadDriverPrivilege 1892 wmic.exe Token: SeSystemtimePrivilege 1892 wmic.exe Token: SeBackupPrivilege 1892 wmic.exe Token: SeRestorePrivilege 1892 wmic.exe Token: SeShutdownPrivilege 1892 wmic.exe Token: SeSystemEnvironmentPrivilege 1892 wmic.exe Token: SeUndockPrivilege 1892 wmic.exe Token: SeManageVolumePrivilege 1892 wmic.exe Token: SeAssignPrimaryTokenPrivilege 1892 wmic.exe Token: SeIncreaseQuotaPrivilege 1892 wmic.exe Token: SeSecurityPrivilege 1892 wmic.exe Token: SeTakeOwnershipPrivilege 1892 wmic.exe Token: SeLoadDriverPrivilege 1892 wmic.exe Token: SeSystemtimePrivilege 1892 wmic.exe Token: SeBackupPrivilege 1892 wmic.exe Token: SeRestorePrivilege 1892 wmic.exe Token: SeShutdownPrivilege 1892 wmic.exe Token: SeSystemEnvironmentPrivilege 1892 wmic.exe Token: SeUndockPrivilege 1892 wmic.exe Token: SeManageVolumePrivilege 1892 wmic.exe Token: SeAssignPrimaryTokenPrivilege 3020 wmic.exe Token: SeIncreaseQuotaPrivilege 3020 wmic.exe Token: SeSecurityPrivilege 3020 wmic.exe Token: SeTakeOwnershipPrivilege 3020 wmic.exe Token: SeLoadDriverPrivilege 3020 wmic.exe Token: SeSystemtimePrivilege 3020 wmic.exe Token: SeBackupPrivilege 3020 wmic.exe Token: SeRestorePrivilege 3020 wmic.exe Token: SeShutdownPrivilege 3020 wmic.exe Token: SeSystemEnvironmentPrivilege 3020 wmic.exe Token: SeUndockPrivilege 3020 wmic.exe Token: SeManageVolumePrivilege 3020 wmic.exe Token: SeAssignPrimaryTokenPrivilege 3020 wmic.exe Token: SeIncreaseQuotaPrivilege 3020 wmic.exe Token: SeSecurityPrivilege 3020 wmic.exe Token: SeTakeOwnershipPrivilege 3020 wmic.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2712 2864 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe 30 PID 2864 wrote to memory of 2712 2864 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe 30 PID 2864 wrote to memory of 2712 2864 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe 30 PID 2864 wrote to memory of 2712 2864 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe 30 PID 2840 wrote to memory of 2668 2840 MeshAgent.exe 34 PID 2840 wrote to memory of 2668 2840 MeshAgent.exe 34 PID 2840 wrote to memory of 2668 2840 MeshAgent.exe 34 PID 2840 wrote to memory of 2668 2840 MeshAgent.exe 34 PID 2840 wrote to memory of 1892 2840 MeshAgent.exe 36 PID 2840 wrote to memory of 1892 2840 MeshAgent.exe 36 PID 2840 wrote to memory of 1892 2840 MeshAgent.exe 36 PID 2840 wrote to memory of 1892 2840 MeshAgent.exe 36 PID 2840 wrote to memory of 3020 2840 MeshAgent.exe 38 PID 2840 wrote to memory of 3020 2840 MeshAgent.exe 38 PID 2840 wrote to memory of 3020 2840 MeshAgent.exe 38 PID 2840 wrote to memory of 3020 2840 MeshAgent.exe 38 PID 2840 wrote to memory of 2564 2840 MeshAgent.exe 40 PID 2840 wrote to memory of 2564 2840 MeshAgent.exe 40 PID 2840 wrote to memory of 2564 2840 MeshAgent.exe 40 PID 2840 wrote to memory of 2564 2840 MeshAgent.exe 40 PID 2840 wrote to memory of 536 2840 MeshAgent.exe 42 PID 2840 wrote to memory of 536 2840 MeshAgent.exe 42 PID 2840 wrote to memory of 536 2840 MeshAgent.exe 42 PID 2840 wrote to memory of 536 2840 MeshAgent.exe 42 PID 2840 wrote to memory of 2924 2840 MeshAgent.exe 44 PID 2840 wrote to memory of 2924 2840 MeshAgent.exe 44 PID 2840 wrote to memory of 2924 2840 MeshAgent.exe 44 PID 2840 wrote to memory of 2924 2840 MeshAgent.exe 44 PID 2984 wrote to memory of 2900 2984 MeshAgent.exe 47 PID 2984 wrote to memory of 2900 2984 MeshAgent.exe 47 PID 2984 wrote to memory of 2900 2984 MeshAgent.exe 47 PID 2984 wrote to memory of 2900 2984 MeshAgent.exe 47 PID 2984 wrote to memory of 1748 2984 MeshAgent.exe 49 PID 2984 wrote to memory of 1748 2984 MeshAgent.exe 49 PID 2984 wrote to memory of 1748 2984 MeshAgent.exe 49 PID 2984 wrote to memory of 1748 2984 MeshAgent.exe 49 PID 2984 wrote to memory of 2296 2984 MeshAgent.exe 51 PID 2984 wrote to memory of 2296 2984 MeshAgent.exe 51 PID 2984 wrote to memory of 2296 2984 MeshAgent.exe 51 PID 2984 wrote to memory of 2296 2984 MeshAgent.exe 51 PID 2984 wrote to memory of 2444 2984 MeshAgent.exe 53 PID 2984 wrote to memory of 2444 2984 MeshAgent.exe 53 PID 2984 wrote to memory of 2444 2984 MeshAgent.exe 53 PID 2984 wrote to memory of 2444 2984 MeshAgent.exe 53 PID 2984 wrote to memory of 604 2984 MeshAgent.exe 55 PID 2984 wrote to memory of 604 2984 MeshAgent.exe 55 PID 2984 wrote to memory of 604 2984 MeshAgent.exe 55 PID 2984 wrote to memory of 604 2984 MeshAgent.exe 55 PID 1796 wrote to memory of 1668 1796 MeshAgent.exe 59 PID 1796 wrote to memory of 1668 1796 MeshAgent.exe 59 PID 1796 wrote to memory of 1668 1796 MeshAgent.exe 59 PID 1796 wrote to memory of 1668 1796 MeshAgent.exe 59 PID 1796 wrote to memory of 2136 1796 MeshAgent.exe 61 PID 1796 wrote to memory of 2136 1796 MeshAgent.exe 61 PID 1796 wrote to memory of 2136 1796 MeshAgent.exe 61 PID 1796 wrote to memory of 2136 1796 MeshAgent.exe 61 PID 1796 wrote to memory of 2284 1796 MeshAgent.exe 63 PID 1796 wrote to memory of 2284 1796 MeshAgent.exe 63 PID 1796 wrote to memory of 2284 1796 MeshAgent.exe 63 PID 1796 wrote to memory of 2284 1796 MeshAgent.exe 63 PID 1796 wrote to memory of 2104 1796 MeshAgent.exe 65 PID 1796 wrote to memory of 2104 1796 MeshAgent.exe 65 PID 1796 wrote to memory of 2104 1796 MeshAgent.exe 65 PID 1796 wrote to memory of 2104 1796 MeshAgent.exe 65
Processes
-
C:\Users\Admin\AppData\Local\Temp\fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe"C:\Users\Admin\AppData\Local\Temp\fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Roaming\Leonardo\leonardo-mesh.exe"C:\Users\Admin\AppData\Roaming\Leonardo\leonardo-mesh.exe" -fullinstall2⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2712
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2564
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:536
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2924
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2900
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:1748
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2296
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2444
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:604
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1668
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2136
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2284
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2104
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2804 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2796
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2664
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2528
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2384
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2504
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2080 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2388
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1372
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1672
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2308
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:448 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2888
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2256
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:1912
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1428
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1624
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:328 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2968
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:1640
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2216
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:3048
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2976 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2908
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2272
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2488
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2984
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:892 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1684
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1728
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2576
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵PID:2792
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2668 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3020
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:808
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2804
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.db
- Size 268KB
- SHA256 ad4d9dda46d51656bb7f6d1382996f2f0b94663f0e565c4134e5cd442a499c23
- MD5 12f3e4cc6dd57eb67d4dde4673f59c2e
- SHA1 d778225df1a528fefab063e313d9ab933169a7d9
- SHA512 ec7dcced09a67715f1d0ffba200a7cb589417e56463b131cdb5f127bdfc4391d36c2859e920835d34d2769839ac276f9fbbe42d8164ae683779fbc534bc1aa5e
- SSDEEP 6144:a9+ojQh4gek86/UJ28+skVCQh4gek86/UJ28+skVI:a9+o24EzWvk94EzWvkm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.db
- Size 385KB
- SHA256 cf59cdc8d3b42cd176a16ba2dd87a228a027f65d25613b27ea2a294d1d6af95f
- MD5 e50b52a0d0c73b7cf1046ccbfcb0cbf3
- SHA1 e2ba6e7b5935996883d119e05a084bad1b5fa84b
- SHA512 7c4bcdc143e462a779742568d98f72ef74815592928da017ce8b06cbecbc50e85e38fa446a13cc964bf7392a20ca3cd1029ed13c16d66081620c446f5661f5ed
- SSDEEP 6144:a9+ojQh4gek86/UJ28+skVCQh4gek86/UJ28+skVCQh4gek86/UJ28+skVI:a9+o24EzWvk94EzWvk94EzWvkm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.db
- Size 151KB
- SHA256 8525b7df9ecb6ea34d377de7898d0552933ee2e9aad3783b071c74c44b57421c
- MD5 8c763eed3afb706b68554aab8491037c
- SHA1 2533fe5952196a577e4c92ec9345901f3fcadbd5
- SHA512 3ab87a648831de8128d1fb596c5d1e869e38433059a1b0a4959847886b4d4b270d9541a4595f37c4e0a3ad8544b01d4d15fca924bb37c72b6e9f7512d458b868
- SSDEEP 3072:8j9+oCIQh4LER+bxOFR+DLkcwcpG55UJBM9W1hQs1mVI:a9+ojQh4gek86/UJ28+skVI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 48b8754dd5f1838e9355441fb5da34de846348a5d43f835184ee0f0f491759a3
- MD5 10f3d79babda929c6740ad603770720d
- SHA1 07e62f5c76660cd520ba9a3d9daaa31f2ab6d4c0
- SHA512 05c995f8842104eb39c96bee5ec4923cff2c3ad3ca7fe65c661904cddb9d981fa28d17ddb31afedfb66c718ef62071788df9a99022285957fe17f8d3d0365def
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 4b6bc5f9f9c8bb508b90e68575bb7378366aed9944df28a9dd2586d7d9536387
- MD5 6b583798cb7e5852dc9a4a938498b595
- SHA1 908038d374e50e1c8533cd7d4b1febaa0719ca50
- SHA512 0e77162dcf998927a80128d24629c25f85ea2b3c7eae35ba5ab39bf0f7aacdd08ff23cedfc0bdaf9da1ab7740fdaecf3564dd5aec3ed2910caf4c3bb3fe01ec9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 4d064a345ab9fa525279a98729584780219667888ea513c8430ecaa6968d4b4a
- MD5 4cfaaa8d118d8353dc4f5205ce807348
- SHA1 3ca262e1e5bc29ac8ce51678dc5317ee5292eddb
- SHA512 cff2b61b627a42ade4043bc91538c847990e4e91ef12f9fbee2eda756b96012a245ec4240cd874dbe59fc72d6271a919df0a1b04abf7a19df848d40351eebb8f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 83b121e0bb218f8b605d3cb3ed07c244a4999bda8cfb7e724efe793a8e023293
- MD5 7c4920e315495884658b61bdf19459f4
- SHA1 b7eaa69c2fccd3a51d9a8786e95d739f718c7e82
- SHA512 09f022d7b36617adee1cd1ff4d6f180b8e95d05c0caaca6aeda54a9f1bc58cdb628a04356d71daf87fa1fdb9258f0df921c24b4420d027cdba136073f245b1c3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 b4385ba20aa9d2dc567b05a7744aa4b4835a2a6878d5f4cb76c27d6243df57b7
- MD5 e6848ece1a39ced35fcdc1c534b1b98b
- SHA1 f7c5484c1bf701aa5596520a589cae7993eced88
- SHA512 57565e03278ec90225dc41487c1fb833542753f1d3ae96441e449a068279636f7694820d9136cdea91d9b3c801e3a9eebef7f3ce3d3f772b1a8919ec7797043e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 169545293b781a898a200c6430086e02ae4f7d3593bba222d3d7a65f7974a820
- MD5 584df860c1f78003c28e98ebe014c2c2
- SHA1 cf30626023a0469976f29cf934ce1091f1e446f4
- SHA512 eae5204debd4de5528c4885bb965601fa289a89f40642dde980941e23a639ba603138fe913e8c450c514865196bd5191d3d3cd168000a082c89a1326f3a27809
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 543c5ebd7a16a46954b02413b445968eee1ce6e6e3838d2b81f7173b2c1687b7
- MD5 5c290a95aaed925b29d5c386c1f81c02
- SHA1 33e782df31a719be44dea273749292e915bd84ff
- SHA512 f53aa685354c6045938fc0aef905b21049edfa96f3a6315818df568d8d82a771cd4ebd6490d90abaaf26f4fdd44704ac9555b689ab511634c63a651b69ebd682
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 703B
- SHA256 0cb5ba8757773e011ec1880a3f05b80e83c5b3748d8e3992d3a5bb91cd7525bb
- MD5 b3536fa97c0828de0313e220452d268c
- SHA1 f52b8f5207edf3d96f4c29c6d24dc874d30813e1
- SHA512 9b754e79706f12c53536274dedd9f37a36c56b335fc94bd3f817e183514ee40ea6b2bf887f36588beb69e8e5ac7dbbb3632d5b95f691cec93f8f35962fa25319
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 870B
- SHA256 eab1c58fef99c9eb1dfbc2c2bca31870977cbcf0bbde4aa790551f5e67cb60ad
- MD5 97aa17542d2030fcf09c92a6bfa16a89
- SHA1 070006736513639f1a215075e85485a8d7c1fbc4
- SHA512 af4e3d44b098dfe35e0a516d68e8e27a7dc6477f0f57c07f7784d94dce816d634fd9d2ac751157f66456bd5227dd3d96ff350e8af2ae303f9a524afa9ae6bcc9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.msh
- Size 29KB
- SHA256 010e68384a9d06b183034df449e2b48b445e27af5a17f406bc7075d20c2ba1ca
- MD5 7f870940f8b4ea4c24d0bb2dd0af11dc
- SHA1 348410ad14fe6d61ae1a917dc16e030d54f7cc7d
- SHA512 4ea3ceea55610d64cab29f8683dda05bd95fd6c8b4cf30b2b5d25b86c95f01db7a78b29fd3854638f2daafb1b7c57f197f982b17332d95aed6f9ad000952a6c7
- SSDEEP 768:mOCVrhH/ZmomhkrQCJwZuB9HWFa3p00Wpn:WMhkrNB97Wpn
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\Leonardo\leonardo-mesh.exe
- Size 3.7MB
- SHA256 7c4ac45d254e50dac72902c8f0cd2b5eb474818c15a01887e6b8ed5ed71cac8d
- MD5 e15811177975fb1c9e916807aa6a9f3a
- SHA1 5c64afef7bb8770f897b424dc91352ae472bb637
- SHA512 3aebb5ef4cafaf2dfffebbfad427aa48be6148222b5896f4f7f575720b09e24af4c05936aa37342d26b6f7d6c0b502a44697944274b725facd1dd8a212142f92
- SSDEEP 49152:v8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5Qj:v8o8VOUs9joRbMc2tSW6j
- MD5 SHA1 SHA512 SSDEEP