1/ While analyzing AutoRuns entries in a Compromise Assessment, my teammate
@newtt42
found four executables with different names but with the same hash (in the C:\Windows directory).
The binaries were ran as services with the following names: JXds, vdEp, JXmM, PTLt. 🧵