Analysis

  • max time kernel
    130s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/07/2026, 11:37

General

  • Target
    2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
  • Size 5.0MB
  • Sample260712-nrkz1aay91
  • SHA256 6334880a5798f518a0b2b5b8aa91d508e09dd923f8e33111d72e81338ac789a2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • supershell

C2
  • 2.11.03.11.93.14.532 bit39062564 bit<-chanAacuteAcceptAckAllActiveAgraveAnswerApiURLArabicAtildeAugustAuthorBasic BearerBinaryBitBltBrahmiBypassCANCELCDATA[CLOSEDCarianCcedilChakmaClosedCommonCookieCopticCreateCustomDELETEDaggerEEPROMEacuteEgraveEndDocExpectFEPROMFormatFridayGOAWAYGetACPGetAceGothicHangulHatranHebrewHiddenHyphenIacuteIgraveIsMenuKaithiKhojkiLISTENLPDDR2LPDDR3LPDDR4LambdaLengthLepchaLineToLockedLycianLydianManualMondayMulDivNtildeOacuteOgraveOslashOtildePADDEDPING PONG PatBltPragmaREG_SZRejangSCHED STREETSTRINGSYSTEMScaronSearchServerSourceStatusStringSundaySymbolSyriacSystemTai_LeTangutTargetTeluguThaanaTmpDirTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11UacuteUgraveUserIdWARN: WINDIRWanchoWeeklyWeightX25519YacuteYezidi[%d]%s[]byte\u%04X\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u000b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f\u0022\u0026\u0027\u002b\u003c\u003e\u0060\u2028\u2029\ufffd _amd64aacuteacceptactionactiveagravearray*atildeavx512binaryborderbrvbarbuild bytes*ccedilcentoschan<-closedcmd_idconptycookiecoordscurrendaggerdebiandefinedeletedividedomaineacuteefenceegraveempty env.nuexec: existsexpectfedoraforallfrac12frac14frac34go %s goarchgopherhangupheaderheartsheighthelliphiddeniacuteigraveimportinternip+netiquestkMGTPEkilledlambdalfloorlistenlowastlsaquomailtomethodmiddotminutemonthsnats: natswsnetdnsnomeshntildenu.exenumbernutempoacuteobjectograveoriginoslashotildeotimesoutputpausedpermilplusmnpopcntposterprintfpythonquery:rdrandrdseedrdtscpreadatredhatremoverenamereturnrfloorrsaquorune1 scaronscopedscriptsecondselectsendtoserversigmafsilentsimplesocketsocks socks5spadessrcdocsrcsetstate(statusstdoutstringstructsweep switchsysmontargettelnetthere4thinsptimerstmpdirtypeofuacuteubuntuugraveuint16uint32uint64unusedusemapvaluesweierpwinptyx86_64xmlns:yacute{ARCH} %v=%v, (conn) (scan (scan) MB in Value> action allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= using zombie% CPU (%s %s; %s://%s%v days%v hour%v week%v year%v: %#x, goid=, j0 = , type=--force-nodeid/LOG=%s19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625: type ::ffff::method:scheme:status= "`API URLAckNoneActionsAgentIDAgentPKAvestanBaseURLBengaliBrailleCLOSINGCOMMENTCONNECTChanDirClassIdConnectContactContextConvertCopySidCreatedCypriotDEBUG: DeseretERROR: Ed25519ElbasanEllipseElymaicEnabledEndMenuEndPageEpsilonExpiresFATAL: FreeSidGNUStepGODEBUGGetMenuGetTaskGranthaGroupIdHEADERSHanunooILLEGALIM UsedIO waitInstAltInstNopInstallJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMaskBltMeshDirMonthlyMultaniMyanmarNewTaskOctoberOmicronOsmanyaPATHEXTPolygonRadicalRefererSELECT SHA-224SHA-256SHA-384SHA-512SUCCESSServiceSetMenuSetRectSharadaShavianSiddhamSinhalaSite IDSleepExSogdianSoyomboSubjectSwapperTagalogTask PKTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpdatesUpgradeUpsilonUsage: VersionWARNINGWSARecvWSASend[INFO] "`'/<-#\\.\UNC\ ) types value=_structabortedalefsymallocmRallocmWalt -> amxbf16amxint8amxtileanswersany -> archiveavx512fbdoUxXvbooleanbucket(charsetcheckedchunkedclassidclosurecmd.execolspancommandcomplexconnectconsolecontentcpuprofdefaultderiveddirnameenctypeepsilonexpiresfailingfields.finallyfloat32float64forcegcgctracehead = headershttp://installinstantintegerinvalidkeytypelognamelookup manjaromeshdirminpc= minutesmpr.dllmsgpacknil keynop -> number nushellomicronoperandoptimumosxsavepacer: packagepanic: passingpatternpdh.dllpreloadprintlnprofilepubdatereaddirrefererrefreshrestartresultsrowspanrunningsandboxsecondsserial:signal site-idspecialsrclangstoppedstring*subkeyssuccesssyscalltimeouttraileruintptrunknownupgradeupsilonversionwaitingwindowswsarecvwsasend{{end}} bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status xmlns="%!Month(%.10q...%.1f %cB%02d%02d%25s: %s%s %s:%d%s /C %s%s&#x%x;%s: %s %s;%s;%s%v hours%v month%v weeks%v years&#xfffd;--config012345672.5.4.102.5.4.112.5.4.172006010248828125AbortDocAcceptExAcceptedAngleArcArmenianBAD RANKBalineseBopomofoBugineseCLICOLORCancelIoCherokeeClassANYComputerConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDisabledDownloadDrainingDrawIconDuployanDurationDwmFlushEndPaintEqualSidEthiopicExtenderFebruaryFillRectFullPathGeorgianGetFocusGetTasksGoStringGujaratiGurmukhiHOMEPATHHTTP/1.1HTTP/2.0HelpLinkHiraganaIdentityInsecureInstFailInstRuneIntervalIsWindowJavaneseKatakanaKayah_LiLAST_ACKLinear_ALinear_BLocationMD5+SHA1MD5-sessMahajaniMoveToExNO_ERRORNO_PROXYNode id:NovemberOl_ChikiOpenStepPRIORITYParseIntPasswordPhags_PaPolylinePriorityPtInRectQuestionReadFileReceivedResetDCWRunLevelSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SYN_SENTSameSiteSaturdaySetEventSetFocusSetTimerSettingsSystem32TagbanwaTai_ThamTai_VietTextOutWThursdayTifinaghToken %sTriggersTypeAAAATypeAXFRUgariticUpdateIDWSAIoctlZgotmplZ[::1]:53[:word:][ERROR] [signal "%s" %s 

 --%s stack=[_NewEnum_gatewayaddress agent_idantergosautoplayavx512bwavx512cdavx512dqavx512eravx512pfavx512vlbad instbeEfFgGvcgocheckcodebasecomp_syscompresscontinuecontrolscs curl -X datetimedeadlockdeno.exedenotempdisableddnsquerydropzonedurationencodingexecwaitexplicitexporterfile+netfinishedfont/otffont/ttffs graphicsgs has_morehijackedhostnamehreflanghttp/1.1if-matchif-rangeinfinityinsecureinvalid ip4:icmpis-*.tmplanguagelinkpathlocationlongdescloopbacklstrcpyWlstrlenWmanifestmultiplenats: %snatsportnew_namenew_pathno anodeno-cacheno_proxynssm.exeold_nameold_patholeaut32opensuseoriginalpanic %vpath %s photurispollDescpy38-x32py38-x64r10 r11 r12 r13 r14 r15 r8 r9 raspbianrax rbp rbx rcx rdi readfromreadonlyrecvfromredirectrequiredreversedrflags rip rsi rsp runnablescavengeseamlessselectedshutdownsockaddrsoftwarestrconv.syncmeshtabindextemplatetextareathetasymtraceBuftrigger=unixgramunknown(updtCnt:urlquerywsaioctlx509sha1{{else}} (forced) -> node= B exp.) B work ( as type blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ of type runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=#ZgotmplZ%s %q: %s%s %x %x %v minute%v months%v second(unknown), newval=, oldval=, size = , tail = 01234567_0x%X (%d)1 error: 244140625: status=AUOptionsAgent ID:Agent PK:ArgumentsAuthorityAutomaticBase URL:Bassa_VahBhaiksukiBigEndianCONNECTEDCheckInSWClassINETClient IDCreateDCWCreateICWCreatePenCuneiformDiacriticDrawTextWEndDialogEqualRectEvery dayExecQueryFindCloseForbiddenGetDIBitsGetFolderGetWindowHOMEDRIVEHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLoadIconWLoadMenuWLocalFreeLogonTypeMalayalamMongolianMoveFileWNabataeanNot FoundOnFailurePalmyreneParseBoolParseUintPrincipalPublisherPurgeCommREG_DWORDREG_QWORDRPC debugRectangleReleaseDCReleaseIdRemoveAllRun Task:SamaritanSee OtherSendInputSeptemberSetBkModeSetCursorSetupCommStartDocWStartPageStartTypeSundaneseSyncMesh:TIME_WAITTimestampToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWakeToRunWednesdayWinTmpDirWriteFile[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundagent-wmiagent.logalmalinuxatomicor8autofocusautomaticbad indirbad prunebroadcastbus errorchallengechan sendchoco.execlient-idcomplex64config.nuconnectexconpty-incopystackcpu-totalctxt != 0d.nx != 0dns,filesdraggabledxva2.dllelement <empty urlexit_codefiles,dnsfont/wofffork/execfuncargs(gdi32.dllgetCallerhchanLeafimage/bmpimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplinuxmintlocalhostmSpanDeadmap[%s]%smaxlengthmeshagentmkdirtempmulticastnil errornil tracentdll.dllole32.dllomitemptyopeneulerpage_sizepanicwaitpclmulqdqpreemptedprofBlockprotocol psapi.dllquestionsrecover: reflect: runchecksrwxrwxrwxscavtracestackpoolstartTypesucceededtimestamptracebackundefinedunderflowunhandleduninstallurn:uuid:video/avivideo/mp4wbufSpanswebsocketwinmm.dllwsasendto{VERSION}{{break}}} stack=[ netGo = MB goal, but have flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!Weekday(%s|%s%s|%s%v minutes%v seconds, bound = , limit = -NoProfile.localhost.terminal./dev/stdin/etc/hosts/r /t 5 /f012345678912207031256103515625: parsing :authority<no value>AcceptEulaAdditionalAll monthsAlphaBlendBad varintBeginPaintCLOSE_WAITCONNECTINGCache DRAMCancelIoExCategoriesCategoryIDCheckInWMIChorasmianClassCHAOSClassCSNETCombineRgnConnectionContent-IdCreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DaysOfWeekDefinitionDeleteMenuDeleteTaskDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMEnable RDPEvery weekException FIN_WAIT_1FIN_WAIT_2GC forced GOMAXPROCSGOMEMLIMITGetDlgItemGetFoldersGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHKEY_USERSHTTP_PROXYHost: %s IP addressIgnore NewInstalled:IsValidSidKeep-AliveKharoshthiLoadImageWLocalAllocLockFileExManichaeanMesh AgentMessage-IdMoveWindowNATS/1.0 NetUserAddNetUserDelNo ContentOffsetRectOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianPingCheck:PlaySoundWPolyBezierProcessingPulseEventREG_BINARYRIPEMD-160RST_STREAMRemoveMenuRepetitionResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSend EmailSet-CookieSetBkColorSetCaptureShcore.dllShowCursorShowWindowStatus: %sStretchBltSupportURLSynch DRAMUNKNOWN_%dUser-AgentWSACleanupWSASocketWWSAStartupWindows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:] --%s-- _reserved1agent-typearg %d: %watomicand8audio/aiffaudio/midiaudio/mpegaudio/waveavx512bf16avx512gfniavx512ifmaavx512vaesavx512vbmiavx512vnnibackgroundbase_boardcomplex128connectionconpty-outcreatetempdebug calldefinitiondnsapi.dlldwmapi.dllecho replyexecerrdotexitThreadexp masterfloat32nanfloat64nanfont/woff2formactionformmethodformtargetgetsockoptgoroutine http-equivhttp_proxyimage/avifimage/jpegimage/webpimpossibleinstanceofinvalid IPinvalidptrkeep-alivelocal-meshmSpanInUsemediagroupmesh agentmeshnodeidnil headernot a boolnotifyListnovalidateowner diedpowershellprofInsertpython.exeradiogroupres binderres masterresumptionrune <nil>runtime: gs.state = schedtracescientificsemacquiresession_idset-cookiesetsockoptskipping: socks bindspellcheckstackLarget.Kind == terminatedtracefree(tracegc() unins*.exeunixpacketunknown pcuser-agentuser32.dllvideo/webmwinagent-vwinpty.dllws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%d errors: %d.%d.%d.%d%s %s %s ) at entry+, elemsize=, npages = , settings:--no-prompt.WithCancel.cmdoutput./VERYSILENT/dev/stderr/dev/stdout/index.html0123456789_0x%08X (%d)30517578125: frame.sp=> in space AckExplicitAppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestCOM HandlerClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDaysOfMonthDefDlgProcWDeleteFileWDescriptionDestroyIconDestroyMenuDisplayNameDives_AkuruDownloaded:DrawMenuBarENABLE_PUSHEND_HEADERSESTABLISHEDEarly HintsEnable pingEndBoundaryEnumWindowsEnvironmentExitProcessFileVersionFindWindowWFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTimeGetFileTypeGetIfEntry2GetKeyStateGetMenuInfoGetMessageWGetSysColorGetWindowDCGlobalAllocHTTPS_PROXYIdeographicIn-Reply-ToInflateRectInsertMenuWInstCaptureInstRuneAnyInstallDateInteractiveIsInstalledIsRectEmptyLastRunTimeLoadCursorWMachineGuidMarshalJSONMarshalTextMedefaidrinMesh Agent:Mesh agent:MessageBeepMessageBoxWModifyMenuWMoveFileExWNATS error:NandinagariNetShareAddNetShareDelNetUserEnumNew_Tai_LueNextRunTimeOld_PersianOld_SogdianOpenProcessPROGRAMDATAPatchMgmnt:Pau_Cin_HauPrintWindowProductNameRandomDelayRegCloseKeyReturn-PathSHA-512-256SHA-512/224SHA-512/256SYSTEMROOT=Sending WMISetCommMaskSetFileTimeSetMenuInfoSignWritingSoft_DottedStateChangeSwapBuffersSystemDriveTTL expiredTacticalRMMToUnicodeExUSERPROFILEUserenv.dllVariantInitVirtualFreeVirtualLockWARN RESTY WSARecvFromWaitMessageWaitTimeoutWarang_CitiWhite_Space[:^xdigit:]\device\mup_eval_args_additionalsagent-disksagent-helloalarm clockassistQueueauthoritiesavx512vbmi2avx512vnniwbad addressbad argSizebad m valuebad messagebad timedivbad verb '%broken pipecall of nilcgocall nilcheckrunnerclobberfreeclosesocketcombase.dllcontextmenucreated by crossorigincrypt32.dlldescriptionempty fieldexpected :=fallthroughfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3formenctypegccheckmarkgdiplus.dllgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=msimg32.dllmswsock.dllnetpollInitnil Contextnil contextnot definedoraclelinuxparse errorplaceholderraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writestack tracetacticalrmmtls: alert(tls://%s:%stracealloc(traffic updunreachableunsupporteduserenv.dllversion.dllwinagent-v*winpty_freewinpty_openwsarecvfromwss://%s:%s (sensitive) = struct { B (∆goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%02d-%d-%02d) p->status=, cons/mark --env-config-byte limit -fullinstall100-continue127.0.0.1:53152587890625762939453125> but have <Agent token:BODY : %v Bidi_ControlCIDR addressCONNECT %s CONTINUATIONCfgMgr32.dllCheckInDisksCheckInHelloCheckInPubIPCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateBitmapCreateCursorCreateEventWCreateFolderCreateMutexWCurrentBuildCustomSourceDDR2 FB-DIMMDEBUG RESTY DISCONNECTEDDaysIntervalDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ERROR RESTY EnableWindowEulaAcceptedExtCreatePenExtractIconWFindNextFileGetAddrInfoWGetCommStateGetConsoleCPGetCursorPosGetDlgCtrlIDGetLastErrorGetLengthSidGetMenuStateGetProcessIdGetStdHandleGetTempPathWGetTopWindowGlobalUnlockHEADERS: %s HOST : %s I'm a teapotIdleDurationIdleSettingsInstAltMatchIsDownloadedJoin_ControlKBArticleIDsLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMesh Node IDMime-VersionMissing pathMonthsOfYearMoreInfoURLsMsrcSeverityMulti-StatusNeedsReboot:Netapi32.dllNot ExtendedNot ModifiedNtCreateFileOpen ServiceOpenServiceWPROGRAMFILESPUSH_PROMISEPahawh_HmongPdhOpenQueryPeekMessageWPostMessageWProgramFilesPublicIP errRCodeRefusedRCodeSuccessRECONNECTINGREG_MULTI_SZReadConsoleWRedrawWindowRegGetValueWReleaseMutexReportEventWRestartCountResumeThreadRevertToSelfRoInitializeRun ParallelRunning taskSERIALNUMBERSHA-256-sessSYN_RECEIVEDSameSite=LaxScrollWindowSelectObjectSendMessageWSession LockSetCommBreakSetCommStateSetConsoleCPSetCursorPosSetEndOfFileSetErrorModeSetLocalTimeSetRectEmptySetStdHandleSetTextColorSetWindowPosSetupAPI.dllShow MessageSlowConsumerSora_SompengSubscriptionSubtractRectSyloti_NagriSysStringLenTactical RMMTacticalRMM_Thread32NextTransmitFileUnauthorizedUnlockFileExUpdateWindowUsing proxy:ValidateRectValueQueriesVariantClearVersionMajorVersionMinorVirtualAllocVirtualQueryWeeksOfMonthX-ImforwardsX-Powered-Byabi mismatchadvapi32.dllagent-winsvcaltmatch -> anynotnl -> autocompleteavx5124fmapsavx512bitalgbad flushGenbad g statusbad g0 stackbad recoveryblock clausebuild %s=%s c ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycomctl32.dllcomdlg32.dllcontent-typecontext.TODOdumping heapecho requestend tracegc entersyscallexit status gcBitsArenasgcpacertracegetaddrinfowharddecommithost is downhttp2debug=1http2debug=2illegal seekimage/x-iconinvalid baseinvalid bodyinvalid kindinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneedmax-forwardsmesh_node_idmheapSpecialmissing pathmspanSpecialnetapi32.dllno extensionno such hostnot pollablenssm-x86.exentoskrnl.exeoleaut32.dllopengl32.dllout of rangepointtopointproxyconnectrandautoseedrecv_goaway_reflect.Copyregistrationreleasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptservices.exesetupapi.dllshort buffershutdown.exespanSetSpinestop_pendingstring|bytessweepWaiterstacticalrmm*traceStringstransmitfileunexpected )unins000.exeunknown portunknown typewinpty_bins/winpty_spawnwintrust.dllwirep: p->m=worker mode wtsapi32.dll{{continue}} != sweepgen (default %q) (default %v) MB globals, MB) workers= [%dm%s= called from closed by </ flushedWork idlethreads= in duration in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s://%s:%d/%s, gp->status=, not pointer--WebProxy=%s--no-progress-byte block (3814697265625: unknown pc <unsupported>AUDIT_FAILUREAUDIT_SUCCESSAccept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCPU Load Avg:Cache-ControlCertOpenStoreCheckInWinSvcCheckMenuItemCloseEventLogCoTaskMemFreeCompatibilityConnectServerContent-RangeCreateActCtxWCreateRectRgnCreateWindowWDRAINING_PUBSDRAINING_SUBSDeleteServiceDestroyCursorDestroyWindowDocumentationECDSAWithSHA1EnumProcessesEstimatedSizeExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWForcing ipv4:FreeAddrInfoWGC sweep waitGetClassLongWGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetIfEntry2ExGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowInfoGetWindowRectGo CPU Check:Gunjala_GondiIIDFromStringIf-None-MatchImageList_AddInstallSourceIntersectRectInvalid monthLast-ModifiedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiMeshAgent.exeModule32NextWNatsProxyPathNatsProxyPortNot InstalledOld_HungarianOpenClipboardOpenEventLogWPKCS1WithSHA1PdhCloseQueryREG_EXPAND_SZRPC RunChecksReadEventLogWRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReset ContentRestartOnIdleRtlCopyMemoryRtlGetVersionRtlInitStringRtlMoveMemoryRunOnlyIfIdleSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSafeArrayCopySafeArrayLockSelectClipRgnSetBrushOrgExSetClassLongWSetDCPenColorSetSystemTimeShellExecuteWStartBoundaryStartServiceWStop ExistingStopOnIdleEndStringFromIIDSysFreeStringTacticalAgentThe log levelThread32FirstUNSUB %d %s Unknown ErrorUpdateID='%s'Usage of %s: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWaitCommEventWeeksIntervalWriteConsoleW[FrameHeader accept-rangesaccess deniedauthorizationbad flushGen bad map stateby_start_timecache-controlcomp_sys_prodcontent-rangedalTLDpSugct?define clausedouble unlockemail addressempty commandempty integerexchange fullexecRInternalfatal error: getTypeInfo: gethostbynamegetservbynamegzip, deflateif-none-matchimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base ip6:ipv6-icmplame referrallast-modifiedlevel 3 resetload64 failedmeshagent.exemin too largenats: timeoutnil stackbaseno name spacenot a Float32not availableout of memoryparsing time pause_pendingprofMemActiveprofMemFutureruntime: seq=runtime: val=socks connectsrmount errorstart_pendingtestRInternaltime exceededtimeEndPeriodtimer expiredtlsmaxrsasizetraceStackTabtrmm/%s/%s/%sunexpected %sunimplementedunknown type unsupported: updaterunninguser canceledvalue method wglShareListsxadd64 failedxchg64 failed} sched={pc: /* %s */null needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args %v, Attempt %v-fulluninstall-thread limit .WithDeadline(/api/v3/choco/1907348632812595367431640625: extra text: <not Stringer>> closed by </Accept-CharsetActivateActCtxAgentStartup()CLICOLOR_FORCECallNextHookExCertCloseStoreClearCommBreakClearCommErrorClientToScreenCloseClipboardCoInitializeExCoUninitializeComputerNameExContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomCurrentVersionDefWindowProcWDisplayVersionDkim-SignatureDragQueryFileWDragQueryPointDuplicateTokenDwmEnableMMCSSDwmShowContactERR_UNKNOWN_%dEmptyClipboardEnableMenuItemEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGdiplusStartupGetConsoleModeGetMenuBarInfoGetMenuStringWGetMessageTimeGetPixelFormatGetProcAddressGetShellWindowGetStockObjectGetSystemTimesGetTickCount64GetUserNameExWGetWindowLongWGetWindowTextWHiliteMenuItemINTERNAL_ERRORInstEmptyWidthInvalid ActionInvalidateRectIsWellKnownSidIsWow64ProcessLastTaskResultLoadLibraryExWMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMapVirtualKeyWModule32FirstWNetUserGetInfoNetUserSetInfoNot AcceptableOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxPrints versionProcess32NextWPublicIP startQuotation_MarkRCodeNameErrorREFUSED_STREAMREQUEST_METHODReboot needed:RegDeleteTreeWRegSetValueExWReleaseCaptureRemote ConnectResourceHeaderRevisionNumberRunPythonCode:Running checksSUB %s %s %d ScreenToClientSession UnlockSetConsoleModeSetFilePointerSetPixelFormatSetThreadTokenSetWindowLongWSetWindowTextWSizeofResourceSleeping for 5SysAllocStringTrackPopupMenuTranslateNameWTypesSupportedVerQueryValueWVirtualProtectVirtualQueryEx[^\w@%+=:,./-]\.+*?()|[]{}^$ Error %d: %s accept-charsetagent-publicipallocfreetracebad allocCountbad record MACbad restart PCbad span statecontent-lengthdata truncatedfile too largefinalizer waitformnovalidategcstoptheworldgetprotobynameinternal errorinvalid optioninvalid pid %vinvalid semverinvalid syntaxis a directorykey size wronglen of type %slevel 2 haltedlevel 3 haltedmultipartfilesneed more datanetwork_confignil elem type!no module datano such devicepacket too bigpowershell.exeprotocol errorread_frame_eofreflect.Selectruntime: full=runtime: want=s.allocCount= script_resultssemaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown methodunknown mode: unknown node: unknown statusunreachable: unsafe.PointeruserArenaStatewglMakeCurrentwinapi error #work.full != 0zero parameter with GC prog (no semicolon) is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-NonInteractive0601021504Z0700476837158203125: cannot parse : no frame (sp=<invalid DWORD><invalid QWORD><invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWCheckInSyncMeshClientAuthType(Console ConnectCreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDeviceIoControlDialogBoxParamWDragAcceptFilesDuplicateHandleEnabling RDP...Every other dayFailed to find Failed to load FindNextStreamWFindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveObjectGetActiveWindowGetAdaptersInfoGetClassInfoExWGetCommTimeoutsGetCommandLineWGetEnhMetaFileWGetMenuItemRectGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWHEADERS : Hanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWInstallLocationIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredMonitorFromRectNTSTATUS 0x%08xNetGetAnyDCNameNetworkSettingsNot ImplementedNot InitializedNtResumeProcessOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPlayEnhMetaFilePostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWQueue InstancesRecovering meshRegCreateKeyExWRegDeleteValueWRequest TimeoutRestartIntervalRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSameSite=StrictSetCommTimeoutsSetDCBrushColorSetSecurityInfoSetVolumeLabelWShowWindowAsyncStatus: runningStringFromCLSIDStringFromGUID2SwapMouseButtonTactical Agent:The mode to runUninstallStringUnmapViewOfFileWhere to log toX-Forwarded-For] morebuf={pc:accept-encodingaccept-languageadvertise erroragent-agentinfoallocmRInternalapplication/oggapplication/pdfapplication/zipasyncpreemptoffavx512vpopcntdqbad certificatebad trailer keycontenteditabledesktop_monitordouble scavengeelem size wrongfmipv6 messagesfont/collectionforce gc (idle)invalid addressinvalid argSizeinvalid booleaninvalid pointerjstmpllitinterpkey has expiredkilling processmalloc deadlockmisaligned maskmissing addressmissing mcache?monitoring_typems: gomaxprocs=negative offsetnetwork is downnetwork_adapterno dot in fieldno medium foundno such processnon-minimal tagnot implementedpreempt SPWRITErecord overflowrecovery failedrecv_rststream_reflectlite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktacticalagent-vtacticalrmm.exetarinsecurepathtemplate clausetimeBeginPeriodtimestamp replytraceback stuckunclosed actionunexpected typeunknown Go typeunknown networkunknown versionunknown/invalidwindows-servicewinpty_set_sizewrite error: %wx-forwarded-forzipinsecurepath already; errno= mheap.sweepgen= not in ranges: untyped locals %s %s HTTP/1.1 ()<>@,;:\"/[]?= , not a function--no-config-file-ExecutionPolicy.WithValue(type /api/v3/checkin//etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625: value of type > in name space AdjustWindowRectAllowDemandStartAlready ReportedCheckInAgentInfoCheckInLimitDataCloseEnhMetaFileCoCreateInstanceConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateJobObjectWCreateNamedPipeWCreateSolidBrushCryptProtectDataCryptQueryObjectDefineDosDeviceWDelayedAutoStartDispatchMessageWDnsNameCompare_WDuplicateTokenExDwmDefWindowProcDwmRenderGestureDwmTetherContactEnabling ping...EnumChildWindowsEventMessageFileEvery other weekFRAME_SIZE_ERRORFile Not Found: FindFirstStreamWFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdipDisposeImageGetAsyncKeyStateGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleWindowGetCurrentActCtxGetCurrentThreadGetDesktopWindowGetFullPathNameWGetGUIThreadInfoGetKeyboardStateGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetModuleHandleWGetNamedPipeInfoGetOpenFileNameWGetPriorityClassGetSaveFileNameWGetSysColorBrushGetSystemMetricsHiberbootEnabledImageList_CreateImageList_RemoveImperial_AramaicInstRuneAnyNotNLIsDialogMessageWMapVirtualKeyExWMeroitic_CursiveMissing new_nameMissing old_nameMonitorFromPointMultiple ChoicesNATS reconnectedNatsPingIntervalNatsStandardPortNetApiBufferFreeNetLocalGroupAddNetLocalGroupDelNtSuspendProcessOpenProcessTokenOther_AlphabeticPayment RequiredProxy-ConnectionRCodeFormatErrorRead after CloseRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRegistrationInfoRemoveDirectoryWRtlGetCurrentPebSETTINGS_TIMEOUTSHA-512-256-sessSafeArrayDestroySeDebugPrivilegeSetClassLongPtrWSetClipboardDataSetDllDirectoryWSetEntriesInAclWSetFilePointerExSetFileValidDataSetMenuItemInfoWSetPriorityClassSetServiceStatusSignatureScheme(System32\cmd.exeTactical RMM v%sTerminateProcessTrackPopupMenuExTranslateMessageUnregisterClassWUpgrade RequiredUse a http proxyUser-Agent: %s VirtualProtectExWWW-AuthenticateWinVerifyTrustExWorkingDirectoryWww-AuthenticateZanabazar_Square runtime stack:

Extracted

Family
  • meshagent

Version
  • 2

Botnet
  • TacticalRMM

C2
  • http://mastiffsystemsmesh.mytrmm.com:443/agent.ashx

Attributes
  • mesh_id

    0x841F73B273680CE972E11DE4D9D860D4133570D0EF3A311AF0D1771A0BBA5B35A9BF1E3D443531CDC25CC082246639BE

  • server_id

    4A595DA5DCFB8F4667B26A40509C81FFD5CC8C6E5173C8B4599AC0EDAD4DE774F0BA8F55C6AA291179B45E62FBE4AD3F

  • wss

    wss://mastiffsystemsmesh.mytrmm.com:443/agent.ashx

Signatures

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

  • Family: Supershell

    Supershell is a cross-platfrom reverse shell written in Golang.

  • Detects MeshAgent payload 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 2 IoCs
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

  • Executes dropped EXE 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
      C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5260
      • C:\Users\Admin\AppData\Local\Temp\is-021NR.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-021NR.tmp\tacticalagent-v2.11.0-windows-amd64.tmp" /SL5="$701FA,4216799,861184,C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:5636
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5648
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5676
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5736
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5752
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM tacticalrmm.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5824
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c tacticalrmm.exe -m installsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5984
          • C:\Program Files\TacticalAgent\tacticalrmm.exe
            tacticalrmm.exe -m installsvc
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5276
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net start tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6128
          • C:\Windows\SysWOW64\net.exe
            net start tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5924
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5976
    • C:\Program Files\TacticalAgent\tacticalrmm.exe
      "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://mastiffsystemsapi.mytrmm.com --client-id 43 --site-id 51 --agent-type workstation --auth 54061b12a2467a48b4e2ea56c43f77b6207615bd015c58cb67366de489fe8a7b
      2⤵
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Program Files\TacticalAgent\meshagent.exe
        "C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall
        3⤵
        • Sets service image path in registry
        • Executes dropped EXE
        PID:4852
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
        3⤵
        • Executes dropped EXE
        PID:1824
  • C:\Program Files\Mesh Agent\MeshAgent.exe
    "C:\Program Files\Mesh Agent\MeshAgent.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -noprofile -nologo -command -
      2⤵
      • Drops file in System32 directory
      • Command and Scripting Interpreter: PowerShell
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3228
    • C:\Windows\system32\cmd.exe
      /c manage-bde -protectors -get C: -Type recoverypassword
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\system32\manage-bde.exe
        manage-bde -protectors -get C: -Type recoverypassword
        3⤵
          PID:2648
      • C:\Windows\system32\cmd.exe
        /c manage-bde -protectors -get F: -Type recoverypassword
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Windows\system32\manage-bde.exe
          manage-bde -protectors -get F: -Type recoverypassword
          3⤵
            PID:5148
      • C:\Program Files\TacticalAgent\tacticalrmm.exe
        "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5780
        • C:\Program Files\TacticalAgent\tacticalrmm.exe
          "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4560
        • C:\Program Files\Mesh Agent\MeshAgent.exe
          "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
          2⤵
          • Executes dropped EXE
          PID:4824
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3356038825.ps1
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2284
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\542091045.ps1
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Windows\System32\setx.exe
            "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283300045909053
            3⤵
              PID:1380
            • C:\Windows\System32\setx.exe
              "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283300053319144
              3⤵
                PID:4552
              • C:\Windows\System32\setx.exe
                "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283300054569425
                3⤵
                  PID:1552
                • C:\ProgramData\chocolatey\choco.exe
                  "C:\ProgramData\chocolatey\choco.exe" -v
                  3⤵
                  • Executes dropped EXE
                  PID:6008
            • C:\Program Files\TacticalAgent\tacticalrmm.exe
              "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc
              1⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5920
              • C:\Program Files\TacticalAgent\tacticalrmm.exe
                "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner
                2⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6052
              • C:\Program Files\Mesh Agent\MeshAgent.exe
                "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
                2⤵
                • Executes dropped EXE
                PID:1048
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1951571121.ps1
                2⤵
                • Badlisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4640
                • C:\Windows\System32\setx.exe
                  "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299931940467
                  3⤵
                    PID:3284
                  • C:\Windows\System32\setx.exe
                    "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299935065352
                    3⤵
                      PID:2580
                    • C:\Windows\System32\setx.exe
                      "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299936003072
                      3⤵
                        PID:5356
                      • C:\Windows\System32\setx.exe
                        "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299962570229
                        3⤵
                          PID:5528
                        • C:\ProgramData\chocolatey\choco.exe
                          "C:\ProgramData\chocolatey\choco.exe" -v
                          3⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:1164
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3511362825.ps1
                        2⤵
                        • Drops file in System32 directory
                        • Command and Scripting Interpreter: PowerShell
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2528

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          MeshAgent.db

                          • Path C:\Program Files\Mesh Agent\MeshAgent.db
                          • Size 39KB
                          • SHA256 4ec7ad31929ee8f41b2047d18f0df3274f5b673cb1cd3c616193b45b1ab4261f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          MeshAgent.db

                          • Path C:\Program Files\Mesh Agent\MeshAgent.db
                          • Size 176KB
                          • SHA256 cfc79312449de4e6cf659af5f4ca69429ee7918e66d988c1f4ebb24038e42b3d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          agent.log

                          • Path C:\Program Files\TacticalAgent\agent.log
                          • Size 210B
                          • SHA256 a258c1dd4cfb38b6435504db66dce8957c279b5ac944ad81769114704730d701
                          • MD5 SHA1 SHA512 TLSH

                          agent.log

                          • Path C:\Program Files\TacticalAgent\agent.log
                          • Size 72B
                          • SHA256 52570f7a872b4820527f20a22521cc29f5db072fd77705e8fd8892988307b4ea
                          • MD5 SHA1 SHA512 TLSH

                          agent.log

                          • Path C:\Program Files\TacticalAgent\agent.log
                          • Size 144B
                          • SHA256 5600493d0a79cd7c11fc6c766d972f45d9db035eee5d67c74e2016995472a1df
                          • MD5 SHA1 SHA512 TLSH

                          nu.exe

                          • Path C:\Program Files\TacticalAgent\bin\nu.exe
                          • Size 39.0MB
                          • SHA256 a97f528f3ec26a62668a5609f211edd0b5fafb7cb469519991b1ea1984da2a8c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          meshagent.exe

                          • Path C:\Program Files\TacticalAgent\meshagent.exe
                          • Size 3.3MB
                          • SHA256 905583adba45b5dd0ec8f33974853fc1fd2515169763fdc973dddcdb20eb249e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
                          • Size 211KB
                          • SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          INSTALLER

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\anyio-4.13.0.dist-info\INSTALLER
                          • Size 4B
                          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                          • MD5 SHA1 SHA512

                          __init__.py

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography\hazmat\primitives\__init__.py
                          • Size 180B
                          • SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
                          • MD5 SHA1 SHA512 TLSH

                          LICENSE

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\requests\LICENSE
                          • Size 9KB
                          • SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          __init__.py

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pyasn1\codec\__init__.py
                          • Size 59B
                          • SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
                          • MD5 SHA1 SHA512 TLSH

                          WHEEL

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\requests-2.34.2.dist-info\WHEEL
                          • Size 91B
                          • SHA256 69e6228a0d35958183cc1812f07c565ce837b95eb51bd8a33acba9fa4f68d6c9
                          • MD5 SHA1 SHA512 TLSH

                          LICENSE

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools-82.0.1.dist-info\licenses\LICENSE
                          • Size 1023B
                          • SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
                          • MD5 SHA1 SHA512 TLSH

                          INSTALLER

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\INSTALLER
                          • Size 2B
                          • SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
                          • MD5 SHA1 SHA512

                          WHEEL

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\packaging-26.0.dist-info\WHEEL
                          • Size 82B
                          • SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
                          • MD5 SHA1 SHA512 TLSH

                          LICENSE

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\tomli-2.4.0.dist-info\licenses\LICENSE
                          • Size 1KB
                          • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                          • MD5 SHA1 SHA512 TLSH

                          WHEEL

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\websockets-16.0.dist-info\WHEEL
                          • Size 101B
                          • SHA256 ee4e96732e7cf222587b995fe4ad3de4d2e0faea014e713e4fc78727dd86e3fe
                          • MD5 SHA1 SHA512 TLSH

                          __init__.py

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\internet\__init__.py
                          • Size 139B
                          • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                          • MD5 SHA1 SHA512 TLSH

                          mibdump.exe

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Scripts\mibdump.exe
                          • Size 105KB
                          • SHA256 b09618bd0697939681a2aac76bf6d35a8641c784dee0eb5f253938e36f6a70ca
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-console-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-console-l1-1-0.dll
                          • Size 18KB
                          • SHA256 4aaf273c4cb1d93b8c8686843ffbc577d31e1c010e02ae8e72478c5b52dda06d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-datetime-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-datetime-l1-1-0.dll
                          • Size 18KB
                          • SHA256 a580c502170462431a197954eada3a2b92cddda8e77d489475a8fa6da0000349
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-debug-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-debug-l1-1-0.dll
                          • Size 18KB
                          • SHA256 b83a794600a47be935cc562ace7a4d531083c76fcc8ac6424d008f1034eedf96
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-errorhandling-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-errorhandling-l1-1-0.dll
                          • Size 18KB
                          • SHA256 3975ca725ae8f6f635560329ee00e214f58d6a2c9e8d355756481f92c068cd43
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-file-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-file-l1-1-0.dll
                          • Size 21KB
                          • SHA256 d62e2dcb011f08b416addaa11d07fc295427f57ca31b0098a71cc7ed6fe2e95e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-file-l1-2-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-file-l1-2-0.dll
                          • Size 18KB
                          • SHA256 6b31a206c051815be9f7b366d2a9d2464747a56888a7307a924ecdac558271e1
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-file-l2-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-file-l2-1-0.dll
                          • Size 18KB
                          • SHA256 6ba964ad55822f55eea14f73a48deb164b337639a82da677fc6efc1c539fe81e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-handle-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-handle-l1-1-0.dll
                          • Size 18KB
                          • SHA256 69ebc1072b678643a9e64ff6455cc02880da4b542e45f93d6d479fccfb73c07d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-heap-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-heap-l1-1-0.dll
                          • Size 18KB
                          • SHA256 b41e478248ff99012f2d67813c1ba1b7ca41890289bb9027181c1238f6472e51
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-interlocked-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-interlocked-l1-1-0.dll
                          • Size 18KB
                          • SHA256 a934ee2bda04576524c4b9e05186179af388bcdf782aef02878a342427f3361d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-libraryloader-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-libraryloader-l1-1-0.dll
                          • Size 18KB
                          • SHA256 def954361eba9ca81693dde0ceb108136cbc1b5c9e50bafc62182079219d0735
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-localization-l1-2-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-localization-l1-2-0.dll
                          • Size 20KB
                          • SHA256 2b7e6b54ebc2b9556e2f75e7372d4b2d16758f928b79395b8a55c7acdca93341
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-memory-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-memory-l1-1-0.dll
                          • Size 18KB
                          • SHA256 1fcc4c3c6c688c02c4b61a4d054d45f97cbf8fbb34f8d306a9d455db7d44f641
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-namedpipe-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-namedpipe-l1-1-0.dll
                          • Size 18KB
                          • SHA256 3a1bbd714ba09814a42b62eef1abd48c27f4c02c5b0c69975e017406e8037f77
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-processenvironment-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-processenvironment-l1-1-0.dll
                          • Size 19KB
                          • SHA256 c18fcf72b0b53be9c41c5f8e60f1dcbe15f8a374880f2abb9b5e8aad17a508a0
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-processthreads-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-processthreads-l1-1-0.dll
                          • Size 20KB
                          • SHA256 c042b609479eafbb7eaa98586f4178455ece1db9ffb441f7ec0f8026ed1d0de6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-processthreads-l1-1-1.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-processthreads-l1-1-1.dll
                          • Size 18KB
                          • SHA256 5129795d6e0aeca2fa56aaa56d71d2e9809c2ad77c14265abcb51fe832105e00
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-profile-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-profile-l1-1-0.dll
                          • Size 17KB
                          • SHA256 49d214f07eced8a966e9ce102cd6a5fec8c9bb47ee3f1d027c23a258142b44b8
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-rtlsupport-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-rtlsupport-l1-1-0.dll
                          • Size 18KB
                          • SHA256 ef8814992833c056235cdfb04214758ec1e5bfc147069d005920f05a18056169
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-string-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-string-l1-1-0.dll
                          • Size 18KB
                          • SHA256 aaa457e091a2737df36849b0b403eee22ea571ba09dc4f181c7177c2f254a6dd
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-synch-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-synch-l1-1-0.dll
                          • Size 20KB
                          • SHA256 a79597dbacd18716bf6bf0cfaa0c647b862165d48972937669bac03a9d196f71
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-synch-l1-2-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-synch-l1-2-0.dll
                          • Size 18KB
                          • SHA256 d95346a16d088e510def0eff7cbdcb71d70adf335d0a88a7838c9476590c8f8c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-sysinfo-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-sysinfo-l1-1-0.dll
                          • Size 19KB
                          • SHA256 5f1801102b5b865c8275588d1a983f6166ccc15794a0a96ce9534889173da06d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-timezone-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-timezone-l1-1-0.dll
                          • Size 18KB
                          • SHA256 23f035627abed3460e6dbe8436e5b608c7c30f69091011f655f10ee49ebfd282
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-core-util-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-core-util-l1-1-0.dll
                          • Size 17KB
                          • SHA256 bb15ccff99ecdd52cf0c5d178ee6ee445bd3192664775ea74d2fa1648b5d1b4a
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-conio-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-conio-l1-1-0.dll
                          • Size 19KB
                          • SHA256 edf658d7655b524f5158b69a189d9715f87ceac701a055acc23ce608e4ea0774
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-convert-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-convert-l1-1-0.dll
                          • Size 22KB
                          • SHA256 b353bd22b97fd3704557a99359c9ea0b4e0ad8b7e43b5e21700dabd1a1d84923
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-environment-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-environment-l1-1-0.dll
                          • Size 18KB
                          • SHA256 325e7bb5c8a3c7f9db8698a570b7d9d9424a028d51f937a2dff3dc5ff0b6e457
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-filesystem-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-filesystem-l1-1-0.dll
                          • Size 20KB
                          • SHA256 b78607f566599e92bfa8ff5de0f28c439207abf17f274a045500a0d107287d41
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-heap-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-heap-l1-1-0.dll
                          • Size 19KB
                          • SHA256 a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-locale-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-locale-l1-1-0.dll
                          • Size 18KB
                          • SHA256 29abdc8c5396132b004e6751464641b8f0562249333b2257a1d2eb4aecc8d9dc
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-math-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-math-l1-1-0.dll
                          • Size 26KB
                          • SHA256 6a9dd5a4e52c1aa0e341e35e9dc1a6fbf476ebacd64add3a53c146f019a9a4c6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-multibyte-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-multibyte-l1-1-0.dll
                          • Size 26KB
                          • SHA256 acb97f64896cb96cea09c2a2e691a8e2302885150a0699aa0ac0593bcdc89e9f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-private-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-private-l1-1-0.dll
                          • Size 69KB
                          • SHA256 31ea0991b7fac73adbaf2b9887bbf80353d78bc9a92618bb73e2b55f6bd4f1ad
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-process-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-process-l1-1-0.dll
                          • Size 19KB
                          • SHA256 e31fd2a662773f4b2d84d29dc312d5614992b8e1b700840a2f5ae539ad9a21c2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-runtime-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-runtime-l1-1-0.dll
                          • Size 21KB
                          • SHA256 6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-stdio-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-stdio-l1-1-0.dll
                          • Size 24KB
                          • SHA256 513bb1dd16be7491ced8fa2494b604257285f76062525685c2991391d0c048c3
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-string-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-string-l1-1-0.dll
                          • Size 24KB
                          • SHA256 63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-time-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-time-l1-1-0.dll
                          • Size 20KB
                          • SHA256 803b6f86f178e71f462dfdd6521c9f4791059c1fab5dc86de17c34c25e55f8bd
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          api-ms-win-crt-utility-l1-1-0.dll

                          • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\api-ms-win-crt-utility-l1-1-0.dll
                          • Size 18KB
                          • SHA256 7a578dd2ceb4387ae8f67f6a82ab553ca1570d1588ab6645859e5625585af95c
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          tacticalrmm.exe

                          • Path C:\Program Files\TacticalAgent\tacticalrmm.exe
                          • Size 11.8MB
                          • SHA256 50bd75acffec398028502fca967529f72cff40083dfbe137a9712628bcc0fef1
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          tacticalagent-v2.11.0-windows-amd64.exe

                          • Path C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
                          • Size 5.0MB
                          • SHA256 99b5544169550f7915322411b90af71dc9883d53ba5938025e7db440b6cc1d5e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          choco.exe

                          • Path C:\ProgramData\chocolatey\choco.exe
                          • Size 11.5MB
                          • SHA256 cb3623ee613d28db9a4b7bf40c1df2e7b9c21e709902276bae9d3f6368574404
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolatey.config.1164.update

                          • Path C:\ProgramData\chocolatey\config\chocolatey.config.1164.update
                          • Size 9KB
                          • SHA256 e965ae07d0a7a1a3a8fe642f732b3177e80c83c3396c96a68a520f2900c53d0d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolatey.config.backup

                          • Path C:\ProgramData\chocolatey\config\chocolatey.config.backup
                          • Size 809B
                          • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                          • MD5 SHA1 SHA512 TLSH

                          chocolateyInstaller.psm1

                          • Path C:\ProgramData\chocolatey\helpers\chocolateyInstaller.psm1
                          • Size 21KB
                          • SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Format-FileSize.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Format-FileSize.ps1
                          • Size 15KB
                          • SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-CheckSumValid.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-CheckSumValid.ps1
                          • Size 25KB
                          • SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-ChocolateyConfigValue.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyConfigValue.ps1
                          • Size 15KB
                          • SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-ChocolateyPath.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyPath.ps1
                          • Size 16KB
                          • SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-ChocolateyUnzip.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyUnzip.ps1
                          • Size 25KB
                          • SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-ChocolateyWebFile.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyWebFile.ps1
                          • Size 31KB
                          • SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-FtpFile.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-FtpFile.ps1
                          • Size 22KB
                          • SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-OSArchitectureWidth.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-OSArchitectureWidth.ps1
                          • Size 16KB
                          • SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-PackageParameters.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-PackageParameters.ps1
                          • Size 21KB
                          • SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-ToolsLocation.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-ToolsLocation.ps1
                          • Size 17KB
                          • SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-UACEnabled.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-UACEnabled.ps1
                          • Size 15KB
                          • SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-UninstallRegistryKey.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-UninstallRegistryKey.ps1
                          • Size 19KB
                          • SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-VirusCheckValid.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-VirusCheckValid.ps1
                          • Size 15KB
                          • SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-WebFile.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-WebFile.ps1
                          • Size 28KB
                          • SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-WebFileName.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-WebFileName.ps1
                          • Size 23KB
                          • SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Get-WebHeaders.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Get-WebHeaders.ps1
                          • Size 20KB
                          • SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-BinFile.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-BinFile.ps1
                          • Size 20KB
                          • SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyEnvironmentVariable.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
                          • Size 18KB
                          • SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyExplorerMenuItem.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
                          • Size 18KB
                          • SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyFileAssociation.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyFileAssociation.ps1
                          • Size 17KB
                          • SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyInstallPackage.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyInstallPackage.ps1
                          • Size 28KB
                          • SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyPackage.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPackage.ps1
                          • Size 30KB
                          • SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyPinnedTaskBarItem.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
                          • Size 16KB
                          • SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyPowershellCommand.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPowershellCommand.ps1
                          • Size 23KB
                          • SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyShortcut.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyShortcut.ps1
                          • Size 22KB
                          • SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyVsixPackage.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyVsixPackage.ps1
                          • Size 22KB
                          • SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-ChocolateyZipPackage.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyZipPackage.ps1
                          • Size 24KB
                          • SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Install-Vsix.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Install-Vsix.ps1
                          • Size 16KB
                          • SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Set-PowerShellExitCode.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Set-PowerShellExitCode.ps1
                          • Size 15KB
                          • SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Start-ChocolateyProcessAsAdmin.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
                          • Size 31KB
                          • SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          UnInstall-ChocolateyZipPackage.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
                          • Size 16KB
                          • SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Uninstall-BinFile.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Uninstall-BinFile.ps1
                          • Size 17KB
                          • SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Uninstall-ChocolateyEnvironmentVariable.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
                          • Size 16KB
                          • SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Uninstall-ChocolateyPackage.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Uninstall-ChocolateyPackage.ps1
                          • Size 20KB
                          • SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Write-FunctionCallLogMessage.ps1

                          • Path C:\ProgramData\chocolatey\helpers\functions\Write-FunctionCallLogMessage.ps1
                          • Size 15KB
                          • SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolatey.nupkg

                          • Path C:\ProgramData\chocolatey\lib\chocolatey\chocolatey.nupkg
                          • Size 5.5MB
                          • SHA256 40778cc59245b3eb6ea5147aeef5bea5d577419e5abce22a224189740dc16db5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolatey.log

                          • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                          • Size 4KB
                          • SHA256 cf893c4e3f8856896d0ed075f3c8b3c12680b5da7201ae8303de5bee1c15f206
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolateyInstall.ps1

                          • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall.ps1
                          • Size 16KB
                          • SHA256 c46903cfed1d74620630d0653ce057b3079af5789afeb1a5f884298a8693b4ec
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolateysetup.psm1

                          • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateysetup.psm1
                          • Size 46KB
                          • SHA256 4d1a0d3cc617ab11eb736b8d12f202bec257fd419c9b1d9c5f62e42aab6dbbcf
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          tacticalagent-v2.11.0-windows-amd64.tmp

                          • Path C:\Users\Admin\AppData\Local\Temp\is-021NR.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
                          • Size 3.4MB
                          • SHA256 4e50d7fcd52abdf13c2159b53b6a4fa7c6483c3eaebf3bf792db129e6fd80e73
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          4D19361C1E7B229FDD75EF5C063C1EB9E822E33B

                          • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D19361C1E7B229FDD75EF5C063C1EB9E822E33B
                          • Size 1KB
                          • SHA256 867bad0dba17d1b14bce76489fe5eeb9f6c53e2bf438b877e4314b2a364e9b7c
                          • MD5 SHA1 SHA512 TLSH

                          __PSScriptPolicyTest_btgck1kl.4oh.ps1

                          • Path C:\Windows\Temp\__PSScriptPolicyTest_btgck1kl.4oh.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH

                          CREDITS.json

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.json
                          • Size 4KB
                          • SHA256 c5fad22315b60877f304ca3d3e5a40549efb55d742a23917a2f5b275a5916144
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          CREDITS.pdf

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.pdf
                          • Size 168KB
                          • SHA256 dc18f6fd6ca9cc102d3eff336b90afbfa564981529953ed8b47eaa83acc56286
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          CREDITS.txt

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txt
                          • Size 26KB
                          • SHA256 e8dab7ad60ca5003e6792f929c609bfe83be1e42f8bd9a1d9fe93efacc19390a
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          LICENSE.txt

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txt
                          • Size 670B
                          • SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
                          • MD5 SHA1 SHA512 TLSH

                          choco.exe.manifest

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe.manifest
                          • Size 2KB
                          • SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
                          • MD5 SHA1 SHA512 TLSH

                          Chocolatey.PowerShell.dll

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
                          • Size 38KB
                          • SHA256 366b891888c8f820329842bb5243f7df050a335d70cfb74d21a109ac7b96cc81
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          Chocolatey.PowerShell.dll-help.xml

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll-help.xml
                          • Size 58KB
                          • SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          ChocolateyTabExpansion.ps1

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\ChocolateyTabExpansion.ps1
                          • Size 37KB
                          • SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolateyProfile.psm1

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1
                          • Size 15KB
                          • SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          chocolateyScriptRunner.ps1

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyScriptRunner.ps1
                          • Size 17KB
                          • SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          RefreshEnv.cmd

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\RefreshEnv.cmd
                          • Size 5KB
                          • SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          choco.exe

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe
                          • Size 143KB
                          • SHA256 4a1c6cf52929dd0348f5c91ce2a69a7d35a06a4c143957f42d855756da4af510
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          choco.exe.ignore

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe.ignore
                          • Size 2B
                          • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                          • MD5 SHA1 SHA512

                          7z.dll

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll
                          • Size 1.3MB
                          • SHA256 585e2e465bf77e3daa25de7dcba5fac0606ae4a0e029903158d85ae0b1805f34
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          7z.dll.manifest

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll.manifest
                          • Size 513B
                          • SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
                          • MD5 SHA1 SHA512 TLSH

                          7z.exe

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe
                          • Size 350KB
                          • SHA256 fe888b5c127025f938bc6c028fa58b2d0637678d1c796a74617c089a6a0d5ca9
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          7zip.license.txt

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7zip.license.txt
                          • Size 5KB
                          • SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          checksum.exe

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe
                          • Size 38KB
                          • SHA256 199f19514bf28345e94ce55f3ef42adb97c81f521870a30178d13670ed6d9dd4
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          checksum.exe.config

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe.config
                          • Size 150B
                          • SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
                          • MD5 SHA1 SHA512 TLSH

                          checksum.license.txt

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.license.txt
                          • Size 95B
                          • SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
                          • MD5 SHA1 SHA512 TLSH

                          shimgen.exe

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.exe
                          • Size 555KB
                          • SHA256 a150c842f118a9b9fbba7bb65bc48529e33116f2ba5f1b4b99067b7a732cfc74
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          shimgen.license.txt

                          • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.license.txt
                          • Size 3KB
                          • SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
                          • MD5 SHA1 SHA512 TLSH

                          1770E2E2DA2C4EC236C80ED5BB9D0EBE674600CA

                          • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\1770E2E2DA2C4EC236C80ED5BB9D0EBE674600CA
                          • Size 1KB
                          • SHA256 abbacf7ad9e8d3d9e2d0784933da7fdacd9d696fbeb8e0bb4e1a7ea968883ed3
                          • MD5 SHA1 SHA512 TLSH

                          memory/980-50-0x0000020A2E0D0000-0x0000020A2E0F2000-memory.dmp

                          memory/980-53-0x0000020A474F0000-0x0000020A47534000-memory.dmp

                          memory/980-55-0x0000020A475C0000-0x0000020A47636000-memory.dmp

                          memory/1164-3980-0x0000023725070000-0x0000023725BE8000-memory.dmp

                          memory/1164-3995-0x00000237264B0000-0x0000023726500000-memory.dmp

                          memory/1164-4036-0x0000023726500000-0x000002372651E000-memory.dmp

                          memory/2284-3524-0x0000028FFC6E0000-0x0000028FFC6EA000-memory.dmp

                          memory/2284-3523-0x0000028FFD680000-0x0000028FFD692000-memory.dmp

                          memory/4640-3522-0x0000023C329E0000-0x0000023C329EA000-memory.dmp

                          memory/4640-3527-0x0000023C32A20000-0x0000023C32A26000-memory.dmp

                          memory/4640-3526-0x0000023C329F0000-0x0000023C329F8000-memory.dmp

                          memory/4640-3528-0x0000023C32A30000-0x0000023C32A3A000-memory.dmp

                          memory/4640-3521-0x0000023C32A00000-0x0000023C32A1C000-memory.dmp

                          memory/4640-3512-0x0000023C327D0000-0x0000023C32885000-memory.dmp

                          memory/4640-3709-0x0000023C32890000-0x0000023C3289E000-memory.dmp

                          memory/4640-3513-0x0000023C32890000-0x0000023C3289A000-memory.dmp

                          memory/4640-3525-0x0000023C32A40000-0x0000023C32A5A000-memory.dmp

                          memory/4640-3511-0x0000023C327B0000-0x0000023C327CC000-memory.dmp

                          memory/5052-9-0x00000000033E0000-0x00000000033E1000-memory.dmp

                          memory/5052-21-0x0000000000360000-0x00000000006CE000-memory.dmp

                          memory/5260-22-0x0000000000920000-0x0000000000A02000-memory.dmp

                          memory/5260-3-0x0000000000920000-0x0000000000A02000-memory.dmp