Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 12:13
Behavioral task
behavioral1
Sample
fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
leonardo-mesh.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
leonardo-mesh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
- Size 1.6MB
- Sample240825-pdvgystdlc
- SHA256 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373
- MD5 dc37d19933e5689c25bc6cce8c15d58c
- SHA1 5465ed40e9ce77663bcb5213cf7deb6bded25804
- SHA512 15ca53e95a2e74d17b87778354ed7508192fb2225ca6c40db7693909c35b02726472f19b060be878c02f5d89c17f99ffaf7600289f82930fdfd28507fa1b881d
- SSDEEP 24576:zadIJEV+Vz4OjRZMpM2wSZB8Q04KfA3NapQpN65NlwBy8rTx3ZmIkmu3ylHAhf8:WIii8uqMIBv09cNgHwBy8rVkUkyR+U
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral2/files/0x000700000002342f-2.dat family_meshagent - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe\" " leonardo-mesh.exe - Executes dropped EXE 11 IoCs
pid Process 3912 leonardo-mesh.exe 3528 MeshAgent.exe 3764 MeshAgent.exe 3200 MeshAgent.exe 4980 MeshAgent.exe 2164 MeshAgent.exe 1796 MeshAgent.exe 2068 MeshAgent.exe 3364 MeshAgent.exe 1796 MeshAgent.exe 3500 MeshAgent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\DLL\wkernel32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\wntdll.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\wuser32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\44919597229A9386AD8AB3EB7E688415E97C59E5 MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\wrpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\wgdi32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\wuser32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\wgdi32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wwin32u.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\exe\MeshService.pdb MeshAgent.exe File opened for modification C:\Windows\SysWOW64\dll\ntasn1.pdb MeshAgent.exe - Drops file in Program Files directory 25 IoCs
description ioc Process File created C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File created C:\Program Files (x86)\Mesh Agent\MeshAgent.exe leonardo-mesh.exe File created C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File created C:\Program Files (x86)\Mesh Agent\MeshAgent.msh MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe File opened for modification C:\Program Files (x86)\Mesh Agent\MeshAgent.log MeshAgent.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language leonardo-mesh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Modifies data under HKEY_USERS 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133690616029715361" MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4936 wmic.exe Token: SeIncreaseQuotaPrivilege 4936 wmic.exe Token: SeSecurityPrivilege 4936 wmic.exe Token: SeTakeOwnershipPrivilege 4936 wmic.exe Token: SeLoadDriverPrivilege 4936 wmic.exe Token: SeSystemtimePrivilege 4936 wmic.exe Token: SeBackupPrivilege 4936 wmic.exe Token: SeRestorePrivilege 4936 wmic.exe Token: SeShutdownPrivilege 4936 wmic.exe Token: SeSystemEnvironmentPrivilege 4936 wmic.exe Token: SeUndockPrivilege 4936 wmic.exe Token: SeManageVolumePrivilege 4936 wmic.exe Token: SeAssignPrimaryTokenPrivilege 4936 wmic.exe Token: SeIncreaseQuotaPrivilege 4936 wmic.exe Token: SeSecurityPrivilege 4936 wmic.exe Token: SeTakeOwnershipPrivilege 4936 wmic.exe Token: SeLoadDriverPrivilege 4936 wmic.exe Token: SeSystemtimePrivilege 4936 wmic.exe Token: SeBackupPrivilege 4936 wmic.exe Token: SeRestorePrivilege 4936 wmic.exe Token: SeShutdownPrivilege 4936 wmic.exe Token: SeSystemEnvironmentPrivilege 4936 wmic.exe Token: SeUndockPrivilege 4936 wmic.exe Token: SeManageVolumePrivilege 4936 wmic.exe Token: SeAssignPrimaryTokenPrivilege 2684 wmic.exe Token: SeIncreaseQuotaPrivilege 2684 wmic.exe Token: SeSecurityPrivilege 2684 wmic.exe Token: SeTakeOwnershipPrivilege 2684 wmic.exe Token: SeLoadDriverPrivilege 2684 wmic.exe Token: SeSystemtimePrivilege 2684 wmic.exe Token: SeBackupPrivilege 2684 wmic.exe Token: SeRestorePrivilege 2684 wmic.exe Token: SeShutdownPrivilege 2684 wmic.exe Token: SeSystemEnvironmentPrivilege 2684 wmic.exe Token: SeUndockPrivilege 2684 wmic.exe Token: SeManageVolumePrivilege 2684 wmic.exe Token: SeAssignPrimaryTokenPrivilege 2684 wmic.exe Token: SeIncreaseQuotaPrivilege 2684 wmic.exe Token: SeSecurityPrivilege 2684 wmic.exe Token: SeTakeOwnershipPrivilege 2684 wmic.exe Token: SeLoadDriverPrivilege 2684 wmic.exe Token: SeSystemtimePrivilege 2684 wmic.exe Token: SeBackupPrivilege 2684 wmic.exe Token: SeRestorePrivilege 2684 wmic.exe Token: SeShutdownPrivilege 2684 wmic.exe Token: SeSystemEnvironmentPrivilege 2684 wmic.exe Token: SeUndockPrivilege 2684 wmic.exe Token: SeManageVolumePrivilege 2684 wmic.exe Token: SeAssignPrimaryTokenPrivilege 3972 wmic.exe Token: SeIncreaseQuotaPrivilege 3972 wmic.exe Token: SeSecurityPrivilege 3972 wmic.exe Token: SeTakeOwnershipPrivilege 3972 wmic.exe Token: SeLoadDriverPrivilege 3972 wmic.exe Token: SeSystemtimePrivilege 3972 wmic.exe Token: SeBackupPrivilege 3972 wmic.exe Token: SeRestorePrivilege 3972 wmic.exe Token: SeShutdownPrivilege 3972 wmic.exe Token: SeSystemEnvironmentPrivilege 3972 wmic.exe Token: SeUndockPrivilege 3972 wmic.exe Token: SeManageVolumePrivilege 3972 wmic.exe Token: SeAssignPrimaryTokenPrivilege 3972 wmic.exe Token: SeIncreaseQuotaPrivilege 3972 wmic.exe Token: SeSecurityPrivilege 3972 wmic.exe Token: SeTakeOwnershipPrivilege 3972 wmic.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3912 3980 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe 85 PID 3980 wrote to memory of 3912 3980 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe 85 PID 3980 wrote to memory of 3912 3980 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe 85 PID 3528 wrote to memory of 4936 3528 MeshAgent.exe 94 PID 3528 wrote to memory of 4936 3528 MeshAgent.exe 94 PID 3528 wrote to memory of 4936 3528 MeshAgent.exe 94 PID 3528 wrote to memory of 2684 3528 MeshAgent.exe 96 PID 3528 wrote to memory of 2684 3528 MeshAgent.exe 96 PID 3528 wrote to memory of 2684 3528 MeshAgent.exe 96 PID 3528 wrote to memory of 3972 3528 MeshAgent.exe 98 PID 3528 wrote to memory of 3972 3528 MeshAgent.exe 98 PID 3528 wrote to memory of 3972 3528 MeshAgent.exe 98 PID 3528 wrote to memory of 2932 3528 MeshAgent.exe 100 PID 3528 wrote to memory of 2932 3528 MeshAgent.exe 100 PID 3528 wrote to memory of 2932 3528 MeshAgent.exe 100 PID 3528 wrote to memory of 2352 3528 MeshAgent.exe 102 PID 3528 wrote to memory of 2352 3528 MeshAgent.exe 102 PID 3528 wrote to memory of 2352 3528 MeshAgent.exe 102 PID 3528 wrote to memory of 804 3528 MeshAgent.exe 105 PID 3528 wrote to memory of 804 3528 MeshAgent.exe 105 PID 3528 wrote to memory of 804 3528 MeshAgent.exe 105 PID 3764 wrote to memory of 832 3764 MeshAgent.exe 110 PID 3764 wrote to memory of 832 3764 MeshAgent.exe 110 PID 3764 wrote to memory of 832 3764 MeshAgent.exe 110 PID 3764 wrote to memory of 3604 3764 MeshAgent.exe 112 PID 3764 wrote to memory of 3604 3764 MeshAgent.exe 112 PID 3764 wrote to memory of 3604 3764 MeshAgent.exe 112 PID 3764 wrote to memory of 2176 3764 MeshAgent.exe 114 PID 3764 wrote to memory of 2176 3764 MeshAgent.exe 114 PID 3764 wrote to memory of 2176 3764 MeshAgent.exe 114 PID 3764 wrote to memory of 2260 3764 MeshAgent.exe 116 PID 3764 wrote to memory of 2260 3764 MeshAgent.exe 116 PID 3764 wrote to memory of 2260 3764 MeshAgent.exe 116 PID 3764 wrote to memory of 2332 3764 MeshAgent.exe 118 PID 3764 wrote to memory of 2332 3764 MeshAgent.exe 118 PID 3764 wrote to memory of 2332 3764 MeshAgent.exe 118 PID 3200 wrote to memory of 4052 3200 MeshAgent.exe 121 PID 3200 wrote to memory of 4052 3200 MeshAgent.exe 121 PID 3200 wrote to memory of 4052 3200 MeshAgent.exe 121 PID 3200 wrote to memory of 2384 3200 MeshAgent.exe 123 PID 3200 wrote to memory of 2384 3200 MeshAgent.exe 123 PID 3200 wrote to memory of 2384 3200 MeshAgent.exe 123 PID 3200 wrote to memory of 2244 3200 MeshAgent.exe 125 PID 3200 wrote to memory of 2244 3200 MeshAgent.exe 125 PID 3200 wrote to memory of 2244 3200 MeshAgent.exe 125 PID 3200 wrote to memory of 3596 3200 MeshAgent.exe 127 PID 3200 wrote to memory of 3596 3200 MeshAgent.exe 127 PID 3200 wrote to memory of 3596 3200 MeshAgent.exe 127 PID 3200 wrote to memory of 3904 3200 MeshAgent.exe 129 PID 3200 wrote to memory of 3904 3200 MeshAgent.exe 129 PID 3200 wrote to memory of 3904 3200 MeshAgent.exe 129 PID 4980 wrote to memory of 4988 4980 MeshAgent.exe 133 PID 4980 wrote to memory of 4988 4980 MeshAgent.exe 133 PID 4980 wrote to memory of 4988 4980 MeshAgent.exe 133 PID 4980 wrote to memory of 2736 4980 MeshAgent.exe 135 PID 4980 wrote to memory of 2736 4980 MeshAgent.exe 135 PID 4980 wrote to memory of 2736 4980 MeshAgent.exe 135 PID 4980 wrote to memory of 4204 4980 MeshAgent.exe 137 PID 4980 wrote to memory of 4204 4980 MeshAgent.exe 137 PID 4980 wrote to memory of 4204 4980 MeshAgent.exe 137 PID 4980 wrote to memory of 752 4980 MeshAgent.exe 140 PID 4980 wrote to memory of 752 4980 MeshAgent.exe 140 PID 4980 wrote to memory of 752 4980 MeshAgent.exe 140 PID 4980 wrote to memory of 1832 4980 MeshAgent.exe 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe"C:\Users\Admin\AppData\Local\Temp\fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Roaming\Leonardo\leonardo-mesh.exe"C:\Users\Admin\AppData\Roaming\Leonardo\leonardo-mesh.exe" -fullinstall2⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3912
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2932
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:2352
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:804
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:832
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:3604
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2176
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:2260
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2332
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:4052
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2244
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:3596
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:3904
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:4988
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:4204
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:752
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2164 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:4404
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:3708
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:4460
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵PID:3764
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:3352
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1796 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:636
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:3972
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:716
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:4640
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1896
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2068 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:116
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:2640
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:4116
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:3272
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2144
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3364 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:3604
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:4204
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1248
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:3200
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:3004
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:4916
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1796 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:4736
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:1400
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:3128
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:1668
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2232
-
-
C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3500 -
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:4992
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
PID:3580
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:2224
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- System Location Discovery: System Language Discovery
PID:464
-
-
C:\Windows\SysWOW64\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵
- System Location Discovery: System Language Discovery
PID:3364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.db
- Size 268KB
- SHA256 f1bf619671cf74a1e92a640c10ff835eeed95f16abbb6d120343571e1c37ed57
- MD5 dec35f463cc592d0e860f13590140bd6
- SHA1 ab2b043f5c74343cfd257fd544e813b7b82b6d84
- SHA512 5f2a77211e25d86b32aac4c4a05ffef5a2eba0f73cff36ff2a354ae4be7c009d9380fe22ed3c9c9efe3694444cdd82630aefb4680132d5842e0fecc2b35f603b
- SSDEEP 6144:a9+QQh4gek86/UJ28+skVCQh4gek86/UJ28+skVI:a9+B4EzWvk94EzWvkm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.db
- Size 385KB
- SHA256 9a61f0a51b3ebe08eefd8e31260d8578c4cbf4dd640c653ed41d65043889420d
- MD5 169bba87bbf8ad374ea92bbf6bb7a757
- SHA1 2d4302f62548b489585acff3d166f6dcd319d754
- SHA512 99db03ec00152006072863cfbd1e9d28af8f31521d01272ec994c006aa5e5ab788b4fbaf1e0bc5f943ee94116b5c06a822891fc544c41067e34d1824bed4843e
- SSDEEP 6144:a9+QQh4gek86/UJ28+skVCQh4gek86/UJ28+skVCQh4gek86/UJ28+skVI:a9+B4EzWvk94EzWvk94EzWvkm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.db
- Size 151KB
- SHA256 c843a75560ea2d2980326cfbd0059ba7b736270dae57ec09c9880c76fb041929
- MD5 aa06b918d232476cf0758cd26979bee2
- SHA1 313f0e02dea8831d9702b0d5aa6e33fe9386b08e
- SHA512 efe640a68289b9ebef4d8ddd01ac01162976bc2f0f6f201ebf92a79bd3020802d7daf31d97480274fae0c67b6c4f15ef563f6f050c8e5b5b7f4cf4939cf43929
- SSDEEP 3072:8j9+/IQh4LER+bxOFR+DLkcwcpG55UJBM9W1hQs1mVI:a9+QQh4gek86/UJ28+skVI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 491f495839e44a47721b50599ee565ea9efbad81add9cb5172f2ed52c0af8a34
- MD5 60fb4dc9c520004aec1a6e377acec733
- SHA1 bff614cd21fd5b2fa09cf306209dd0f797bc02a5
- SHA512 6eb22c51161cb994274d9b12470d5b2412d44b5b4e26d316b81c4c59e9e723a45810488f4da33c12880b93aec1754c9ddd2a35c1a0f94dcf727242d33dc65290
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 da8e0be0852ec39fab7ce0547fb4822bd767b02a1f23718378e1bc34b04346b1
- MD5 eb8cb5cc4ad52f52fdd3d5c6c144ad80
- SHA1 421e9012fe7a6b03870468ffa8328bb8683ab030
- SHA512 82c35d1f84cdeae5d89df0377d3272109ff2e7be6ae4a762569340221ed2d8bb1557ff6ae18e96276721ddbf1b272e2ad5d5b203953f9ed1ffbf3cc3fcd7fe40
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 8ac4ad9ac429dc55362c0404ff1768b11c6feb8d959665b5cad3ceb0303fe62c
- MD5 40e8eee977f857379c4689b45ed8eb93
- SHA1 e3f23884eaf6a4f1577f488c5960c92fc247aa3a
- SHA512 c2921d9a3d87972d82f30ce73b70f0514e7844b55d88949cc01690ed8b6fbba14b0e1b6ca481a34d8a2cc9e4631c2041bed1ced6cdb25fbd2d00f342d5afde6a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 334B
- SHA256 f885299869a437ee7fb3c854328a64fde05442c28b804a0ed991a724ef02c72c
- MD5 282477e2eb56b111b35789829f674787
- SHA1 a3fdf0a6eb39d5ab815e25ca9a69208394262f64
- SHA512 e7ce5aaa7065322255194ec789ed7206a2a20e16b2bbfdc39d6ff9a9ff035c7bb25a378d292a1b5b6be6fb8e006be03b44113d3bdba4f460b0e66367931d398f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 501B
- SHA256 ea0c66423120aaf3cd9229c6f9365d0df1e38493ee74fa5970db355043690e7a
- MD5 1a1939b6bb9d6c72bdcee6d80a924e1a
- SHA1 cc67b7f7ee7cccde6026a82be5790f7a535109db
- SHA512 6e1cf7997217e901758d81535194773328ebb456afdb7ae35560de35bf6789951ffa7056bcdabe5d89e6b74f4cfe3c2cb89d65c6123368ed86bea3a474586d20
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 668B
- SHA256 fb29b384a527bca97ca66657328b7924fcde7cc3b07990d8fcb53786a2b62209
- MD5 9d9a8aadaf39a38d4e6671b065768be8
- SHA1 bf7c1cebb1db9191ba89e01109cda9f432069587
- SHA512 1773f58ab29ce9f3a194a76a9c0fa56643de3ad8419667d8b6f066e2f50a01aa28ba3f8f0e890e99d59f11f6e03b2407ba4c45c0b07d5118032d7afc0eb89518
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 835B
- SHA256 2bea9301c6fc6679fabb64a219cb139a129577034ed00853ce7c93e2b6e55524
- MD5 afc41ba62a1f7aecee37c3f39879fb75
- SHA1 c7724fe8c02a6260f6c4e337ce2dfaa3be8b7284
- SHA512 bfc756ae20dea3c932f1c66a31299f8fdfa74d13a2cb3e776be48552be13cac1a97fe4791ea9364d0595e4a8aa4aad7a20459cc2fca236a6db8cf923812d56a8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1002B
- SHA256 9aa01a965afe0fdf3daac0f314c354556095f7cb75a6eb2a5d38f1c0adc3637b
- MD5 2301d010b9cee1735d8897d454211bfa
- SHA1 d5aafc9997954606fdbda42f78d2f399207e36c8
- SHA512 c03a9b8aa80659e836a7f88e6fb185cfa9e1d58f362e47febbda0b4395980e0e7c7860805c308739868538e170c62cb9b30607409db1caeab1505641493e75f3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 3bc2234cf43f686ddb2fae5c89e8873ab5ef2b6febcf34bdd5190b76ec61f80a
- MD5 eca8a44f4595e9ebe2d40e4a52445c5b
- SHA1 7ce3970bd3c7f7f373c8239a8218bd3b7dd02496
- SHA512 486948cce3e75fea11c352e3b6e8a5c703c30dc6f01c2d43b9fb1b4bc8cbdc3663bd643d452cf7c8d5e0b189aa87a959384e30849acd41f6b3f3aac681a9c3da
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Mesh Agent\MeshAgent.msh
- Size 29KB
- SHA256 010e68384a9d06b183034df449e2b48b445e27af5a17f406bc7075d20c2ba1ca
- MD5 7f870940f8b4ea4c24d0bb2dd0af11dc
- SHA1 348410ad14fe6d61ae1a917dc16e030d54f7cc7d
- SHA512 4ea3ceea55610d64cab29f8683dda05bd95fd6c8b4cf30b2b5d25b86c95f01db7a78b29fd3854638f2daafb1b7c57f197f982b17332d95aed6f9ad000952a6c7
- SSDEEP 768:mOCVrhH/ZmomhkrQCJwZuB9HWFa3p00Wpn:WMhkrNB97Wpn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Leonardo\leonardo-mesh.exe
- Size 3.7MB
- SHA256 7c4ac45d254e50dac72902c8f0cd2b5eb474818c15a01887e6b8ed5ed71cac8d
- MD5 e15811177975fb1c9e916807aa6a9f3a
- SHA1 5c64afef7bb8770f897b424dc91352ae472bb637
- SHA512 3aebb5ef4cafaf2dfffebbfad427aa48be6148222b5896f4f7f575720b09e24af4c05936aa37342d26b6f7d6c0b502a44697944274b725facd1dd8a212142f92
- SSDEEP 49152:v8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5Qj:v8o8VOUs9joRbMc2tSW6j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\44919597229A9386AD8AB3EB7E688415E97C59E5
- Size 1KB
- SHA256 8fabaff28617f3f940070d3ab3a4a46617fe2c087681a3a2fab6f3cc017b283d
- MD5 02a0de0f25557c39d17ddf264077a77a
- SHA1 8bb5dc95bd74ba42e98d1f17f41095384df094d5
- SHA512 9b95ed2bf6bbd835e1cb5890c087fe26613073dbac971013867ab8a698b8d2838d8ef31c26cb864e8485a806af2b76025f748d823d5e706142ea9f39f24e0b7e
- MD5 SHA1 SHA512