PUP.TacticalRMM
The detection of PUP.TacticalRMM on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is PUP.TacticalRMM?
PUP.TacticalRMM is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are often bundled with other software or downloaded from untrusted sources, and they can cause a range of problems, including slowing down your computer, displaying unwanted ads, and potentially even stealing your personal data. The name PUP.TacticalRMM suggests that it may be related to remote management or monitoring, but without further information, it is difficult to determine its exact purpose or behavior.
How PUP.TacticalRMM Operates
Like many PUPs, PUP.TacticalRMM may operate by installing itself on your system and then running in the background, often without your knowledge or consent. It may collect data about your browsing habits, system configuration, or other sensitive information, and transmit this data to its creators or other third parties. PUPs like PUP.TacticalRMM can also modify system settings, install additional software, or display unwanted ads, making it difficult to use your computer effectively.
It is also possible that PUP.TacticalRMM may be using legitimate system processes or disguising itself as a legitimate program to avoid detection. This can make it challenging to identify and remove the PUP, especially for inexperienced users. However, by understanding the symptoms of infection and taking the right steps, you can remove PUP.TacticalRMM and restore your system to a safe and secure state.
Symptoms of Infection
The symptoms of PUP.TacticalRMM infection can vary, but common signs include slow system performance, unwanted ads or pop-ups, unfamiliar programs or icons, and unexpected changes to system settings. You may also notice that your browser homepage or search engine has been changed, or that you are being redirected to unfamiliar websites. If you suspect that your system is infected with PUP.TacticalRMM, it is essential to take immediate action to remove the threat and prevent further damage.
- Slow system performance or crashes
- Unwanted ads or pop-ups
- Unfamiliar programs or icons
- Unexpected changes to system settings
- Browser homepage or search engine changes
- Redirects to unfamiliar websites
How to Remove PUP.TacticalRMM
- Boot your system in Safe Mode with Networking to prevent PUP.TacticalRMM from loading and to allow for a clean removal process.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious components related to PUP.TacticalRMM.
- Uninstall any suspicious programs or applications that may be related to PUP.TacticalRMM.
- Reset your browser settings, including Chrome, Firefox, and Edge, to their default values to remove any unwanted changes or extensions.
- Reboot your system and perform a follow-up scan to ensure that PUP.TacticalRMM has been completely removed.
Conclusion
Removing PUP.TacticalRMM from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove this potentially unwanted program and restore your system to a safe and secure state. Remember to always be cautious when downloading software or clicking on links from untrusted sources, and to keep your system and anti-virus software up to date to prevent future infections.
Analysis Report
General information
| Family Name: | PUP.TacticalRMM |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6a5e53cda82dd4dcb0f9312bb9d70718
SHA1:
0eceeb987206961b61e4979383a24f32d24171f0
SHA256:
D9957033E0C39D8B6FF8153376B097A1090E5C60A2A4E6931741DC1A66FB5C5F
File Size:
4.37 MB, 4366864 bytes
|
|
MD5:
743332c5817338609fbc4d5e85ee5c69
SHA1:
9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2
SHA256:
950A12ED22261F193E658329A21A50BBF0C33C5E527B7666EA2E17B1891FA92F
File Size:
4.48 MB, 4475181 bytes
|
|
MD5:
b031db0f8b1db79fe6c405c4c4a15a7a
SHA1:
2ed0d9d5c77b188ae4254e17b30e3a2e7b94bb94
SHA256:
7AD87C05FB6196021BD5F1FC73294A3616C9F81756F71FD0251E2344C52A4290
File Size:
4.89 MB, 4887552 bytes
|
|
MD5:
ab07c502166906dabb3ab7830265cf88
SHA1:
659274b793ae24658ee66a9659b177064073ff16
SHA256:
DF4FE51CAD23582702C2765FD1B584DFFAF1F8D8ED04EC8F5E1EF158C2CC607D
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
e9ed5082f672576cf4456cf083479493
SHA1:
c4f3ed149e838160a47b92fc6cc3f3358d4fb534
SHA256:
F9DEF0FB9669962E0BEA9604B54A95206DB83A94EA7163BCA0E1217400A6118D
File Size:
5.27 MB, 5268992 bytes
|
Show More
|
MD5:
683bd92f0f4002a2484cb0d6f1081134
SHA1:
c4ef5eef921b40ce3059add303a93e1798fc93b3
SHA256:
8DD03795B3FB1EA766DB8F3B3AD57D6F2B53C6CF1118E50BCC8D0652D71E24DF
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
cfc4d8fbc2824a64d40999e4c5781759
SHA1:
22f3eb5e28aadc83e9f81af9df3d4969b658fce0
SHA256:
775AF6E2DFB604BB7C788327B75A22F566157E6F4A6364632CE85FFFA607AE67
File Size:
4.89 MB, 4887552 bytes
|
|
MD5:
8c5c4eb4a60a53b8c0a2b91574ea63f7
SHA1:
3c99835aa1f85660192b622d49c0aaebfd1430e8
SHA256:
3C63DC60492203A8F65CCD04DC94D912C3F6783FB676136238B83E3A0787E306
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
d838ef4aaa462180fd51173cd45a46be
SHA1:
ff371f449db384ab6b49426e9ae64f41f1b5d692
SHA256:
9C100F9F26EB495DADD490650D3EBCC8BD6BDBC9A534A3CEB40B01B051422106
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
75d38680019299cf7a828fd28ffccbc1
SHA1:
37d9efe70dbad097e0164420c19999241939cf73
SHA256:
0AA9283D20F3ABD4C50B205A2C2F0F33A4D889465D5381C8DD6E90A730BE31C9
File Size:
3.55 MB, 3551063 bytes
|
|
MD5:
6d61db050931a6185e429fc672bff2c9
SHA1:
534b29a018828a1fa6606349ab0a9139c5077cc9
SHA256:
B69281DEA45F255A45E99FBBE6A0C89FC269C68B6448B04F1BDC560DEC70DE8E
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
10f7abd5fcb7e108dc1c0ae84d801c7b
SHA1:
bc63156d60f96eac24a3bc494ff170a3d2d05e5e
SHA256:
7BFA865FE98EBAABD9780046358F3FEB1B37142729F37F0909DFAD5ACAEDCA32
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
2e4173f119d4f6d936f69d5ec12a9acc
SHA1:
27db7d5a916503d7f034b0ec33c3f303ff6e6a83
SHA256:
66EC01FDFC7BA17FBD87E7C03821BD7E79AE6E7641182BA67082F2868AADFF35
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
f2268bfc231cf2cef0cb50a01bf8a8bb
SHA1:
9aadf79a25d20ccc38b45f7f9651352c6c1aefa7
SHA256:
4020F25C4ACF1FF39D9F894CD72B81111BD8DB32F467B8C2B6EADCC0F0E32790
File Size:
4.72 MB, 4723248 bytes
|
|
MD5:
8e1fd2eadf0485c14763d89c4298135e
SHA1:
5fb595d58b89ddf09d075470938eecff42f556fb
SHA256:
28FFAE76E9341D7D124F56CFFE6A22B843C94FF7D65B766535565FB06FB3E839
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
b3207544ed604ece14adfec906dd386c
SHA1:
f0c1fc0848a9b2658170ffb8daa5bbc990c64d24
SHA256:
3CE90D7408CA8704141BA0D00CAEEF439B7CF9518C7C9B4C33569D6BC179E349
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
cabc204878bb2740eaa6863af1833a93
SHA1:
0db31a416e92eac343b177ca57988f02158c9aff
SHA256:
6508209695EB1BDC2278BBF8D0EE5ACCC99716B320D26B8D80D80B820B1A02C4
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
491ae8ca89664aa8574f4547cbff25d8
SHA1:
9fdf4871a3bc9b4a44cf7e7819e92fd70a11251c
SHA256:
9BED1F35B7E24463BFA21AB1222E33E2D8531620A8F0D6A2CD24C1D60CE5E7A9
File Size:
5.28 MB, 5277040 bytes
|
|
MD5:
cbe57ab68a9b5c77da2980b6e1485b2b
SHA1:
d07f7507e3efa3cdadee9ad36d144f58098b5068
SHA256:
89D9ED26E742B45E329F20B684ABD3CBF5F9FFE979EEEB74FDB548F3FD919CDE
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
c430107c3ee14dc022912baae59f034e
SHA1:
a47565758e97bba9736087c7c7a303513c51b0b3
SHA256:
DC75EBF0B0C436F7C75BCAECC2131EAB8656227EB40438F34FF82A551E515146
File Size:
5.27 MB, 5268992 bytes
|
|
MD5:
e21c85b732f74d18d9e0afda2fb707fc
SHA1:
f60c6c6616658896fb5f0ba321723cfea552629d
SHA256:
C4F55004435F21D901D0B6D7126F9A3536C51CD94FF52B590CFCABD79A53536D
File Size:
5.27 MB, 5268992 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
Show More
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name | rmm.exe |
| Legal Copyright |
|
| Original File Name | tacticalrmm.exe |
| Original Filename | installer.go |
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Amidaware Inc. | Amidaware Inc. | Self Signed |
File Traits
- 2+ executable sections
- golang
- Inno
- InnoSetup Installer
- Installer Manifest
- Installer Version
- ntdll
- VirtualQueryEx
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 829 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 829 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- BestaFera.G
- BlackLock.A
- CobaltStrike.DWA
- CobaltStrike.XAD
- CobaltStrike.XM
Show More
- CobaltStrike.XN
- CobaltStrike.XV
- CobaltStrike.XZ
- Delf.DA
- Filecoder.DDC
- Filecoder.GOA
- Go.Agent.E
- Go.Rozena.A
- Goshell.C
- Goshell.F
- Ousaban.V
- ReverseShell.B
- ReverseShell.GA
- ReverseShell.WL
- Rozena.EA
- TIYWEPXB.A
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\programdata\tacticalrmm\tacticalagent-v2.10.0-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.4.4-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.4.6-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.6.1-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.7.0-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.8.0-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\tacticalrmm\tacticalagent-v2.9.1-windows-amd64.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-1anae.tmp\9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2_0004475181.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-c9mev.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-go47v.tmp\0eceeb987206961b61e4979383a24f32d24171f0_0004366864.tmp | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\is-k9f5m.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-n0e21.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-o8lu0.tmp\9aadf79a25d20ccc38b45f7f9651352c6c1aefa7_0004723248.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\setup log 2025-09-15 #001.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\setup log 2026-04-21 #001.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ���Q&� | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ܴ♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 똮♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 蠏♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䤷♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 胇♑ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 莵髵퇻ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ᧅ鮎퇻ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| User Data Access |
|
| Syscall Use |
Show More
81 additional items are not displayed above. |
| Anti Debug |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Icmp |
|
| Process Terminate |
|
| Process Manipulation Evasion |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Jrmtgdwl\AppData\Local\Temp\is-GO47V.tmp\0eceeb987206961b61e4979383a24f32d24171f0_0004366864.tmp" /SL5="$1026A,3528895,825344,c:\users\user\downloads\0eceeb987206961b61e4979383a24f32d24171f0_0004366864"
|
"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
|
C:\WINDOWS\system32\PING.EXE ping 127.0.0.1 -n 2
|
C:\WINDOWS\system32\net.exe net stop tacticalrpc
|
WriteConsole: Access is denied
|
Show More
"cmd.exe" /c net stop tacticalagent
|
C:\WINDOWS\system32\net.exe net stop tacticalagent
|
WriteConsole: Access is denied
|
"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
|
C:\WINDOWS\system32\PING.EXE ping 127.0.0.1 -n 2
|
C:\WINDOWS\system32\net.exe net stop tacticalrmm
|
WriteConsole: Access is denied
|
"cmd.exe" /c taskkill /F /IM tacticalrmm.exe
|
C:\WINDOWS\system32\taskkill.exe taskkill /F /IM tacticalrmm.exe
|
WriteConsole: ERROR: CoInitial
|
"cmd.exe" /c sc delete tacticalagent
|
C:\WINDOWS\system32\sc.exe sc delete tacticalagent
|
WriteConsole: [SC] OpenService
|
"cmd.exe" /c sc delete tacticalrpc
|
C:\WINDOWS\system32\sc.exe sc delete tacticalrpc
|
WriteConsole: [SC] OpenService
|
"C:\Users\Tqxwwhoq\AppData\Local\Temp\is-1ANAE.tmp\9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2_0004475181.tmp" /SL5="$6004A,3636643,825344,c:\users\user\downloads\9a528ce9810ec4f79b94c59a2b7f02b61efbf9d2_0004475181"
|
"C:\Users\Xowgraho\AppData\Local\Temp\is-O8LU0.tmp\9aadf79a25d20ccc38b45f7f9651352c6c1aefa7_0004723248.tmp" /SL5="$E0040,3722619,861184,c:\users\user\downloads\9aadf79a25d20ccc38b45f7f9651352c6c1aefa7_0004723248"
|
WriteConsole: ERROR: The proce
|
