Analysis
- user interaction
yes - max time kernel
1049s - max time network
1016s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 14:02
Behavioral task
behavioral1
Sample
meshagent64-Test.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target meshagent64-Test.exe
- Size 3.3MB
- Sample260925-rb7evaxfpc
- SHA256 99a7abad0f4e79fc9120f2ae250bb716d57e8b130c9f81f403cba0839aeed216
- MD5 87a2b0957bcc2cf4706213ad94ac0bec
- SHA1 736df824f4ec1b9b9c996fdbb7ef9cf2b599e41e
- SHA512 f3a2575641f0f88600909242f00ef7b09c55431c039228de3c68f6d98f8c1ccabda4c63534fd8dcd18fdf12e1d3f5af05cda06396a98faab53d921ef8c7a759f
- SSDEEP 49152:EMSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fT:xd9AddBcryO3cICgI9T
- TLSH T162F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
meshagent
Version
-
2
Botnet
-
Test
C2
-
http://mesh.jg06.co.uk:443/agent.ashx
Attributes
-
mesh_id
0xBCACAEAD1E358BB626ED64FDF4EA953400CC32F703DDDDAA2DA33E9AE05D662AF5F7EA37A3C3CC2A6638BF6A61C28B0E
-
server_id
D241BFC678764C9FEBD3AD2123403458CBF5BD98B68ACA8521259D5B81235AFCCA8EA237967B03E277680E5FB8224827
-
wss
wss://mesh.jg06.co.uk:443/agent.ashx
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral1/files/0x00080000000241f5-1.dat family_meshagent - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " meshagent64-Test.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation meshagent64-Test.exe - Executes dropped EXE 19 IoCs
pid Process 696 MeshAgent.exe 3828 MeshAgent.exe 4340 MeshAgent.exe 904 MeshAgent.exe 3380 MeshAgent.exe 4704 MeshAgent.exe 1092 MeshAgent.exe 4444 MeshAgent.exe 4536 MeshAgent.exe 3208 MeshAgent.exe 4220 MeshAgent.exe 5092 MeshAgent.exe 4368 MeshAgent.exe 4208 MeshAgent.exe 3592 MeshAgent.exe 1420 MeshAgent.exe 1120 MeshAgent.exe 3744 MeshAgent.exe 1980 MeshAgent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mesh Agent\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\shcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\combase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\crypt32.pdb MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\combase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\combase.pdb MeshAgent.exe -
pid Process 1264 powershell.exe 548 powershell.exe 2376 powershell.exe 3096 powershell.exe 2568 powershell.exe 2684 powershell.exe 1632 powershell.exe 1860 powershell.exe 2252 powershell.exe 2360 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MeshAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MeshAgent.exe - Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1860 powershell.exe 1860 powershell.exe 2252 powershell.exe 2252 powershell.exe 2252 powershell.exe 2360 powershell.exe 2360 powershell.exe 2360 powershell.exe 1264 powershell.exe 1264 powershell.exe 1264 powershell.exe 548 powershell.exe 548 powershell.exe 548 powershell.exe 2376 powershell.exe 2376 powershell.exe 2376 powershell.exe 3096 powershell.exe 3096 powershell.exe 2568 powershell.exe 2568 powershell.exe 2684 powershell.exe 2684 powershell.exe 1632 powershell.exe 1632 powershell.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1860 powershell.exe Token: SeDebugPrivilege 2252 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeDebugPrivilege 1264 powershell.exe Token: SeDebugPrivilege 548 powershell.exe Token: SeDebugPrivilege 2376 powershell.exe Token: SeDebugPrivilege 3096 powershell.exe Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeDebugPrivilege 1632 powershell.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 544 wrote to memory of 3012 544 meshagent64-Test.exe 93 PID 696 wrote to memory of 1860 696 MeshAgent.exe 100 PID 696 wrote to memory of 3828 696 MeshAgent.exe 104 PID 4340 wrote to memory of 2252 4340 MeshAgent.exe 109 PID 4340 wrote to memory of 904 4340 MeshAgent.exe 111 PID 3380 wrote to memory of 2360 3380 MeshAgent.exe 114 PID 3380 wrote to memory of 4704 3380 MeshAgent.exe 117 PID 1092 wrote to memory of 1264 1092 MeshAgent.exe 127 PID 1092 wrote to memory of 4444 1092 MeshAgent.exe 129 PID 4536 wrote to memory of 548 4536 MeshAgent.exe 132 PID 4536 wrote to memory of 3208 4536 MeshAgent.exe 134 PID 4220 wrote to memory of 2376 4220 MeshAgent.exe 137 PID 4220 wrote to memory of 5092 4220 MeshAgent.exe 139 PID 4368 wrote to memory of 3096 4368 MeshAgent.exe 142 PID 4368 wrote to memory of 4208 4368 MeshAgent.exe 146 PID 3592 wrote to memory of 2568 3592 MeshAgent.exe 149 PID 3592 wrote to memory of 1420 3592 MeshAgent.exe 151 PID 1120 wrote to memory of 2684 1120 MeshAgent.exe 154 PID 1120 wrote to memory of 3744 1120 MeshAgent.exe 156 PID 1980 wrote to memory of 1632 1980 MeshAgent.exe 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe"C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe"C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe" -fullinstall2⤵
- Sets service image path in registry
PID:3012
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3828
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:904
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4704
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4444
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3208
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5092
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4208
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1420
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3744
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 200KB
- SHA256 5c18013e93b9a9e5c55a643accfcef083c427d17e67b957632791d835dd5402f
- MD5 01a480b061ec6b08bf23a29637e6cf4d
- SHA1 69cd64c160d272d973dfe468e35acf983c873842
- SHA512 2766cfcde3db6a09dd2735bfd0d1e330a8bd1d6e46098d0ef6687065894c14dc393f150d1b1bbfa62381ab6313a84c8b63486ba067120c8129029724ef9072d1
- SSDEEP 3072:Yw9lmWs1dznYNa3IzsWSldE9nkn5GmCs8HEKl/mIsREtH40cGy82Z:D9lRCEY3IzVSA5kwmCfEv8YyG
- TLSH T1DA14F219EF7EB07E2FC523552C0B4931A7D80B389366494268EF0C29D2797D4CA3F566
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 200KB
- SHA256 df7d35a57e2ec49391862462f71ed7ccfa2ee471020977f314847bfb792e22ab
- MD5 705e22c62764efde301898b5a079935a
- SHA1 a4fd3e2edd8ddd46f0b4ce81c5218f46ec9ee3de
- SHA512 af2e4ee866f9090c772299873378075e5174f7873a3afc33e3ecfa205a7c2f29319fcbfc5fa2ba85d8292d7317b641bbe1cfa510c42fd90f4febe2ef89ef9ba7
- SSDEEP 3072:9Wmw9lj1dznYNa3IzsWSldE9nkn5GmCs8HEKl/mIsREtH40cGy82Z:0p9l/EY3IzVSA5kwmCfEv8YyG
- TLSH T11A14F219EF7EB07E2FC523552C0B4931A7D80B389366494268EF0C29D2797D4CA3F566
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.exe
- Size 3.3MB
- SHA256 99a7abad0f4e79fc9120f2ae250bb716d57e8b130c9f81f403cba0839aeed216
- MD5 87a2b0957bcc2cf4706213ad94ac0bec
- SHA1 736df824f4ec1b9b9c996fdbb7ef9cf2b599e41e
- SHA512 f3a2575641f0f88600909242f00ef7b09c55431c039228de3c68f6d98f8c1ccabda4c63534fd8dcd18fdf12e1d3f5af05cda06396a98faab53d921ef8c7a759f
- SSDEEP 49152:EMSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fT:xd9AddBcryO3cICgI9T
- TLSH T162F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 c0435bec3bc1ba393a38d1fb6f08bbfbd684cd42f053531c8402152d0092bc06
- MD5 c41ef85f190f37f834d3a2546614ce6f
- SHA1 eb4ab964fc1ed7d22c03ea7a9129b191f6034281
- SHA512 799d38540539ade300cda43ecbc3c6a72d85a18b9fed5e116c66ff85d9d25c906efe51ad753d95f43f1d67b3a69e1fc09302da72bf96b339b2d4ff0f8d7c9d1f
- TLSH T1B411AD4EFAA80D1FF122317E7EFD7F064166390004D09E2322DCC801898184F7D82A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 d62878656e66213758ad133d5431e3a30ed4dfb9845188b7fb907368adbf3f12
- MD5 48082fe19aa0af452e23b9233c652666
- SHA1 b34dc306e1f0ed9eda3feed90f1ca74484f46451
- SHA512 4443d4aee19e13107838fbcc882c4972bca112b54d562b91dac597ef589024b10327cd2a0971031800b74086e5a956e6ebd5cf0c504226a7a752868209067246
- TLSH T17921AD4EFAA80D2FF523717EBEF97F064166390004D09E2322DCC8018D8184F7D82A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 aa81e5fc8796075dc093cedfb68b6928b197379e31aa33587402c049834a962d
- MD5 d7e5ab94cfb90b286039953e59233c8c
- SHA1 c15ef554b8c202c74ca14bafeec59a25b3bf8033
- SHA512 53b5724c35e265b4d5f3b735aef6f59466e8eabd96575bb913768c002f8eaa9deef0c4247fe3715256562f20f492be6334bf2d1a65355e9210366a51443d22a1
- TLSH T139319C4EFAA80D2FF622717EBEF97F064166390005D09E2322DCC801898184F7D82A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 1KB
- SHA256 df5791db69c1de8ee6e230d929f95a92d87d7c5e5f388ab253cfdd3b878ef2d7
- MD5 a1f97063525cf09de376a45006893910
- SHA1 753135babe3fbeb900bdeeb2072e18cf2b224473
- SHA512 35415550994ff3355a963665b642c335ef69a303ca38720d7b05aca11a9af6077c197a63b3d65ccfde37b64d1fe9866c98277bfd4bc844b999e7f9ab8d5af9f3
- TLSH T149319E4DFA980D1FF626717E7EF97F064156390005D09E2322DCC401898184F7DC2A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 362B
- SHA256 357b29cc2d3d62b509881c49c371a0535b6e9bd9788a97cb8246baa840d0db21
- MD5 82f4ba3b098b5a195a0d884d5841270c
- SHA1 9026398045585afa0e5250346583aa83271902f2
- SHA512 41d9af8dcae748d181099c93a2b7ab16960599d21eaa7a30240b9c32d1ac6a340e2307efb88858390542825ab756e2b3f89fa3b3680884af971de6b5c3d266c0
- TLSH T199E0C04DFB980D1FF122307E7EFC6F024052350004D09E2322DCC4008D8184F7D82A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 543B
- SHA256 b8fd4cb8976fcc0d7033463e141d71d623449ebe7571763d6797ae5e2b6f438d
- MD5 b00da246982afc93fa247f8a938cbb64
- SHA1 799378dedee8103306502c9c8209bff4a10f02c0
- SHA512 0d65e27dd7eaf92f7d5e1ca95db3992bdf86696668bdd050a9870bad259d712edecc5a0770e1b813c6e196e3388968918e5f9498429134016388a34ef5e5a8db
- TLSH T1EDF08B4DFA980D1FF122317E7EFD6F024052350004D09E2322DCC400898184F7D82A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 724B
- SHA256 f5cf757c8d3e1bd00b847dea0547f28b64e37cbe886d5cf0f5decdbed361b357
- MD5 cd5b7861e44feafb1103f79e08530cc6
- SHA1 894dc4c3adcde0757104d879bff1c02bbdd7b124
- SHA512 657f73e98132d2e9cfdd87b794725c00dad9f54042f3bba1b314bd09c068d7a0c8af1c60802349ed507791ea43476d0737c05072ff4421106eb7f20d7aab3453
- TLSH T17E019C4DFAA80D1FF122317E7EFD6F024166350004D09E2322DCC400898184F7D82A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.log
- Size 905B
- SHA256 ab241798ec4f22694ffed2c7b00486067f747557fb86f53938366cd461a385d4
- MD5 fff771283d8880145cbf3992f367b59d
- SHA1 e318341e80675992eb6f7ff0024fa6848b2d6125
- SHA512 f0d4801378c904d4d8f1042ce997256d541e5639ce8084be63955869ef224e1222a16773eb2e9beb6a95a5e6c9243fad81bc747723479b7096fc8212dae1b0c5
- TLSH T1CE119C4DFAA80D1FF122317E7EFD7F024166390004D09E2322DCC400898184F7D82A6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.msh
- Size 35KB
- SHA256 13432f73b74247f817a5b31116fad9d38606ad9ed289c4894deaff2bc5a5959a
- MD5 5c9965b444e60f6a36dc0741ef09fa6d
- SHA1 7b43344b42d783823c87001ed9a06ab55a93be3e
- SHA512 af72dc2cd16a3ad8d06c5fc26aa99e2d6ec24b755f6faef4c692082fba1cf6ace366bcedc990f2cf26c6769b4d6204e4111e5c5e07b5659d794626d29d55d48e
- SSDEEP 384:TT8rCFryXKhhlW/zNc3XRJ3PoNSpyjSUzrnQCJwZVx9K6rvja3qj7ZiZFa3EB8PN:/aCVrh6/Zyo1zrQCJwR99BWFa3Em0Wth
- TLSH T1A4F2E61D8FADB03F2F8623952C0B4D317BE80B38935209516DEF481A427A79DD97F1A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_wxn0uwa1.bmt.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723
- MD5 06d16fea6ab505097d16fcaa32949d47
- SHA1 0c1c719831fa41cd102d0d72d61c0f46ec5b8de8
- SHA512 03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a
- TLSH T17961FF313275B1D4C9567F071A2819C053BF8396EA94AF5CB25C621EDD2641BDF122F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 d104d242cffc8a3c779d32b795db8c4e2dd9e59beb57cd3706c7428e4a3b5bb3
- MD5 67a8e43869ca532187b01500505ff10f
- SHA1 de6b1655ca2a912e748094b9bc3380056517dac8
- SHA512 530cfaba68dd28f659149f60a24919726f957e8c6225b6e5f76d0b8bc6f326ed475304f20461a2f5bc83a9de7fe893160ac9a082ad3ea48b2f268925159c9f27
- TLSH T186510127B3C45B63D94A1137809C881170D6A2439266BFCB3F8FC6D0A21FEB5BB71615
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 2f2d3847339c77762b1dafab957022a07665a510de03f997124c462ad3221de9
- MD5 f2e211a81fb3f915cfed5fe5098989e7
- SHA1 0ecc0cf8b44d33bc5cb7889ec4fc99cbdf91b814
- SHA512 92738e67215632366c9f4909ee8bd70c0dccd56cdcea6d4b122b54e9426e2aae778ea0b8f31f310a847e30a0a93afbe470ecfdb5bf04135b4edc4d1575fa1e3f
- TLSH T12E510E27F3C46BA3D44B1137449C4822B196D2439356BFCA3A8DC790F25FEB5ABB1A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 c9fe763b7e365d2f25c545aae16280de0dd5d319fee257d1af10b4a73f1f4ddb
- MD5 23c1c336be8c80eba166624ad7936bea
- SHA1 cb28debd8121842509efbb94fa3546a122437faa
- SHA512 9c4fd5955c459fc4c6ded4121027613debd071a49e092d1e68d6d9462673e04bb92dbb012248d7a52c4472ac4375a234ea504e41f205e4c358d41846bc981f43
- TLSH T160510027B3C45BA3D94A5537809C881270D5E1434366BFCB3B8EC790A21FEB5BBB1651
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 8bbc106fa229f791f9ed86892b5154e61fef569b253aa2ae648960fbb6fda351
- MD5 d6e80d3511a714f0bb39094f149ebf3b
- SHA1 adab81bbe08772180e8f49ad692641f20d1f9e20
- SHA512 1657fd5988386f59abd4c546238caf775c35b10e1a8b0acd922531263048ea67601b6a52e543e183de622b94ad6803ce51c63adc1ed65e73a4352817cde62c0f
- TLSH T1F1512117B3C45B63D94E5136809C481230E6E2434266ABCB3F8FC6A0B21FEB5FB71611
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 d332d5def64968cea7c87decb3e8bc36993d2a27a32f387dbcba849335238350
- MD5 7dfb541c03425e25d734f7abfe5985ca
- SHA1 6884c950facb7ae84b1a19dd6e5c8901dd7f97f2
- SHA512 164788c1c7e4fb1fd8b34748c151c754aa2835bcd77a079002380a99c95b076a08af53ae6aaa0546a4b53d3b0127c7df887fc4de4cf3baad6f8d747c6bd2ece7
- TLSH T19551F117F3C45B63D949113A809C481270D6D1438166AFCB3F8FC6A0B15FDB6BB71615
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 9ac5b90362dde0539c99598febe79bf9dc0b6fc5ebf5a07a1915d4fd076c1c07
- MD5 4016fcab900f86a2af0f4cef096c26d4
- SHA1 c7994da63e991e59700249a5169742855df7276e
- SHA512 db585f8ec1785f83c0670d39cdcc74daec01a47c3aff72705a1b72d10c29e55d3acc3711bff8e0fdac27261654587877ddb733d036b7b967a0ad25457a8aaf38
- TLSH T1EC511217B3C856D3E98D553EC09C981530D692878066BFCA6F8FC5E0A26F1B7FA30161
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 7281356c168160d75e78682d6c0acaf5af44d69992b2c1ea14e2e30845631d39
- MD5 c2f6e1e310536580149b74d3bc580b55
- SHA1 9d2dad3f2bd30891a29cea48a8aee05f06ffaa17
- SHA512 3b5759ee089827509809cd6dcf98ae6d1bb4e152a6b6733a35aac0f4697e3d6a3550c459cc8d79302b8879e945f48225852d2cad39fdde60812e7f4f87fbdf79
- TLSH T1CA510E27F3C45B63D84B1037449C48127196E2439356BB8A3A8DC790F25FEB5BBB0A01
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 8c51f814fa11a79dc5095bdc704ee2211dc66d5e7c587197589918f2ef0a94ff
- MD5 7cc24364eb647460897ba0b7b96ff9ea
- SHA1 5c63a43eb95574ca7b508ffca2492f42e6b22552
- SHA512 ccd27154cc4cd2daa795d03a265eb1b9980af3b9d9bbd191c698a9549051998125577955104f53cdef46550b5b28c1f4ae06931bc80f9b7cf0c9185c807719ff
- TLSH T1EE510027F3C45B63D44A113B889C48117196E2438257BFCA3A8DC790E65FEB5BBB1A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 49deb9057be77326e98dbb19f8977fa016c106c32cc4fa651eae1c745dc2625d
- MD5 4f514a2693fe06b2ac7745959f4c73f8
- SHA1 ce7affcc97678e2384859665d635528be0703ff5
- SHA512 a341ceeb6633234a3ceca2be3d55413115d7bdf14287a211c74a91b6e2983b5347a3f12d3183fbc5e7025bb190c15789c8702c66eab40c56f50435a6e5266fed
- TLSH T1C2511017F3C45BA3D94E113A849C481271E6E2434166BBCB2B8FC690E25FEB5BBB1650
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\CB64611E48BBAC211CDAFCD8CC4CE0D53507EE06
- Size 1KB
- SHA256 cea2cb7f695b24fc583264ce8f753fba00883993ff2134cdf031a4793968beaa
- MD5 404c34fd9c9ba7c39de8453a2c2124a3
- SHA1 5a045a57f8e6ac5ffd7281f9805f59867fad88c4
- SHA512 e9e232a4622ede9aeb1d41dd240210ada54ea32cb6953e8e0da10f5d4f10b07c6dfbc422f32587cfee8cbd257d52be91e13d8ffc53bcfb71d95c5dfbac356500
- TLSH T1B52157047BF49DBFF86159773229056D5573B5E04766C10F5517038C0D1BA61EB2A31F
- MD5 SHA1 SHA512 TLSH