hxxps://gofile[.]io/d/osmj7R

Analysis

user interaction
yes
max time kernel
77s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/osmj7R
Sample260705-necsvsfx4r

Score

9^/10

defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
6760	bcdedit.exe
3916	bcdedit.exe
3476	bcdedit.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
54	1232	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
4284	KernelTweak Setup 1.0.0.exe
2900	KernelTweak.exe
5780	KernelTweak.exe
5936	KernelTweak.exe
6104	KernelTweak.exe

Loads dropped DLL 20 IoCs

pid	Process
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
2900	KernelTweak.exe
5780	KernelTweak.exe
5936	KernelTweak.exe
6104	KernelTweak.exe
5780	KernelTweak.exe
5780	KernelTweak.exe
5780	KernelTweak.exe
5780	KernelTweak.exe
5780	KernelTweak.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6540	powershell.exe
6768	powershell.exe
5424	powershell.exe
4400	powershell.exe
2684	powershell.exe
6124	powershell.exe
3956	powershell.exe
6068	powershell.exe
1824	powershell.exe
4740	powershell.exe
2412	powershell.exe
6204	powershell.exe
4324	powershell.exe
5048	powershell.exe
3204	powershell.exe
5848	powershell.exe
1084	powershell.exe
1772	powershell.exe
4752	powershell.exe
2116	powershell.exe
5784	powershell.exe
6424	powershell.exe
7148	powershell.exe
360	powershell.exe
3640	powershell.exe
296	powershell.exe
5948	powershell.exe
4872	powershell.exe
4992	powershell.exe
504	powershell.exe
1728	powershell.exe
3632	powershell.exe
6332	powershell.exe
3316	powershell.exe
5600	powershell.exe
6824	powershell.exe
3272	powershell.exe
1456	powershell.exe
6020	powershell.exe
6528	powershell.exe
4168	powershell.exe
6808	powershell.exe
1380	powershell.exe
5828	powershell.exe
6440	powershell.exe
2992	powershell.exe
1972	powershell.exe
1504	powershell.exe
4508	powershell.exe
5376	powershell.exe
4420	powershell.exe
2708	powershell.exe
2640	powershell.exe
5724	powershell.exe
2648	powershell.exe
4388	powershell.exe
4304	powershell.exe
3260	powershell.exe
1472	powershell.exe
5700	powershell.exe
1068	powershell.exe
3388	powershell.exe
5904	powershell.exe
2668	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	api.gofile.io
30	api.gofile.io
32	api.gofile.io
36	api.gofile.io

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 29 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2316	powercfg.exe
2904	powercfg.exe
1860	powercfg.exe
480	powercfg.exe
4296	powercfg.exe
2648	powercfg.exe
4196	cmd.exe
1116	cmd.exe
5024	powercfg.exe
6800	cmd.exe
2584	cmd.exe
5700	powershell.exe
1772	powercfg.exe
3004	powercfg.exe
4540	cmd.exe
6368	powershell.exe
2028	cmd.exe
4452	powercfg.exe
4752	powershell.exe
3612	powershell.exe
908	powercfg.exe
1836	powercfg.exe
6700	powercfg.exe
5128	powercfg.exe
6276	cmd.exe
2804	powercfg.exe
3260	powershell.exe
4292	powercfg.exe
3328	powershell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\KernelTweak\vk_swiftshader.dll	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\da.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\de.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\es-419.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\resources\app.asar	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ml.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\v8_context_snapshot.bin	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\bg.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\fil.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\id.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\kn.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\lt.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ro.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\libEGL.dll	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\resources.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\vulkan-1.dll	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\es.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ko.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\sv.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\sw.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\LICENSE.electron.txt	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\ffmpeg.dll	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\vk_swiftshader_icd.json	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ca.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\fi.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\pt-PT.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\zh-TW.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\resources\elevate.exe	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\Uninstall KernelTweak.exe	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\uninstallerIcon.ico	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\KernelTweak.exe	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\af.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\hr.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\nb.pak	KernelTweak Setup 1.0.0.exe
File opened for modification	C:\Program Files\KernelTweak\resources	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\en-US.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\it.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ur.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\mr.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\pl.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\pt-BR.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\sl.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ta.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\el.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\fa.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\chrome_100_percent.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\snapshot_blob.bin	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\gu.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\he.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ru.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\icudtl.dat	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\am.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ar.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\te.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\th.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\cs.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\fr.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\lv.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\ms.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\nl.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\sk.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\locales\uk.pak	KernelTweak Setup 1.0.0.exe
File created	C:\Program Files\KernelTweak\d3dcompiler_47.dll	KernelTweak Setup 1.0.0.exe
File opened for modification	C:\Program Files\KernelTweak\locales	KernelTweak Setup 1.0.0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	KernelTweak.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 64 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6808	powershell.exe
1972	powershell.exe
4400	powershell.exe
1084	powershell.exe
6436	powershell.exe
5484	cmd.exe
6680	cmd.exe
6224	powershell.exe
3840	powershell.exe
6328	cmd.exe
2436	powershell.exe
5116	cmd.exe
6876	powershell.exe
6540	powershell.exe
3124	powershell.exe
6920	powershell.exe
4568	powershell.exe
1188	powershell.exe
1836	cmd.exe
4508	cmd.exe
1384	powershell.exe
4556	cmd.exe
4616	cmd.exe
6992	cmd.exe
5744	cmd.exe
4320	cmd.exe
1468	powershell.exe
1216	powershell.exe
4548	powershell.exe
1504	powershell.exe
3132	powershell.exe
6000	powershell.exe
1116	cmd.exe
1284	cmd.exe
6744	cmd.exe
1976	cmd.exe
6892	cmd.exe
6204	cmd.exe
5784	cmd.exe
2772	powershell.exe
1316	cmd.exe
3632	powershell.exe
1188	cmd.exe
3320	powershell.exe
2968	cmd.exe
2884	cmd.exe
7036	powershell.exe
7152	cmd.exe
1012	cmd.exe
4872	cmd.exe
6068	cmd.exe
5592	cmd.exe
4976	cmd.exe
1472	powershell.exe
2436	powershell.exe
6848	powershell.exe
436	cmd.exe
1824	powershell.exe
2648	powershell.exe
5516	cmd.exe
4860	powershell.exe
5472	powershell.exe
6680	powershell.exe
4872	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KernelTweak Setup 1.0.0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1232	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a041ec0fbc09f3eb0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801a041ec0f0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101a041ec0f000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3a041ec0f00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6a041ec0f00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6500	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3964	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277239037156793"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{9F3B11CE-CA7C-4083-8804-7A4500C65587}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	KernelTweak Setup 1.0.0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
4284	KernelTweak Setup 1.0.0.exe
7048	powershell.exe
7048	powershell.exe
4992	powershell.exe
4992	powershell.exe
7048	powershell.exe
4992	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
2596	powershell.exe
2596	powershell.exe
2596	powershell.exe
716	powershell.exe
716	powershell.exe
716	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
5812	powershell.exe
5812	powershell.exe
5812	powershell.exe
5360	powershell.exe
5360	powershell.exe
5360	powershell.exe
6584	powershell.exe
6584	powershell.exe
6584	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
5408	powershell.exe
5408	powershell.exe
5408	powershell.exe
1736	powershell.exe
1736	powershell.exe
1736	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
4740	powershell.exe
4740	powershell.exe
4740	powershell.exe
2712	powershell.exe
2712	powershell.exe
2712	powershell.exe
7064	powershell.exe
7064	powershell.exe
7064	powershell.exe
6424	powershell.exe
6424	powershell.exe
6424	powershell.exe
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe
3204	powershell.exe
3204	powershell.exe
3204	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4284	KernelTweak Setup 1.0.0.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	7048	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeBackupPrivilege	5208	vssvc.exe
Token: SeRestorePrivilege	5208	vssvc.exe
Token: SeAuditPrivilege	5208	vssvc.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	5360	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	6584	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	5408	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeShutdownPrivilege	2900	KernelTweak.exe
Token: SeCreatePagefilePrivilege	2900	KernelTweak.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 5896	6032	msedge.exe	89
PID 6032 wrote to memory of 3232	6032	msedge.exe	90
PID 6032 wrote to memory of 1232	6032	msedge.exe	91
PID 6032 wrote to memory of 3232	6032	msedge.exe	90
PID 6032 wrote to memory of 3232	6032	msedge.exe	90
PID 6032 wrote to memory of 2424	6032	msedge.exe	92
PID 6032 wrote to memory of 2424	6032	msedge.exe	92
PID 6032 wrote to memory of 2520	6032	msedge.exe	94
PID 6032 wrote to memory of 2520	6032	msedge.exe	94
PID 6032 wrote to memory of 2520	6032	msedge.exe	94
PID 6032 wrote to memory of 6580	6032	msedge.exe	95
PID 6032 wrote to memory of 6580	6032	msedge.exe	95
PID 6032 wrote to memory of 6580	6032	msedge.exe	95
PID 6032 wrote to memory of 3816	6032	msedge.exe	96
PID 6032 wrote to memory of 3816	6032	msedge.exe	96
PID 6032 wrote to memory of 3816	6032	msedge.exe	96
PID 6032 wrote to memory of 6972	6032	msedge.exe	97
PID 6032 wrote to memory of 6412	6032	msedge.exe	98
PID 6032 wrote to memory of 6972	6032	msedge.exe	97
PID 6032 wrote to memory of 6412	6032	msedge.exe	98
PID 6032 wrote to memory of 2672	6032	msedge.exe	100
PID 6032 wrote to memory of 7028	6032	msedge.exe	103
PID 6032 wrote to memory of 7028	6032	msedge.exe	103
PID 6032 wrote to memory of 7028	6032	msedge.exe	103
PID 6032 wrote to memory of 4672	6032	msedge.exe	104
PID 6032 wrote to memory of 4672	6032	msedge.exe	104
PID 6032 wrote to memory of 2632	6032	msedge.exe	105
PID 6032 wrote to memory of 2632	6032	msedge.exe	105
PID 6032 wrote to memory of 2632	6032	msedge.exe	105
PID 6032 wrote to memory of 4524	6032	msedge.exe	106
PID 6032 wrote to memory of 5552	6032	msedge.exe	107
PID 6032 wrote to memory of 5552	6032	msedge.exe	107
PID 6032 wrote to memory of 5552	6032	msedge.exe	107
PID 6032 wrote to memory of 6780	6032	msedge.exe	108
PID 6032 wrote to memory of 6780	6032	msedge.exe	108
PID 6032 wrote to memory of 4284	6032	msedge.exe	109
PID 6032 wrote to memory of 4524	6032	msedge.exe	113
PID 6032 wrote to memory of 4972	6032	msedge.exe	114
PID 6032 wrote to memory of 5752	6032	msedge.exe	115
PID 2900 wrote to memory of 5780	2900	KernelTweak.exe	116
PID 2900 wrote to memory of 5780	2900	KernelTweak.exe	116
PID 2900 wrote to memory of 5936	2900	KernelTweak.exe	117
PID 2900 wrote to memory of 6104	2900	KernelTweak.exe	118
PID 2900 wrote to memory of 3936	2900	KernelTweak.exe	119
PID 2900 wrote to memory of 3120	2900	KernelTweak.exe	120
PID 3120 wrote to memory of 4992	3120	cmd.exe	123
PID 3936 wrote to memory of 7048	3936	cmd.exe	124
PID 2900 wrote to memory of 1116	2900	KernelTweak.exe	125
PID 1116 wrote to memory of 5020	1116	cmd.exe	127
PID 2900 wrote to memory of 7080	2900	KernelTweak.exe	128
PID 7080 wrote to memory of 2596	7080	cmd.exe	130
PID 2900 wrote to memory of 3664	2900	KernelTweak.exe	131
PID 3664 wrote to memory of 716	3664	cmd.exe	133
PID 2900 wrote to memory of 3180	2900	KernelTweak.exe	134
PID 3180 wrote to memory of 2708	3180	cmd.exe	136
PID 2900 wrote to memory of 4720	2900	KernelTweak.exe	137
PID 4720 wrote to memory of 5812	4720	cmd.exe	139
PID 2900 wrote to memory of 5940	2900	KernelTweak.exe	144
PID 5940 wrote to memory of 5360	5940	cmd.exe	146
PID 2900 wrote to memory of 2532	2900	KernelTweak.exe	147
PID 2532 wrote to memory of 6584	2532	cmd.exe	149
PID 2900 wrote to memory of 5160	2900	KernelTweak.exe	150
PID 5160 wrote to memory of 6068	5160	cmd.exe	152
PID 2900 wrote to memory of 2784	2900	KernelTweak.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/osmj7R
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b8,0x7fffce58c188,0x7fffce58c194,0x7fffce58c1a0
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,3067622663470761060,621871438353026563,262144 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,425325622435855423,15770370431156001530,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,5032158406124090169,12694913769283794226,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,13083017233346468038,5819340234886063968,2097152 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,8957938382066796598,8386269291544229668,2097152 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:6580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5128,i,15468147500427458755,3069390885490234787,2097152 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,905407334789791608,13489428578385433545,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,16783530364693279585,7963430549411812408,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:6412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,10240686111589155348,13986979356134613598,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,10240686111589155348,13986979356134613598,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6220,i,12901841563030908896,15940003226407229187,2097152 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,10506720395940642303,9946351418811650282,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6632,i,1679736945917506860,3518679295714913307,2097152 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,15922347140060002749,12118355462331801193,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6452,i,12359338292590726924,11229804262735160888,2097152 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,14956022819103887614,11517189373632689398,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:6780
- C:\Users\Admin\Downloads\KernelTweak Setup 1.0.0.exe
  "C:\Users\Admin\Downloads\KernelTweak Setup 1.0.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,14535090649442197413,7753969783168801951,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,6320754648041840906,913503816242934356,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,7315621907778872849,3437723395606994967,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,9859334727192822534,11638932482522848312,524288 --field-trial-handle=2040,i,8707728274551359771,11639742606202407938,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:6448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:796

C:\Program Files\KernelTweak\KernelTweak.exe
"C:\Program Files\KernelTweak\KernelTweak.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files\KernelTweak\KernelTweak.exe
  "C:\Program Files\KernelTweak\KernelTweak.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\KernelTweak" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1688,i,11860819605138710016,15666375057683775336,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5780
- C:\Program Files\KernelTweak\KernelTweak.exe
  "C:\Program Files\KernelTweak\KernelTweak.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\KernelTweak" --field-trial-handle=2096,i,11860819605138710016,15666375057683775336,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5936
- C:\Program Files\KernelTweak\KernelTweak.exe
  "C:\Program Files\KernelTweak\KernelTweak.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\KernelTweak" --app-user-model-id=KernelTweak --app-path="C:\Program Files\KernelTweak\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2304,i,11860819605138710016,15666375057683775336,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:7048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $os = Get-CimInstance Win32_OperatingSystem $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $gpu = Get-CimInstance Win32_VideoController | Select-Object -First 1 $uptime = (Get-Date) - $os.LastBootUpTime $powerPlan = powercfg /getactivescheme $gameMode = (Get-ItemProperty -Path \"HKCU:\Software\Microsoft\GameBar\" -Name \"AllowAutoGameMode\" -ErrorAction SilentlyContinue).AllowAutoGameMode $hags = (Get-ItemProperty -Path \"HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\" -Name \"HwSchMode\" -ErrorAction SilentlyContinue).HwSchMode $memComp = (Get-ItemProperty -Path \"HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\" -Name \"EnableCompression\" -ErrorAction SilentlyContinue).EnableCompression @{ osVersion = $os.Version osBuild = $os.BuildNumber cpuModel = $cpu.Name cpuCores = $cpu.NumberOfCores cpuArchitecture = $cpu.Architecture totalRamGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) totalDiskGB = [math]::Round($disk.Size / 1GB, 1) freeDiskGB = [math]::Round($disk.FreeSpace / 1GB, 1) gpuModel = $gpu.Name systemUptime = \"$($uptime.Days)d $($uptime.Hours)h $($uptime.Minutes)m\" windowsEdition = $os.Caption dotNetVersion = (Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" -Name \"Release\" -ErrorAction SilentlyContinue).Release powerPlan = \"$powerPlan\" gameMode = if ($gameMode -eq 1) { $true } else { $false } hagsEnabled = if ($hags -eq 2) { $true } else { $false } memoryCompression = if ($memComp -eq 1) { $true } else { $false } virtualizationEnabled = (Get-CimInstance Win32_ComputerSystem).HypervisorPresent } | ConvertTo-Json -Compress""
  2⤵
  - Power Settings
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Quick Optimize' -RestorePointType MODIFY_SETTINGS""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Quick Optimize' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:5148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:5816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:3752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:4328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Optimize All' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:6152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Optimize All' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Empty Standby Memory' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:6404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Empty Standby Memory' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Write-Host \"Emptying standby memory...\"; [System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi([System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi([System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi([System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi(\"\")))) | Out-Null; [System.GC]::Collect(); [System.GC]::WaitForPendingFinalizers(); Write-Host \"Done\"""
  2⤵
  PID:4924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Write-Host \"Emptying standby memory...\"; [System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi([System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi([System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi([System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocAnsi(\"\")))) | Out-Null; [System.GC]::Collect(); [System.GC]::WaitForPendingFinalizers(); Write-Host \"Done\""
    3⤵
    PID:6700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-Process | ForEach-Object { try { [System.Diagnostics.Process]::GetProcessById($_.Id).Refresh() } catch {} }; [System.GC]::Collect(); [System.GC]::WaitForPendingFinalizers(); Write-Host \"Standby memory emptied\"""
  2⤵
  PID:2128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-Process | ForEach-Object { try { [System.Diagnostics.Process]::GetProcessById($_.Id).Refresh() } catch {} }; [System.GC]::Collect(); [System.GC]::WaitForPendingFinalizers(); Write-Host \"Standby memory emptied\""
    3⤵
    PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:3784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:6912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Clear Temporary Files' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:2308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Clear Temporary Files' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:1508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Remove-Item -Path \"$env:TEMP\*\" -Recurse -Force -ErrorAction SilentlyContinue; Remove-Item -Path \"$env:WINDIR\Temp\*\" -Recurse -Force -ErrorAction SilentlyContinue; Remove-Item -Path \"$env:LOCALAPPDATA\Temp\*\" -Recurse -Force -ErrorAction SilentlyContinue; Write-Host \"Temporary files cleared\"""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Remove-Item -Path \"$env:TEMP\*\" -Recurse -Force -ErrorAction SilentlyContinue; Remove-Item -Path \"$env:WINDIR\Temp\*\" -Recurse -Force -ErrorAction SilentlyContinue; Remove-Item -Path \"$env:LOCALAPPDATA\Temp\*\" -Recurse -Force -ErrorAction SilentlyContinue; Write-Host \"Temporary files cleared\""
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Ultimate Performance Plan' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:3908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Ultimate Performance Plan' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:1264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61""
  2⤵
  - Power Settings
  PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61"
    3⤵
    - Power Settings
    PID:6368
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      Power Settings
      PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg /setactive e9a42b02-d5df-448d-aa00-03f14749eb61""
  2⤵
  - Power Settings
  PID:2028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg /setactive e9a42b02-d5df-448d-aa00-03f14749eb61"
    3⤵
    - Power Settings
    PID:3612
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /setactive e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      Power Settings
      PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable CPU Throttling' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable CPU Throttling' -RestorePointType MODIFY_SETTINGS"
    3⤵
    PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:2336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 100; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 100; powercfg /setactive SCHEME_CURRENT""
  2⤵
  - Power Settings
  PID:6276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 100; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 100; powercfg /setactive SCHEME_CURRENT"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Power Settings
    PID:3260
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 100
      4⤵
      Power Settings
      PID:4452
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 100
      4⤵
      Power Settings
      PID:4292
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT
      4⤵
      Power Settings
      PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:1724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Optimize CPU Scheduler' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Optimize CPU Scheduler' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -ErrorAction SilentlyContinue).Win32PrioritySeparation""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -ErrorAction SilentlyContinue).Win32PrioritySeparation"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -Value 38 -Type DWord -Force""
  2⤵
  PID:6600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -Value 38 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Enable Game Mode' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Enable Game Mode' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:4844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\GameBar' -Name 'AllowAutoGameMode' -ErrorAction SilentlyContinue).AllowAutoGameMode""
  2⤵
  PID:4368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\GameBar' -Name 'AllowAutoGameMode' -ErrorAction SilentlyContinue).AllowAutoGameMode"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\GameBar' -Name 'AllowAutoGameMode' -Value 1 -Type DWord -Force""
  2⤵
  PID:2880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\GameBar' -Name 'AllowAutoGameMode' -Value 1 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Hardware Accelerated GPU Scheduling' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:6316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Hardware Accelerated GPU Scheduling' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:5792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'HwSchMode' -ErrorAction SilentlyContinue).HwSchMode""
  2⤵
  PID:2440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'HwSchMode' -ErrorAction SilentlyContinue).HwSchMode"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'HwSchMode' -Value 2 -Type DWord -Force""
  2⤵
  PID:4564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'HwSchMode' -Value 2 -Type DWord -Force"
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Game DVR' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:2236
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Game DVR' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:5360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:3500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\System\GameConfigStore' -Name 'GameDVR_Enabled' -ErrorAction SilentlyContinue).GameDVR_Enabled""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\System\GameConfigStore' -Name 'GameDVR_Enabled' -ErrorAction SilentlyContinue).GameDVR_Enabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\System\GameConfigStore' -Name 'GameDVR_Enabled' -Value 0 -Type DWord -Force""
  2⤵
  PID:5732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\System\GameConfigStore' -Name 'GameDVR_Enabled' -Value 0 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Hyper-V' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:5924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Hyper-V' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:6812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "bcdedit /set hypervisorlaunchtype off""
  2⤵
  PID:5672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "bcdedit /set hypervisorlaunchtype off"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2668
  - - C:\Windows\system32\bcdedit.exe
      "C:\Windows\system32\bcdedit.exe" /set hypervisorlaunchtype off
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "bcdedit /set vsmlaunchtype off""
  2⤵
  PID:404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "bcdedit /set vsmlaunchtype off"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4992
  - - C:\Windows\system32\bcdedit.exe
      "C:\Windows\system32\bcdedit.exe" /set vsmlaunchtype off
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Enable X2APIC' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Enable X2APIC' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:2988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "bcdedit /set x2apicpolicy enable""
  2⤵
  PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "bcdedit /set x2apicpolicy enable"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2640
  - - C:\Windows\system32\bcdedit.exe
      "C:\Windows\system32\bcdedit.exe" /set x2apicpolicy enable
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - TDR Delay (Extended)' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:5204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - TDR Delay (Extended)' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:6304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SOFTWARE\Microsoft\DirectDraw' -Force -ErrorAction SilentlyContinue | Out-Null""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SOFTWARE\Microsoft\DirectDraw' -Force -ErrorAction SilentlyContinue | Out-Null"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Force -ErrorAction SilentlyContinue | Out-Null""
  2⤵
  PID:1656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Force -ErrorAction SilentlyContinue | Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\DirectDraw' -Name 'EmulationOnly' -ErrorAction SilentlyContinue).EmulationOnly""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\DirectDraw' -Name 'EmulationOnly' -ErrorAction SilentlyContinue).EmulationOnly"
    3⤵
    PID:6372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\DirectDraw' -Name 'EmulationOnly' -Value 0 -Type DWord -Force""
  2⤵
  PID:1652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\DirectDraw' -Name 'EmulationOnly' -Value 0 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDelay' -ErrorAction SilentlyContinue).TdrDelay""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDelay' -ErrorAction SilentlyContinue).TdrDelay"
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDelay' -Value 8 -Type DWord -Force""
  2⤵
  PID:2560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDelay' -Value 8 -Type DWord -Force"
    3⤵
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDdiDelay' -ErrorAction SilentlyContinue).TdrDdiDelay""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDdiDelay' -ErrorAction SilentlyContinue).TdrDdiDelay"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:6540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:2804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDdiDelay' -Value 8 -Type DWord -Force""
  2⤵
  PID:5708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers' -Name 'TdrDdiDelay' -Value 8 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - High GPU Priority' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - High GPU Priority' -RestorePointType MODIFY_SETTINGS"
    3⤵
    PID:6416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:7004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:6696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -ErrorAction SilentlyContinue).Win32PrioritySeparation""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -ErrorAction SilentlyContinue).Win32PrioritySeparation"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:6808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -Value 38 -Type DWord -Force""
  2⤵
  PID:4216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' -Name 'Win32PrioritySeparation' -Value 38 -Type DWord -Force"
    3⤵
    PID:800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'GPU Priority' -ErrorAction SilentlyContinue).GPU Priority""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'GPU Priority' -ErrorAction SilentlyContinue).GPU Priority"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'GPU Priority' -Value 8 -Type DWord -Force""
  2⤵
  PID:6652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'GPU Priority' -Value 8 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:4880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Priority' -ErrorAction SilentlyContinue).Priority""
  2⤵
  PID:592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Priority' -ErrorAction SilentlyContinue).Priority"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Priority' -Value 6 -Type DWord -Force""
  2⤵
  PID:3368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Priority' -Value 6 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Scheduling Category' -ErrorAction SilentlyContinue).Scheduling Category""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Scheduling Category' -ErrorAction SilentlyContinue).Scheduling Category"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Scheduling Category' -Value 'High' -Type String -Force""
  2⤵
  PID:5828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games' -Name 'Scheduling Category' -Value 'High' -Type String -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Fault Tolerant Heap' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Fault Tolerant Heap' -RestorePointType MODIFY_SETTINGS"
    3⤵
    PID:800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:5848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:6264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\FTH' -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled""
  2⤵
  PID:6460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\FTH' -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\FTH' -Name 'Enabled' -Value 0 -Type DWord -Force""
  2⤵
  PID:3124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\FTH' -Name 'Enabled' -Value 0 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Paging Executive' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:2628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Paging Executive' -RestorePointType MODIFY_SETTINGS"
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'DisablePagingExecutive' -ErrorAction SilentlyContinue).DisablePagingExecutive""
  2⤵
  PID:6836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'DisablePagingExecutive' -ErrorAction SilentlyContinue).DisablePagingExecutive"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:7036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'DisablePagingExecutive' -Value 1 -Type DWord -Force""
  2⤵
  PID:4808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'DisablePagingExecutive' -Value 1 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Increase Pool Usage Limit' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:3820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Increase Pool Usage Limit' -RestorePointType MODIFY_SETTINGS"
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:6768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'PoolUsageMaximum' -ErrorAction SilentlyContinue).PoolUsageMaximum""
  2⤵
  PID:1848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'PoolUsageMaximum' -ErrorAction SilentlyContinue).PoolUsageMaximum"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'PoolUsageMaximum' -Value 80 -Type DWord -Force""
  2⤵
  PID:3176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'PoolUsageMaximum' -Value 80 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - NTFS Memory Usage (Max)' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - NTFS Memory Usage (Max)' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'NTFS Memory Usage' -ErrorAction SilentlyContinue).NTFS Memory Usage""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:7152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'NTFS Memory Usage' -ErrorAction SilentlyContinue).NTFS Memory Usage"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'NTFS Memory Usage' -Value 2 -Type DWord -Force""
  2⤵
  PID:916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'NTFS Memory Usage' -Value 2 -Type DWord -Force"
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:5312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable C-States' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:4452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable C-States' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:3680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR IDLEDISABLED 1; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR IDLEDISABLED 1; powercfg /setactive SCHEME_CURRENT""
  2⤵
  - Power Settings
  PID:6800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR IDLEDISABLED 1; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR IDLEDISABLED 1; powercfg /setactive SCHEME_CURRENT"
    3⤵
    - Power Settings
    PID:3328
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR IDLEDISABLED 1
      4⤵
      Power Settings
      PID:908
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR IDLEDISABLED 1
      4⤵
      Power Settings
      PID:2316
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT
      4⤵
      Power Settings
      PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Core Parking' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:4716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Core Parking' -RestorePointType MODIFY_SETTINGS"
    3⤵
    PID:6264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:7048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 100; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 100; powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMAXCORES 100; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMAXCORES 100; powercfg /setactive SCHEME_CURRENT""
  2⤵
  - Power Settings
  PID:2584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 100; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 100; powercfg -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMAXCORES 100; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMAXCORES 100; powercfg /setactive SCHEME_CURRENT"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Power Settings
    PID:5700
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 100
      4⤵
      Power Settings
      PID:1836
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMINCORES 100
      4⤵
      Power Settings
      PID:1860
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMAXCORES 100
      4⤵
      Power Settings
      PID:480
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR CPMAXCORES 100
      4⤵
      Power Settings
      PID:1772
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT
      4⤵
      Power Settings
      PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable PCIe ASPM' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:4864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable PCIe ASPM' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:5228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:4740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM OFF; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM OFF; powercfg /setactive SCHEME_CURRENT""
  2⤵
  - Power Settings
  PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "powercfg -setacvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM OFF; powercfg -setdcvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM OFF; powercfg /setactive SCHEME_CURRENT"
    3⤵
    - Power Settings
    PID:4752
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setacvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM OFF
      4⤵
      Power Settings
      PID:6700
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" -setdcvalueindex SCHEME_CURRENT SUB_PCIEXPRESS ASPM OFF
      4⤵
      Power Settings
      PID:4296
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT
      4⤵
      Power Settings
      PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Power Throttling' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:3816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Power Throttling' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:1404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerThrottling' -Name 'PowerThrottlingOff' -ErrorAction SilentlyContinue).PowerThrottlingOff""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerThrottling' -Name 'PowerThrottlingOff' -ErrorAction SilentlyContinue).PowerThrottlingOff"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerThrottling' -Name 'PowerThrottlingOff' -Value 1 -Type DWord -Force""
  2⤵
  PID:6964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerThrottling' -Name 'PowerThrottlingOff' -Value 1 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable USB Selective Suspend' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:5680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable USB Selective Suspend' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:1472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:5996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\USB\Parameters' -Name 'DisableSelectiveSuspend' -ErrorAction SilentlyContinue).DisableSelectiveSuspend""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\USB\Parameters' -Name 'DisableSelectiveSuspend' -ErrorAction SilentlyContinue).DisableSelectiveSuspend"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\USB\Parameters' -Name 'DisableSelectiveSuspend' -Value 1 -Type DWord -Force""
  2⤵
  PID:1888
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\USB\Parameters' -Name 'DisableSelectiveSuspend' -Value 1 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisableUSBSuspension' -ErrorAction SilentlyContinue).DisableUSBSuspension""
  2⤵
  PID:5712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisableUSBSuspension' -ErrorAction SilentlyContinue).DisableUSBSuspension"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisableUSBSuspension' -Value 1 -Type DWord -Force""
  2⤵
  PID:5948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisableUSBSuspension' -Value 1 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable USB Controller Power Mgmt' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable USB Controller Power Mgmt' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:7048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $controllers = Get-CimInstance -ClassName Win32_USBController foreach ($ctrl in $controllers) { $path = \"HKLM:\SYSTEM\CurrentControlSet\Enum\\" + $ctrl.PNPDeviceID.replace(\"\\\", \"\\") + \"\Device Parameters\" try { if ($true) { Set-ItemProperty -Path $path -Name \"EnhancedPowerManagementEnabled\" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue Set-ItemProperty -Path $path -Name \"AllowIdleIrpInD3\" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue Set-ItemProperty -Path $path -Name \"DeviceSelectiveSuspended\" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } else { Remove-ItemProperty -Path $path -Name \"EnhancedPowerManagementEnabled\" -ErrorAction SilentlyContinue Remove-ItemProperty -Path $path -Name \"AllowIdleIrpInD3\" -ErrorAction SilentlyContinue Remove-ItemProperty -Path $path -Name \"DeviceSelectiveSuspended\" -ErrorAction SilentlyContinue } } catch {} } Write-Host \"USB controller power settings updated\" ""
  2⤵
  PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Flush DNS Cache' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:5884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Flush DNS Cache' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:5328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "ipconfig /flushdns""
  2⤵
  PID:5540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "ipconfig /flushdns"
    3⤵
    PID:6628
  - - C:\Windows\system32\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /flushdns
      4⤵
      Gathers network information
      PID:6500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Reset TCP/IP Stack' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:3916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Reset TCP/IP Stack' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:1496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:7100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "netsh int ip reset; netsh int ipv6 reset""
  2⤵
  PID:1808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "netsh int ip reset; netsh int ipv6 reset"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6824
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" int ip reset
      4⤵
      PID:6668
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" int ipv6 reset
      4⤵
      PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $bootTime = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime $uptime = (Get-Date) - $bootTime $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $startupApps = (Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -ErrorAction SilentlyContinue).PSObject.Properties.Count + (Get-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -ErrorAction SilentlyContinue).PSObject.Properties.Count $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ timestamp = (Get-Date -Format \"yyyy-MM-dd HH:mm:ss\") bootTimeSeconds = [math]::Round($uptime.TotalSeconds, 0) cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedMB = [math]::Round($usedMem, 0) diskUsagePercent = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) startupPrograms = $startupApps runningServices = (Get-Service | Where-Object { $_.Status -eq \"Running\" }).Count } | ConvertTo-Json | ConvertTo-Json -Compress""
  2⤵
  PID:1456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Reset Winsock' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:6916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Reset Winsock' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:3440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "netsh winsock reset""
  2⤵
  PID:5124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "netsh winsock reset"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2684
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" winsock reset
      4⤵
      PID:1008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:7100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Telemetry' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:7032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Telemetry' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name 'AllowTelemetry' -ErrorAction SilentlyContinue).AllowTelemetry""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name 'AllowTelemetry' -ErrorAction SilentlyContinue).AllowTelemetry"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $bootTime = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime $uptime = (Get-Date) - $bootTime $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $startupApps = (Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -ErrorAction SilentlyContinue).PSObject.Properties.Count + (Get-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -ErrorAction SilentlyContinue).PSObject.Properties.Count $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ timestamp = (Get-Date -Format \"yyyy-MM-dd HH:mm:ss\") bootTimeSeconds = [math]::Round($uptime.TotalSeconds, 0) cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedMB = [math]::Round($usedMem, 0) diskUsagePercent = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) startupPrograms = $startupApps runningServices = (Get-Service | Where-Object { $_.Status -eq \"Running\" }).Count } | ConvertTo-Json | ConvertTo-Json -Compress""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name 'AllowTelemetry' -Value 0 -Type DWord -Force""
  2⤵
  PID:2104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name 'AllowTelemetry' -Value 0 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' -Name 'AllowTelemetry' -ErrorAction SilentlyContinue).AllowTelemetry""
  2⤵
  PID:5600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' -Name 'AllowTelemetry' -ErrorAction SilentlyContinue).AllowTelemetry"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' -Name 'AllowTelemetry' -Value 0 -Type DWord -Force""
  2⤵
  PID:6852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' -Name 'AllowTelemetry' -Value 0 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Advertising ID' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:5152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Advertising ID' -RestorePointType MODIFY_SETTINGS"
    3⤵
    PID:6224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:3444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:6268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $bootTime = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime $uptime = (Get-Date) - $bootTime $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $startupApps = (Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -ErrorAction SilentlyContinue).PSObject.Properties.Count + (Get-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -ErrorAction SilentlyContinue).PSObject.Properties.Count $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ timestamp = (Get-Date -Format \"yyyy-MM-dd HH:mm:ss\") bootTimeSeconds = [math]::Round($uptime.TotalSeconds, 0) cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedMB = [math]::Round($usedMem, 0) diskUsagePercent = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) startupPrograms = $startupApps runningServices = (Get-Service | Where-Object { $_.Status -eq \"Running\" }).Count } | ConvertTo-Json | ConvertTo-Json -Compress""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:1816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:6876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' -Name 'Enabled' -Value 0 -Type DWord -Force""
  2⤵
  PID:6780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo' -Name 'Enabled' -Value 0 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Background Apps' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:1728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Background Apps' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:5668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:7148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' -Name 'GlobalUserDisabled' -ErrorAction SilentlyContinue).GlobalUserDisabled""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' -Name 'GlobalUserDisabled' -ErrorAction SilentlyContinue).GlobalUserDisabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:1312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' -Name 'GlobalUserDisabled' -Value 1 -Type DWord -Force""
  2⤵
  PID:6560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' -Name 'GlobalUserDisabled' -Value 1 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable OneDrive' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:2768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable OneDrive' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:6804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' -Force -ErrorAction SilentlyContinue | Out-Null""
  2⤵
  PID:3020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' -Force -ErrorAction SilentlyContinue | Out-Null"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' -Name 'DisableFileSyncNGSC' -ErrorAction SilentlyContinue).DisableFileSyncNGSC""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' -Name 'DisableFileSyncNGSC' -ErrorAction SilentlyContinue).DisableFileSyncNGSC"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' -Name 'DisableFileSyncNGSC' -Value 1 -Type DWord -Force""
  2⤵
  PID:2284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive' -Name 'DisableFileSyncNGSC' -Value 1 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:7108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Stop-Process -Name \"OneDrive\" -Force -ErrorAction SilentlyContinue; $taskkill = Start-Process -FilePath \"$env:SYSTEMROOT\System32\taskkill.exe\" -ArgumentList \"/f /im OneDrive.exe\" -NoNewWindow -Wait -PassThru -ErrorAction SilentlyContinue; Write-Host \"OneDrive process stopped\"""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Stop-Process -Name \"OneDrive\" -Force -ErrorAction SilentlyContinue; $taskkill = Start-Process -FilePath \"$env:SYSTEMROOT\System32\taskkill.exe\" -ArgumentList \"/f /im OneDrive.exe\" -NoNewWindow -Wait -PassThru -ErrorAction SilentlyContinue; Write-Host \"OneDrive process stopped\""
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1384
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im OneDrive.exe
      4⤵
      Kills process with taskkill
      PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Cortana' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:2992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Cortana' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:4624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' -Force -ErrorAction SilentlyContinue | Out-Null""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' -Force -ErrorAction SilentlyContinue | Out-Null"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' -Name 'AllowCortana' -ErrorAction SilentlyContinue).AllowCortana""
  2⤵
  PID:4296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' -Name 'AllowCortana' -ErrorAction SilentlyContinue).AllowCortana"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' -Name 'AllowCortana' -Value 0 -Type DWord -Force""
  2⤵
  PID:6372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search' -Name 'AllowCortana' -Value 0 -Type DWord -Force"
    3⤵
    PID:6288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Personalization\Settings' -Name 'AcceptedPrivacyPolicy' -ErrorAction SilentlyContinue).AcceptedPrivacyPolicy""
  2⤵
  PID:2108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Personalization\Settings' -Name 'AcceptedPrivacyPolicy' -ErrorAction SilentlyContinue).AcceptedPrivacyPolicy"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Personalization\Settings' -Name 'AcceptedPrivacyPolicy' -Value 0 -Type DWord -Force""
  2⤵
  PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Personalization\Settings' -Name 'AcceptedPrivacyPolicy' -Value 0 -Type DWord -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Telemetry Tasks' -RestorePointType MODIFY_SETTINGS""
  2⤵
  PID:7060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Checkpoint-Computer -Description 'KernelTweak - Disable Telemetry Tasks' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  PID:6832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser' -ErrorAction SilentlyContinue""
  2⤵
  PID:2648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser' -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Application Experience\ProgramDataUpdater' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Application Experience\ProgramDataUpdater' -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:6440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Application Experience\StartupAppTask' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Application Experience\StartupAppTask' -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\Consolidator' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\Consolidator' -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:5468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip' -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask' -ErrorAction SilentlyContinue"
    3⤵
    PID:3912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector' -ErrorAction SilentlyContinue"
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:3692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:6896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Feedback\Siuf\DmClient' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Feedback\Siuf\DmClient' -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload' -ErrorAction SilentlyContinue""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Disable-ScheduledTask -TaskName '\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload' -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | Where-Object { $_.DeviceID -eq \"C:\" } $usedMem = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory $perfData = Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation | Where-Object { $_.Name -eq \"_Total\" } @{ cpuUsage = [math]::Round($perfData.PercentProcessorTime, 1) ramUsage = [math]::Round(($usedMem / $os.TotalVisibleMemorySize) * 100, 1) ramUsedGB = [math]::Round($usedMem / 1MB, 1) ramTotalGB = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1) diskUsage = [math]::Round((($disk.Size - $disk.FreeSpace) / $disk.Size) * 100, 1) gpuUsage = 0 gpuTemp = 0 networkSent = 0 networkReceived = 0 } | ConvertTo-Json -Compress""
  2⤵
  PID:5852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "
    3⤵
    PID:1732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5208

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

KernelTweak.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KernelTweak.lnk
Size 1KB
SHA256 36b2cbb8a3be852c6939d8bfd3d6c05dcc470f3df4279b4ea9541db2ad96429a
MD5 fa5b8a4efb185e5b11236faa4595ba5d
SHA1 1c1c6fcfe0c8a67f571612196ad646f38b8ac126
SHA512 c4e17d8662f4f6806eb3b05c8ca5297fb79f549627fa2fec2d19707fb9405443b9ce537dd846baf1b815824f5756b620e591c63516e1ff32987b31ab856645a3
TLSH
T17D418E240BE92B59F3735F72EFB67661413DBC00A226435F0988438418B4560CA1EF7B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0a90799b5c8b5e112ddc8028bfe69bd9535c775f86f685a746bbc7b23872c63a
MD5 71f00f9205f014efa7e123ea16f21eb8
SHA1 99ee337bc293d4ef50c21235aee1fb0e649f7f50
SHA512 313cd3e2461a6515d5954a619783bb2a77a52aabda537229df6f4ad9ef165e669b4e88241018ef641ff4d957c7aead58114db0865659c4ae6bb7c5340e360955
SSDEEP 96:6Z2r/5cr/eb+rgs8IuryzHrWQOPrZLQTQY6Avt1MkPUwruSj+ewVhESOMbM8eg7j:w2rxcrmb+rgxIuryzHrWtjpQTQY6AvtC
TLSH
T13E813CBF6E9A2DA9F7653DF410D358A8FFF0A89245272F2D4844D0F4D84A3285AC2167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e8c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e8c5.TMP
Size 3KB
SHA256 6a9f677faa2c3cc9e7565e42bed9c3abed08fa52ccc3dcb9814d4e1a8ff87549
MD5 3dbc636905414f05d87f3a8ce146cf48
SHA1 05a22f2dc8cb0d81dd8f31457cb66d673c1be407
SHA512 52eebcf4b8f6f1630b3045a08efeefc6294f29202e1b0c31c09860bf9a7268893961f7144517ab76aa6edc7bcc4e5a2c6c29d2d9ba429e827b53a1f056324516
TLSH
T1CD61297F6D922C29F7A53DF414D25CA8FFE0A896497B2F1E8C84D0F4C84A3289B41063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78c30121-a37d-431b-b270-fa0658bd622a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\78c30121-a37d-431b-b270-fa0658bd622a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f0f78a57f8b4580527e147b5f5fff84fc5e585177e0d196e97708bbaf9d95648
MD5 4cc98f1bddf5e7eca16217e75445a3e8
SHA1 a5d23cf4a6485bba94e0c970f8f1072fc76d9b03
SHA512 5cdb4fd3859b8701a0cc2c4fa227f31a76431b4ddc2d15a571de27f9f5756b7fc6a2f1c43bfbc5fe00819636199a56eca92d83aa0c063e7a2412868f3cbf8be2
TLSH
T16F51BEF783F8856DDA1196F0AA146E2BCE1C0515832C7D6AC9E09E1BA3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1d5abd9f89d57d1e8382b00dfe8619c85a79fffc4f636046228af2cfeba98e6e
MD5 cb0676f20e52d04deb097a7765de5853
SHA1 3d94cd0a472c063f22d0a53b59da58cedba1ec2f
SHA512 a36029fb5c79a8d003c9ea6ab43b01a8d126e7adc1657eeacad9482feb93fd01eb874b62bd0ab18befdb0dd97144d3608144de66275bc407163a366a14f05e2d
SSDEEP 192:sxRGRByMqZjK1Ml8wo6/fksX7ulENfZ2xrOplzoA8pWlX/g6+WNMFa/YgsmfQiDW:sxRGiO6/fksX7uiBaeIM/5P/1osXljI
TLSH
T13B62DA166538593BCCCBD219FA95BBA3D6F90573A2905E04AAFC8B0C01E76DD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5c203361c1c38b7404d561a03038821f91a246ce4868548c52aedd17bf03f6ee
MD5 52080ed276aaa4545d3a05449d7b04e0
SHA1 c294efe20788db51dd44d465fe3e14f6d40bad3f
SHA512 04a867b9bf2d56658c1cc435bad51529c3aa62c08ac51446b44351c8299c00af120c6ad42a496edc46da710e2bbbcef7b2bbaa1ddc0ea6cac172bbf662ba826e
SSDEEP 768:PRbgHsWgtVfwp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaUfYHroSzBf:PRbgHsWgtVfwpu1jaroYUSd
TLSH
T1A5C21D2B644CC77E4F844EACEC2AAE976DD802CB5B984D5447EE890C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ce9804e6bcb41decd92d4965fea0f97d753df9ff3a1adffba23f30c646b23f2b
MD5 77ba1431c7b40a145cc58baa7bd2f112
SHA1 c172c4c330d95e9ef605cddb6f3808704f4aab87
SHA512 22814e39f5bc3d64c2d74531c0f640665b4dc2fe16b5ac7b5ed4b8e323d44c08643bcdd8ad17447e4a9c67af250275202db551c6edd3277414bdca34651424ac
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/o:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBK
TLSH
T16CB27C5171BA2B00383D250E93B9881F5A46306230DEA96B7BA931E56F67F004FFD6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 65bac5f614a5154fcde203515616d18aeefe487e07987a5b1444ef7936db0dbc
MD5 82c075c6f7f80fa20d7ea3fb9a6b0e89
SHA1 81bb067eda95caa186a263f2fb99590de1ae93bc
SHA512 7eaf7d445c6f3719f284c293692df47abd98590c17fa0affda3c18c15da3ab6908098c9a8519825119eb3cca941349f5f2a50b83676e26542ecd6cc1083d0f52
SSDEEP 384:nGiF1tNn/s3n9S3j8Nc8TUNTUlIR40zOSEULPOfosG7cJah9jaeF1XbryPOOObj0:tF1j+9GBwg1EUQGQJah9OejHyPO29MDA
TLSH
T123D25B36EC94CE77ECE68BD5B74A3647EEE04267858C5AC8DAD85E4C01CB1ED030AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e1b8bae7e4d6ec356f785d5cfd7f40333b8b550aa859705c1a82a063dc9e727f
MD5 24c3f050e348085c1e36d168bc1db361
SHA1 4f8c8f792c26d6485d2f6e503d9944b5b823fbcf
SHA512 43254954152652633075989d97d21fa145c9436837af8fad4cd2cc329adec883fcf7253ba71af554167d95ffe23e8bebf230389a7800d8c83635fc634db1d5be
SSDEEP 384:n8iFWtNn/s3n9Sr8Nc8TUNTUlIRk0zIsSEULPOfosG7cJah9jaeF1XbryWOOObj0:nFWj+9GBwg6EUQGQJah9OejHyWO29MDA
TLSH
T19ED25B36EC94CE77ECE68BD5B74A3647EEE04267858C5AC8DADC5E4C01CB1AD430AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2bec4662929b619d744be0db5ca63a55c52ff39879d2349da6ff293e5acba400
MD5 eabf093b7f498eac50ef694aeae14e8b
SHA1 6aa149fd164d398356dbbfc88d48275f9f8636a6
SHA512 fe6e36c384341e3b491cb7240a83b50ae22aab95cdb431856a7300d0254ddb62449ecca65023b113f4949ec165a32d80dee13229266604d8bb73b4ee1c42fbd8
SSDEEP 384:nGiFQtNn/s3n9Sj8Nc8TUNTUlIRk0zP2SEULPOfosG7cJah9jaeF1XbryPOOObj0:tFQj+9mBwgVEUQGQJah9OejHyPO29MDA
TLSH
T10AD25B36EC94CE77ECE68BD5B74A3647EEE04267858C5AC8DADC5E4C01CB1AD430AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 98286013c7d09374f225dd420b6497c408a89eaea1dea03b0e6308be587b3763
MD5 4fe0612037df883a7b8d957d3b40d2f1
SHA1 0fdeab4cf4aec9570b32266ffaf8121de7bd3caf
SHA512 1dacc5f82d7cf02a5830fa52421d60f8245264e6178ef157dc11e183c6dde5bebe63ee082102e67b28ab4a8aeaffb7bde0355e49e93b543dff8b3689608e1fbe
SSDEEP 384:nniF1tNn/s3n9Sv8NC8TUNTUlIRAq0zvYAoPOfosG7cJah9jaeFYfmn15wbAjEJL:iF1j+9Sbwgm8AvGQJah9Oeafmn12bfJL
TLSH
T118C23936D858CE77ADE68FC9B74A7646EEE0016781DC5AD8DAD84E8C01C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b8c629ea8f89acdbc5ed04d2d180ee697b08af47fc3b41d752a5fd328d86fc44
MD5 5da3c2680e414e07d0ec1548987a7656
SHA1 f16e1cc492a176545d65436b33ab67412e30c3cc
SHA512 02863c59720adda2b179487f62271fd49d9d20c263691e6c99836695b827488ac536e5caa3952acfbb94070f652bc716edcc8e17c0bc67469a07156cf4336b46
SSDEEP 384:n8iFWtNn/s3n9SB8Nc8TUNTUlIRk0zIsS6tULPOfosG7cJah9jaeF1XbryXOOObo:nFWj+9ABwg6MUQGQJah9OejHyXO29MDA
TLSH
T167E2C3F298D78A77D89E4B87673E2E029AFCC157B5885A84B7D81D4CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b7d2ecc082c7fe8d939d3d6a7b128a70e60fd1e65219902359b3042d85f19f60
MD5 fb1ff22097c5763fce68ea452f7e1443
SHA1 df38dfbab1bd3a756afb576d20c628f5c76d6b72
SHA512 1035f9df6fb81fba8ff798017799aaf5121e459c153676778ce8508c709edc75cdbd906c45631a087cb3ae610a6bb92404ec952f531485b390951b9ce8e7de84
TLSH
T14B115733F3CC8664C89A413650CAAC1036B687DB509EDE9BBB84D155A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d92d529483d3340105c18086873cfbbc79ba2585fadb31c73c908545abc1f97c
MD5 3b20d8907f8fb0ef3fab55d52562262d
SHA1 ddb6693b9c25c3b647f7ab6f44715bef31577d49
SHA512 258d046884aa7d4d5f1dc90e617ba880c602d53bf576809be1dde22b9a886f6a0182b90a95eaf9904957b8dfa9c44f2620c520b93c9cb40a7d9dc73cec4ca6d3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_52nptble.xaa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_52nptble.xaa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\LICENSES.chromium.html
Size 9.0MB
SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
MD5 11ee9d008e924e19b33e0b45fdf145df
SHA1 140773241b15513e9d7a7aff4d1c1d8f7e0b7e41
SHA512 4acd065ffee81972fb1cfbe11507aab75c883aa94e359f3c455f87813925bb2d3416ce440561b430d6dedcc2f566d5cb74de139e181da68507ad36e69a672662
SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmf36k6T6W6r656+eGj/dBIp+:oABeGLp
TLSH
T15796A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\chrome_100_percent.pak
Size 148KB
SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
MD5 cb4f128469cd84711ed1c9c02212c7a8
SHA1 8ae60303be80b74163d5c4132de4a465a1eafc52
SHA512 0f0febe4ee321eb09d6a841fe3460d1f5b657b449058653111e7d0f7a9f36620b3d30369e367235948529409a6ce0ce625aede0c61b60926dec4d2c308306277
SSDEEP 3072:iz8JCGIdkwTPaNkx0auKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:iz81Idk8aqT5K18Gb0OV8ld0GecQ3Er2
TLSH
T1ADE3D0E773F4ED7DCAA756F7621600B1EDF3462D0691024A168ED8363A66B48DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\chrome_200_percent.pak
Size 223KB
SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
MD5 e9c1423fe5d139a4c88ba8b107573536
SHA1 46d3efe892044761f19844c4c4b8f9576f9ca43e
SHA512 abf8d4341c6de9c722168d0a9cf7d9bac5f491e1c9bedfe10b69096dcc2ef2cd08ff4d0e7c9b499c9d1f45fdb053eafc31add39d13c8287760f9304af0727bf4
SSDEEP 6144:3DQYajN6svyABnI86fTugx5GMRejnbdZnVE6YoppO4:cfjN6svyABOa6edhVELoXO4
TLSH
T1F124F1DB63F89D7DC9634AB3662601F1ECB2113955B6420B03DFEC357A95B8988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\ffmpeg.dll
Size 2.6MB
SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
TLSH
T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\libEGL.dll
Size 470KB
SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
MD5 b12e3c1e72935273492da1daee50eef1
SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
TLSH
T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\libGLESv2.dll
Size 7.7MB
SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
MD5 5082e41d7a57506fe6b4bd58f87276b4
SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
TLSH
T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\af.pak
Size 494KB
SHA256 e2470090a09ca500679e68bb5e3b1acc35a5873fea4f93af25a23c82122f2c13
MD5 e48860fe82ef022ffab38cbc4c96dffc
SHA1 a832fa66bfddabf3ae7f219cf379f66d2903162a
SHA512 e4d0973ca7e59091c482d2acc384aa48ec87d3ce72d8d42a03a183b230fd209e085a4e907473a05d02d41e15ebc527df942774c23b4804c150367fcd727af7b1
SSDEEP 12288:VoFfnK2L9o38a6qyC/GT3q+62+H2JynwaD4IJzio0vpI5gJ2aU+tBHr+21s9YqpQ:VoZK2L9osa6qV/Sa+62+H2JynwaD4IJS
TLSH
T124B41B06EB84273D09E07696FA0845B7FB9CA26CD770B2B6DD9D82360962EFC017D1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\am.pak
Size 800KB
SHA256 4e15946e86a578eeff41feda808bb291d81e240fbdfc96cbe2efe692ad35eef5
MD5 d6e8c344b2b40a9c671304f6f252d51b
SHA1 c59ddcaad921b6d2d3f70b7ab07026c35e5d1e08
SHA512 018ce2bf4beb4ce066703b2ac7413c6517759be68f889f27990de5d6694e9f84b4027f9861901ea4b15abdd1bb570e5a16651c935713feafc4d16cd57be0b911
SSDEEP 24576:bSTZhZyOqxlXGaj+WRezan5zYgMBgVTq+XG/6uUqPZx:bx52
TLSH
T1D005BA547EF9F7570F8E8A19A4310E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ar.pak
Size 874KB
SHA256 5cc02570e5f61cbca791309985df3a29584e41583b3344f1d9fb6b04ce423e6f
MD5 f6ca56d15814dd5afd5e7ff985257880
SHA1 ef236d7027cb50a188c1e771527e6628702311ea
SHA512 46c0436c110d6f1a8f3ebe962226c51af525228262cd56744e4d89aeb05d1eda614801a294bbfd2e08598e355750d7a2d200b3e7b594da03dd26ece4cdd31e3d
SSDEEP 12288:Fs7XCdUBjhU/l/RBcEX4YvPU5pbRkSO5QNpJQKDBAGd:MXtG55mQY
TLSH
T18C157AE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\bg.pak
Size 913KB
SHA256 97ef7984074775282b68dca5d5a469efdb2b22474ee6669fdfb5197d3f1b3768
MD5 e6608ecc589e87a6f78f9ce553ec2609
SHA1 9fdb2ff6291549df773ba243b3a92b984b15bdf6
SHA512 25450b23acc962be85977ef08be9b484c2a9127775039c521158c1801cd57d5781bcd8d5b8784f8a8b9403ce44b59964a20dbe36ce181f1d239143b22b53d5e2
SSDEEP 24576:7wCIvq65SLYazQkEC/UTVbOVHv373ZfM3aAKZyVDuZWlumpfd2yo5ybXFRoZQ8Eu:7wCIvq65SLYn+UTVbOVHv373ZE3adyVM
TLSH
T1111524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\bn.pak
Size 1.1MB
SHA256 1aba82aee8c985e5e370e7cf2b35c9ec20cbe5174db5fcb54ec7d19ec5d79587
MD5 57eab375114893a5ed0de36a516e8252
SHA1 16f23ab3eb62bc7a2525a7a5d86139fa88670b89
SHA512 895bc282484ed028f5f023cbbb6e2755091f036e540c531b6ff639cf9e0ae5da02801dc81d7910eb141edd5c255d8b088d1abb531b152fbb161d6c2bf9615f4f
SSDEEP 3072:8JwgtHnTLCGplsOmf9MCxQ6v2cq/jOxdCfYa6CHXk1cJrWBbY0QH5qYsqvA1:8SuHzsOmlMCxQG8HXycJrWBbs5Iqm
TLSH
T10245DE209C6E91B2A8C5CDC9434C6370C5236E9B9B61F74DDC17A25938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ca.pak
Size 556KB
SHA256 b3d5dfae25427596b1f14a8e13d6bcb58532c82554229c2367779ff5c42b28bb
MD5 7474c8e0c3285b97f1f12792964b6824
SHA1 8b9381be0754fc3df2f4f13f8575bd4abab90e9d
SHA512 4ad524fd530bfc72d72edf04ba4890e06ca0a20cc1d5c2c3d95cda746b1d884a62ec2d4463ad7be9cd01c7529b41bef65f9e669c62719808a83d3c70f9475d43
SSDEEP 12288:yMio0be7tREIDFCieke3Rj5PqF4N3Mw2juwHzejm0t3lvyb1TDn/RCHYwjcXI2lF:yPbqBosfRUFGiMNb5z75iUBaM
TLSH
T1A8C4F9239FC93B6744D2330AFB45C217E48CA9847B16D254F4AE1B1A22CCADCC677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\cs.pak
Size 572KB
SHA256 7d7b701ce510b2e4a18e957e500086db590aad8bf5acd37f82263a676f0b556c
MD5 582fde87aac61961e4f7955f16d31769
SHA1 3a8eb832317dd7e07efaaeeb5885c32b9d381622
SHA512 adb04ccce5471d80182f7ca73bf1a2e4ce63a4980d455837fb378bf679a0022d4ee6f9fbe148d6932fad83f458c76ac229229542092e0cb9b271c8d44639b11b
SSDEEP 6144:uoShiN4gvDM0eqcNRZhAy8B2ACnO58bCoMbdNOlfzSBlpByI8Q8:uxhKvDBdKnhAyQl58bCoMbdNOZzSnpBI
TLSH
T10CC4492EEEA36425488002487BBA4128BD5EC3540B2FB5BB6CCF9C95217577ACFF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\da.pak
Size 518KB
SHA256 3430c0f1946901dfa24190ca3989f72171ec564bc7c523853e6a1f531b61b5ee
MD5 5f8f09aa98ec3a4c8122d64c5bc6610e
SHA1 08a6dfaa3a11d8c994da90460e78ce0a4fcfb644
SHA512 9c643eb6415cad6aca0584d62211aed5ed21a0f8d71ac4f692bd420a4a190a9781add7c874d0f56bb5c1c0f65d543d932d0f50caf127e8d014c05d015ae61ca3
SSDEEP 6144:gHUinoklzVZs15uHV9D1se8KnwlQGyJwiVobR/0aHtG5VxvdetQid4YF7wv:Q1nuEVCKRWo5Vtdy8
TLSH
T1B6B45A4BDC9C732F89A94B65F3108EA7EB5D543CC684264F65D8943A09CFC6093BE2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\de.pak
Size 553KB
SHA256 662496eff49febbe49f0a03cf2c51acaa743cb2237de3c41014556e16f3d8e2b
MD5 d1a513308f9de55b6c7bbeef7c4fe90b
SHA1 a4a5e99fe73d5f9df2e508c3c8e9b73dea03a76d
SHA512 9756e16255976569584a3a5e2a17421a31bc8f9b158c0ad3d30f6fe624ecd0e77c255571e46554c03c54d58b06d3f7b0fc77d347548f435547eb1ed9173b30be
SSDEEP 12288:nXez9VW6+3K7UpygnaAgykt5RMDU/+/CO3:n4O6+3K7UpygnaAh45RMQWCO3
TLSH
T169C40703ADDF621EC78673607305CDB77B19E36BC346312A88EDD12B654B5B283AC526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\el.pak
Size 1001KB
SHA256 162e51bc7d682e223e498f4ff8c81f019d136d857bd25a1c982d4a1084a8c840
MD5 34c6150acccd20c7f260b269bce06930
SHA1 277b6d2387f600c84263847d6fb2342fd4746cfb
SHA512 58308b1f4f92f1eb26af8516351194b96defa8b40f26cca2776aeb9e804e585fdb9918bd2acb9c6318b63c3768c29893574bd0a4fc18fa9dee96b9112732ff94
SSDEEP 24576:0fYcaPdGgxh1hxFGiYX9wH8JXDsSLmqHB3D2Np6Wkj1m1mVT8yiRNQKPCt2rDQuV:WYcaPdGgxh1hxFGiYX9wH8JXDsSLmqHo
TLSH
T16D25CFEFB4582DED8046950785D8B07C6BC62D6CE749CBD86629CB60BDFC0718A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\en-GB.pak
Size 450KB
SHA256 7df934906a61c0ae7a952f9ed058f4a06cd3989663a7d9f50afc3c9f830135bb
MD5 56bdf77ab3487e28d354a8b0f9ba8d2e
SHA1 b10ee918320a50a417b1ee6a28cd4b05a5f77238
SHA512 8d74c79ba3a554d69f26fb8c20210c9a339d85c0e9a9af445901e8a5c7ea544ea6ec713f9dd2db7b8bb5cb0afb0fb385236d4668a73af37dc9ef8d2f73c57fcc
SSDEEP 6144:2zyvXgRSCd98ZxE+J1RMP9ePsHDfaYIx556S5xTxVBctRVod:9oRSCdaZxdRMwsHu95NxZd
TLSH
T129A43B1FF784226A069311727B09A6A2FF26D06CB35112667CBD802C33B6756C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\en-US.pak
Size 454KB
SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
MD5 5c52a86b21633b55b383c20f16859b2f
SHA1 126585e68cb17f241351004e21c1d30e65de1cf6
SHA512 2a1b6a4becfb97d470cd7de74857edf2cc9cd4a77f377ccd9bf60c30539862ff1ac3ed6cc849632a3ed4ea0e5b92679f3cc5b4cb26cc7eaaa2bb2f4ae9974a6a
SSDEEP 6144:4U0NFUyUGhhA/4miMP9e2qDWfaYe1Vcg5xdxOng5H/thTwB:4jIy1hhYiM9qDvn5zxZTwB
TLSH
T152A44C1FF7441229069352A27F09A5A2FF32D06CA35112567CBD812C33B6B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\es-419.pak
Size 547KB
SHA256 ec922f8ca16b7e7642fc73369ba7b75ec950cafb1dcadc6c88426c034382d483
MD5 15d1e262602e54d76de8bac02dada000
SHA1 54e93995675bcebc595befaed6b73c9ff5e6e735
SHA512 a232eb97021f17fde322697db2c00423cd70e9741772912c5f7a41849b35dcf3e2fe84001ff0a7902b2b54305d1f805f53988e421e192be0d5abd157bf8b5f1f
SSDEEP 6144:SGVG1UtiPz9gqpuYRwqro8U5zivZ+XYidR:aqiBpMq65ziB+FR
TLSH
T118C40922BAC81F5310E2A389B743D753E4989545F408C29BE8EB876562CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\es.pak
Size 547KB
SHA256 0385e6776de5a0d8a3b30b7bad44308ac4cb04e2bcebd573d3c7938b68036573
MD5 f90d43351ffdc63bcef25bf634c1fd35
SHA1 f80df8034cb64df1ef62e586891275a74868ab6c
SHA512 7bfa70a5de14652063d261c28ffd3df89ea5e38877cc7977ab27f7280c48084a4ab1e5bdad0c2f624a7434a5d975feb9d8d221c010e24963d3c42921f5a36e65
SSDEEP 6144:jXKFTiBFIeuyHYc1RDVFa7bg5H2p3+mc8uM53xnjJ5Jp2dCFaZ6PZcHu:7KFkY+xFRWp48uMDnjJ5H2gF0O
TLSH
T187C40722AACC1F6350E39389F743D753E8949585B408C29BD8EB876652CCF8CC967ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\et.pak
Size 497KB
SHA256 ba4ec85d2306a1f1f178a017fef4d340b77b33e10bbee07bd359a8e0ff8ea461
MD5 3cad945e9ae6e31cfe66c89365e5d353
SHA1 43758cb523d60d936b9a417123f337b8e123481c
SHA512 ac07e7f72b670a2e8b7a46a672fefedc58d9384d4773a6f220c231c619c1134613ff68c0ccb0dc9e03eb5f47dea7ac57de318af5f3f242d6be7ae43071e2d947
SSDEEP 6144:qICqnHGj1rurkyJ1HNR5oSPg+sy6/Fb0smFoLSdDWl/P5io50WxH5vMJRyiCKMLZ:q0He1KkQoWkPpmForMWxH5vMNW
TLSH
T147B43B42A27D771B582412F9E337AD23DC9EE7D8B4000D966C974A1970EEF8C38B6B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\fa.pak
Size 813KB
SHA256 f1a7351bf0d8cad475d2761b9edf970c3098836e38aa98106a5e04a41002b7c8
MD5 7851efacda8438c041c9a511f4097de2
SHA1 64cba381a17ef0ffae2dff5135d57fd1f9300ab1
SHA512 d94fb1d04630cc292296ad6033c6beed1a00dcd4c11eaca04a7eacb50c238269b21e4d2a4002836f4d41e0f6d951624beefc95beaae23530eccded4569ff1869
SSDEEP 24576:GfX8u313uyqoT+seq+LRmX1loTUOmdAQifaQ2XxFMJGk62YhwdrigHMX4qOzUrWS:Oe75dk
TLSH
T13D05C3956AAC9AB16747CA0341D33834C773EF12D34DFE40ACA1076609A5B139F5EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\fi.pak
Size 508KB
SHA256 11b0b9b0f74d01f16db7aa49be9dceeb55fde9da56f17419c4bca159cdcae274
MD5 6d7aaddb1365b3efee94d4c510a3002e
SHA1 2a970204894c5ac163c980ec0fac2dbd1711e5b5
SHA512 f44bab9cee552dddac17d4ac1949870943cf138b3fdb0e649e8827acb6de9528dd9cf738757e5b495587e165d1c750b8bcc6205bdd029a01eb92aecab22ba49f
SSDEEP 6144:hjtSFHk5y19uAA8r87LSzrFSrRUysLk+hOEcraV2LN5RwgUH06nIp0Wac9ondnHa:y5Gy19nAPWFIaW5RwgUU6nIp0Waq/jYM
TLSH
T17FB46D915219C22137C8D28E79B0903EF6E5E3DC8C284D96E847C7D849EE9887D7277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\fil.pak
Size 573KB
SHA256 d7fdc7fd08dcc421bc8aaae3fdc72599c60a3b96f05989a3e46736f0de06e745
MD5 c744b92c8feff1c026034f214da59aca
SHA1 95780d3374841efdbc0d8a46cddc46bb860a26e0
SHA512 eeefc73474642e75da61056f2841e7cfeb8d8475be55a39852dfe7de8a972f7d86e9d1df4614b3ca3ae4fb01b68e5ced664bc8e46ccfc94f44b06e29a5035b43
SSDEEP 6144:KoCySmeMLtmQ3zGvjQypDQFLCH2MYFGTdmb5SYw7jMoQcAsNqK:KcRmQjMcb547/
TLSH
T15AC4B715B7401748DBC352E51360682FAAE560BC3F82386E4FBF269B7BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\fr.pak
Size 591KB
SHA256 1f6cc56e04bcbd6b6ecbe500bcb0a5702551ec80d79e624642d0c7d9758d4424
MD5 79d945ef9b8ebc7d39fd03d05d9b2f27
SHA1 6fbcb748515f97056689d4a747e4df3a830fe049
SHA512 f1a26715ad9399052b664c71fb60b6eb6f965fa80d6d8d6c47e0b96ad0d4a4d2028c3e19dad49e008bbc29edc24e656777ce073da008d3f4dfdee4c8f2212a07
SSDEEP 12288:NFVbb5yhyjZLqyluvpTZF6QuaMVWXKzEtSlZsZFMYnYFfLR9ujzl4m8zxpJSWt6P:NTly/VUVg95Px
TLSH
T15FD4F75FADD432CB1AC21277FB12D663DD348248F216E340D89F4295129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\gu.pak
Size 1.1MB
SHA256 087e99953eef9b5fd736e3dbd98d702fdb01dc614593a4c575cb619159688118
MD5 e884bbc8ded4f5f059211fbbb85ed351
SHA1 8f4ecb45ca73902791ff5e56e0b272252c08508e
SHA512 50837daec40a2624097cf36dfd7beebba4db748fd9cc470bf71b526e612c1aa6c88ead7511ba751e370f6f5d28ad9d6338dcb3581d7e3d53e2672741915b952f
SSDEEP 3072:3E8kEz2sb3JSHbyAoIwjAwREJKVMjNiT7llj63rFulPCpMi5eWWiMJsW5U/GQoyj:3EqzTkl0jNl55qPhB1XFR
TLSH
T1FF4518D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\he.pak
Size 713KB
SHA256 20b1c80f8b2bd5130a1fb372814fb9c9ceac15305da3da0cb29923960a94a934
MD5 ad6af80367f0b5d408bbe2c7b32ade48
SHA1 9dd4e4e5a63e50e9d3715667b8149edd8d07a52c
SHA512 95df5ce7f7885d0e72b2d89e1794a3796a1ab407fb27174219db22c668f74a8c3ba1f680cbf990be533c35ca0b2136b1917c0cb92d4556e3ff2ef3447c55efbf
SSDEEP 12288:PY9uJ1Qh43XyfhR5ir+yc/XWqu/DK6oiAC7XbDeQCajL5n6ltE+t+hO5xNmm++nV:31PR5b+D
TLSH
T186F49AC4B2D452255231AAC39FA4FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\hi.pak
Size 1.2MB
SHA256 9c6d8d93278a6e375405142df9829adefbcc8ae9797a4f589591b9784b2b71c8
MD5 66ab509000cac52c805d6871ca6c1f25
SHA1 e3d3e7bacbcfaa7538ca89d9d26218eca06c01f1
SHA512 356642a19f044c6e192f658ca2bf8764431129cdf7c9891b5b5bf4e99f6b990a1428c1e483487b619865e7f2d31cb5c9bbb3b49ed25fa81c4374de3e8e65519b
SSDEEP 3072:8/exXUYA+bcr7In9GOcffQ3ZV/BB0ZV1dKuulRLiW3VTOEOTByntDPtDlYpRYs4I:8/exkZ1r7w9LcA48y5eKyhVy
TLSH
T19545060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3DB9844CB8046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\hr.pak
Size 551KB
SHA256 afed35643df24709c8c5cc9b8158b3d9a2266fbfeed132e98ff254ced4086c5f
MD5 1973723b9c45b9d971c97229e7a441cb
SHA1 2bfa4922bf2084486681af45cd7f7dedf95b2d66
SHA512 6a1f35435b01ab187cd93b376b76444dff575284632fbf37bf8b08e6cfe7783f985d0fad2425df3d3c332aad2278971412455a748e83c2d6fabd0f6afc3dc292
SSDEEP 6144:3Q4YHBQ47wMbxflwiXwu2hSwt+5jhYe35JMK:3Qlh5XtlwiXwuRwQ5dYAkK
TLSH
T131C42A7DBEB397090897A386EFA643447DBD08DCE52597BB684F532E0003F4D6AB8149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\hu.pak
Size 595KB
SHA256 b4e6a1135de8bdc42c04f4db4eb1ce48256f18eb46a5146a21010b6165a90e7a
MD5 2515bb367f56f282657b3dd3b9ffcbc3
SHA1 8cc350e359f1cfefdf0ce3b016109dd483d45a8e
SHA512 779a77b3380f08dfb1d1e9bd65806f3d5ab56619d040bd6ecc9726c17944f4d0c3a619edee06d638549250fbf4c6a2be46cd6196a3a8862d184a68d45d6f6d72
SSDEEP 6144:Fr5gRptZU80LM9rHs21fNAAbkit2V5RlVFZfpAaYGN2enVeWvRwnjDi54RYsR1tl:F29y/SAjV5RlV28HJd5kA7S
TLSH
T118D43B779376945AB8AC179778647F15492E481BEE3B26F72883886D30A078D0DC3CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\id.pak
Size 490KB
SHA256 a21f9474a19fe2d7f26c59f5ba8d6e72801a8a057b7dbcb8b3f96471043d9059
MD5 91bad2312491410c7f0393be512b895f
SHA1 6e4e9cc985c5b96eaaad91787f8bb7f72cddb604
SHA512 5c0e1cd1741e78fff90f3ec2be02bd47bfc669e50ad0cdde975238a74cb4081536faf80d0a28dc9fea6efda6548dcca4e569c54b903f5c2773c17f72000a99e7
SSDEEP 6144:9kLp+Sz0NKaVCGwlxDpuQgif+eVnjHFvTmiZIPk5V3pmwkK53vCqHi4pH7:C9z0N6BXDxgKVnjHFrm8Ic5V3pl7
TLSH
T18EB4F8632ECD310C4A4842D5B2CDAA1E7CCD233BAF05B76E8E748F7055A67682716BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\it.pak
Size 539KB
SHA256 33652aae78a486dc3ce4e5affd1b7f72e1248f6f9f3e62188afe3b5d73bd148e
MD5 591113bc491e5c388ee3876de4aab3a1
SHA1 a63c2a18eb92fd03445bd237a5755d557e1cb593
SHA512 66f1e79c9bf179f19942352258181858268a991b42d4a79747ca580df3fa219c2be71ab6597cec4ba7bd4c691a5e1328aa03a565b3eef442c6e2216f0d82653c
SSDEEP 6144:STnsPgjGeSTx92/Fzw6N8uESIqRRxsO1St7VjRT9TjeUaCnfxLUAppznw9fLwwXe:usONZf+lZiC8WZT91K8/51ZIw
TLSH
T13DC41B3AA5D621155A976359E221B045FBAEFCCCFE417218C99B431C23CFE40E2ADB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ja.pak
Size 659KB
SHA256 c5692ca739c31569ae2431fd58f1028e6c8c01af278b76656ee0bb65b79e9985
MD5 412bef3ec11f53c2aa6511ca139b1f35
SHA1 8b42655c2b62edc13c61a4625f55c961cefd1c49
SHA512 85760c2a0dd4404a2d41f0d957c9cf8962d6b80389df838cd2d85b6a31a54f4e50c5f19ee73d2ee66e3e61a8809aeb5b493e7170aceeef9bda53e135ae02bc42
SSDEEP 6144:7dciDmQZ6rLcuiebgLA9NlW1XpZaQ2dVgbs5zQpeV7:7G6mQZsNiogsmXpZaQ2dVD5zQI
TLSH
T17FE43F7CE3C569369D6153A22C0E36E57606AC5FFCA23A3A442DC034BD70BCEE515AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\kn.pak
Size 1.3MB
SHA256 a6ecf1dfe4d99f6ba0926c696b5b23b77d234fa8fd03da9825b074ecc640d508
MD5 a11d186b8eec7362a280abec3859107f
SHA1 966065cc6f69c3a222751d2191a0efeb6049cbdd
SHA512 099e73977453a5dca329b1d8a8cbc612dd2739bb3db034b7509af35877ede6ee12450875302ff3f9351fc7096b60be1b2d8ccbec89ace3145eb264f25946d46c
SSDEEP 12288:7RT+Q90Ez9Q6to4QOnyFUjY77K5OxWO4Dl1bjr:7Rl0QVf5uW/
TLSH
T13855CD186DBA7D301BD5006B24EC603EDFF16BE29CAA07D2F4DDD7802C66C6A90865DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ko.pak
Size 557KB
SHA256 3fa72d61a997c36f9c093f769f4bba60b290d1fbcb71d5544f85e8e1efe51d07
MD5 965ac0d213ccdfd83ac4970de23a8f11
SHA1 8326841ab80c40a7ca8b13589a3f5ff54fc15827
SHA512 5eaf14ce5c493bb4704716add07428edc6569f2dcb721679e140916c0e426cfa8e8ce27a2c38c48ae6e60461a678525e48e42c2938ce40e488b59d3f97a2f9cf
SSDEEP 12288:Bnxe0CptS2NHOXTTSIyxxMSAG0GlzRXfwb30t8OQ4E3heOGY5yCqhog/75d6L7Uo:NC2Yr51KeHXU
TLSH
T113C4D7F238DB23CD1193C982AEF4FA198382D976F7530294ED44CE54DE245D74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\lt.pak
Size 597KB
SHA256 a1257d10e673311747363e6929832e70f36668b1fc0d6a5ddd550fe88007aa58
MD5 20906aec4a21bcbb8bc8bab067075ba6
SHA1 369da9c1567d4376852cebdb87cd9213dc4bd321
SHA512 8d1ee40bff980b889af83b95fa408bddf2ff5d257f532d2da46bfc3ddbcc31b9cf14b473fdfca1a574c0316fd689a424ae241e9bcc533b7dfe0c7203d4b252fe
SSDEEP 12288:zT2knvNMLM8rPedJaH9qs50zjGwaRpw6SNM:71M5KVs5KGdRpr
TLSH
T137D43B0069E3AEFB9A4463C982A4CA78DEFD50005727BC61EC69C79AC43BF4525B4F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\lv.pak
Size 596KB
SHA256 33fdf706f6d3f06b485c5115a7c73a571296dac41c582fc9d0dbb371d86e8653
MD5 a999e734f9addcf07c080f9861c3c170
SHA1 522bb12a0cd4e5232570001684aed84f421abcd0
SHA512 ecb92c4ddf7b252a3216059e63b387c6847f6eccde532c300b74e6b04ab56da0208c2ecbd00ab1d5e48acced909db74b1aabf88e34d0d5928b89320f45200dc8
SSDEEP 12288:hCNXRaq4s+zN98JSvHkf5mF4TV5AzYg19:hCNl+zN98JSPkf5mFTzR19
TLSH
T17ED41A959EC68FAA4D508DC7732AD123A9CCD740FE06E112ED7D4B3A650F12432B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ml.pak
Size 1.3MB
SHA256 87384db1ddcac012b0b40ec89daf47ebbbcf1497705f023a6983fb2470e4abd6
MD5 39d4a5ed8cf7c8e0df946220fbfc0f68
SHA1 70794849b41d00f2b895f1211a6baaae3fa7d261
SHA512 ac992b9cebc2fd51f7477b36f1aa4d9157a84c3023949c02ea236d909c78fb5ccce28dd213c089820131ee3f669164529daf58901766630ebcf40546d33e132e
SSDEEP 24576:q5T76ZRKuKfGBP1tX3tD3e55HY6bXaS3t:6Mk55
TLSH
T1F4659D5BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\mr.pak
Size 1.1MB
SHA256 039f4e0176c38867fef57482825d043fa63bf1356c85eab0fc665f118db125e4
MD5 649e76b6666096a2258b942745ff9fe1
SHA1 82edf8ca68dff0caa36b17901c1e12a17172fa51
SHA512 92f51140416cd6dd53109ddcc1ee24c1d26999de5cd48a11e6954dbbc985298c1b90c0b4a7bbd8701a2737b71340e8a257e8b1ace85ff3b4876b714c60befdce
SSDEEP 6144:b17lQq7uu0DacX+KZmCneDsQcVgL5UmGQ0I:bB2q730DacX/ZHeDsQcVs5UmGQ0I
TLSH
T1ED35D14DF77AF3685DACBC8E36580D3BD8FD21B1C3E9925648E1B3E74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ms.pak
Size 514KB
SHA256 2f0c83b5b3bff8f624d78e0670a31c509e7f1d5330f72aaede471b2e97c956e2
MD5 9fb7c18f376b46b254ef9a960e08655f
SHA1 31cb060fc606d011151f1b5464e2a469372113a2
SHA512 23ea07d917bc0cb9a2f530f985c4c1930d31eb6e8271804709126b8b0f5266dc51636f679944d2e3d8dd7b603564defe85c1088a33a922e9fe15c2073b509a8f
SSDEEP 6144:fUEy7ZOTdVAPt7BtWMxsvHN3LrRlBJdG4UcuS95b8AAUGIUZf0Vf+:Py7ETedBRxyHPlB6I95npG7
TLSH
T1B8B4B5069EDD3118045843D9D2DA6A1B7CDD3333B705AF2B8DB08FB016AE7A53316B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\nb.pak
Size 499KB
SHA256 887a0278971d6ba61e2f24c62029a3087a46c4962c4357412c28ede12ed6da15
MD5 de04250ff403e9af66a1351598d2a64d
SHA1 4b7a5a2bf48d988f95aac6e85b11a8c2b2fd007e
SHA512 71527c025205bbcd63351283b7b123d8807c05bc68f2f7555f10386e330e052d031b9986ae2c1f0398bd174e67962657e0b8d4a57a07d167c233390a4e6c5556
SSDEEP 12288:+DUl1gBIbnw/5Op7flIxJb6RgbD5EKQbW7pDtvt:mmczYKb6RgbD5fQbiR3
TLSH
T19DB40783EE46B72EF69443A4F42886579B7D942CCD98199B54DCC63E08C7EF092BE1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\nl.pak
Size 516KB
SHA256 619c61701b3a142733d23ad8c7117bc013867a842d3d1d572faa56895ad8257e
MD5 d59fed8986eee2b9d406ad52d88cbcf5
SHA1 f7e409e17723e21174361bc81e54bcef269f40f7
SHA512 234aaddaa7677b39667b4078dc3a630d67b4f2ab7df5ce763d509183a4d88e8f7bd1a231113b8a51418d577e4aa630860a7f2735c34ef59e0f65966cef825597
SSDEEP 12288:+sv5HlbJ9WQuskxgb521Ex5btIQzbIrqqn9EOTy:nHlbJ9WQus9521Ex5biQzbIrqqn9v2
TLSH
T14CB4FA17AC5E253E59C0A385F6094FBBBF2ED22CC26CE67D94DDC1381443F6882AD499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\pl.pak
Size 574KB
SHA256 f2a7dcb69a433c2a898866c555b82c26e3515c089f500e7748b9b11ec3047786
MD5 8d4db26e2ee5181afdfdd513053f3c17
SHA1 0da427a085927a5c02d2a67c424ea99cbf5e6b02
SHA512 bf441f501d746f1fd996c21e5e2cde643b9031bf58bac31474e68a72ea6993447f8bfad3284351bffc94d6a088e183e0b24d109398d65dac0edee8826076ee21
SSDEEP 12288:dhbDxZoJTGTgWoOB/kce5XfQfu4VUd6HA9btHP3CUdRe3mTUpMAml1QhqGY5T1sc:dh/xwGTghUMt1QhG5cc
TLSH
T101C45C0D56E58A4E4DB008E6F2E70B7CACDCC808F109D35FE46F852A615B19ECABE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\pt-BR.pak
Size 540KB
SHA256 5ff219be32f9178fee40e8966ac5deff2be1f2ff259a66cb9cdce81c2e90a7e8
MD5 b4183914f46fd63a7bd32d715b8629f5
SHA1 d0295b556e55a74e357f932473f9dd2bb1cd2f51
SHA512 3bcd37cc49a827c03fb5b3a97a5eeb863ebb6f071fb2af697ebfc4f57dda676227533cc6a2fdb00505cb2395aae685dae087970ce13af113260d856b845a985a
SSDEEP 6144:06EIk/O7P0GYlsw2mQNBXBLQ9syyV35vnXRCrEsRn/Nqs:BEk7FYl32j5fXZsR/NZ
TLSH
T195C42B2A6DC9136605225350B74EEB03E5885745FE0ACA8BDCFF4B05A3DDE40DA33BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\pt-PT.pak
Size 543KB
SHA256 02ea290fac25b414a1d4ed78cdc159cf6c73fe5350824c2f36f032e426a23364
MD5 03138b2e4fb822b03713f6c4f0fc67cf
SHA1 8f6f6585743676177eaff5a582d18691e3386bbc
SHA512 b000f1b8fc952849d1ada21aab665cbb97989fc28e892a75077ae9a24c4ef1d15b7d5cf1c5aca89d27d40a01c64f343a08f790049249fcfed43a1a430b4fef9b
SSDEEP 6144:fNc5PJmPI6Lv6/CieJVJJxhFIKpcfV7Z5Ij6ySRxi:6PJ4pLoZ5IjFSRM
TLSH
T11CC41A296EDA136605135381B70ADB03FAC86655F809C687C9EF0B0672CDF84D7B6F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ro.pak
Size 562KB
SHA256 655c175903a791d0ff56264a487c53f7bd09ed037cf04cfa6e79eb8be5b677e9
MD5 cfd7cb2444248216e12193689ba56c10
SHA1 0a9d65fdbc68688bf1624a8c98fd42673961e0d2
SHA512 7ab384dfe93c4de0d82d3a581d0c4b988f823f49848cedf081067e052be2d43c42389899588839dbc7cb35ba70617648bd0c7c199900e78c487f3dd77e64b4fd
SSDEEP 6144:Dl1456eMxkXbf1WgAbyFopxwdNijkHGpq5C5+U6Ys2tE/bBO3:RmnIkXbfZAGFoPwSACq5CcUXE/Y3
TLSH
T1BFC43C2391C81A972A9152B2B73624D3EC8D105DF641D2CDA4EEC97D10CD9DBC62EECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ru.pak
Size 924KB
SHA256 4babe5f20caafca33867ee263aa9dd55ed271704a062e4372fdd133eb359a558
MD5 46fb61aa9515e97293969683fc330764
SHA1 5bcc41716976eefb65870ba2a2b230238f7e53d3
SHA512 c3acfc1c902c651e5fc0501a7a77358cbb99daa020597f7f6be9fc81ee53509dcb0d63c6bbc5ae308c88d95dace7099f024d698b6f364dc7db4ae2a7660e5b31
SSDEEP 12288:Oqgi74CVfQjRo4YSWKCx/KHizJ9ZF1WAaWlapqSvDs/uTXb3YHVeXN2hVO3j/LSa:Om4Mz15W3sC
TLSH
T1D1157661669E64DE1101F01BDD08BE093CEB45FE3FABA35619A42D7F35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\sk.pak
Size 580KB
SHA256 89f984a67cea3997c704005fbfbacd3f6f5652248626945c2ab1c3bcf24e6623
MD5 5d41e75bf42cb12d7674986f4e5dcba4
SHA1 7c3375226997e3f69e3c9a3a5ed762ec40d24973
SHA512 a2b91c888ea3dc2e618bf8faf7ac9f0fe562ff16c85d03afac0778ed671b1868a665b892aeb2d588e7f5bf32a7eba57b75e2e15f2c51fc9264e0db2f95d804d0
SSDEEP 12288:1Q+gClqsxkldrM8ixiq845nH7wM6IzWTjPxt9cU:+ClqsA/ip5bwcGtWU
TLSH
T162C44C3FDFE6181E8E8D0148EFEA7110FD6E46508A4EB0A5D44F364714E26EDCAB8E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\sl.pak
Size 556KB
SHA256 458b15bf249c1e6fe9843725c42443274ef6e09dcb15f5288c916c0561aefc47
MD5 6c71fa576a41711dcb351abf92a65ea4
SHA1 a0281f6b9dc363628e7d6045f7dc2904149c9dad
SHA512 258e49b51ee65bf508d05a5b3286a8937d3a876a876635b59b97752c5171e89458b9d23d9d7178153aa16b6fc908cc011a8e855c6d3a0152c919b40349cdf4fc
SSDEEP 12288:QFEa1zRkPcB2e+ojNK5eVfnWJUU+i/fzurqc:QFJbko/NK5eVf1i/fzuN
TLSH
T1C0C42B35BAA79E0F0D9AA2CAFEB602007FDC044CD256E6A1FC8F336D5015A3817BD595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\sr.pak
Size 859KB
SHA256 4cea4c83b5e887463dadbf470a9953b8175149f31fd07b83406a6fc59acfde41
MD5 eb8ec452c7079ef7dc24bc7975513ed9
SHA1 4787250292b8f2040c7ec0b265f60edcfd1ffcd6
SHA512 3ab2eafd3f09627efed8263cc2d59d5780b6a856a6d1299be511bbb5c1350fa05f98b0e77c53c3707ada17e7e44b8801b191802e2cf5129548e279703983a8ba
SSDEEP 12288:rH8hr7QuzIWUISuGSDd5S0Gj+uJPPX5Y2EsuexNHgb37DVebd/k/q:rHAlPURX5FuI5
TLSH
T17E1557A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\sv.pak
Size 501KB
SHA256 105460cb717104d82f99cf8c5e2c51ff252211a605bd1c98bf75981f100d619e
MD5 819b5e4f2b7734ea4677f6d579d72f84
SHA1 aff3048d8e35fabf68a756513b67efedba59f85b
SHA512 3e1ff5d934c7e0656dd16265be697420c31b191f88a5140c3598b4fe37a6bd3031f50d45ac7e961acaf0886934951a48230f7b10a53d85e015d6d5e1602c3eff
SSDEEP 6144:0qvFK1jOrdxwhaqqbCAxLUxlsWG4RFcz9RtGdJ2qF4ivMJSO8DE/xJuZpV5YiUr4:0hOdxwSCd95srSQEV
TLSH
T1F5B41C438A20F526FBB2130DB508115B4AEDE25CE7E2958DB8DD883DAD8BD5805FF247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\sw.pak
Size 529KB
SHA256 f0fccf2e3ad332846736d816e254028569f5f84918573872442987a8bc9bba58
MD5 be2bc09130635406f560b95e789f9a81
SHA1 f189cd6eb6c844e2d96ffaeda66fe4d5f1453130
SHA512 f651ea959066a5966f35493788b9833597dff653f649a5bc8b09a8ed748bcf086bd0586a36e1f4ecddd361d04774253e21d67801760d0988f3e17f0c6e1121cd
SSDEEP 12288:Xzs5IvVSRflncfD5WBqMCBfRd8FU1bQWNs4METOIQp2QVLKhzgKy5yvTCs0LMMkH:Xzs5mif/5ml
TLSH
T1EEB4C6629871E0191233518603DDFF732BDCED5C2D2B29935A46BF0F218F98857ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ta.pak
Size 1.3MB
SHA256 1cebac8d758298ed2763e62b9bdfb17351831e691ff3e1ba85252c9a66d66242
MD5 52ee28471f2f9d01ef3f57233496554b
SHA1 abd7dd9989fac90636626a41f007eb6aa5ec7a2e
SHA512 af2e9593faf60319244c90e9c06604dd3830705f14c18cd380dc2338aaa0c1e137bf751603ab9beaf7f1783839f83bcd4fda357b7cebc66ee94155d560b6f691
SSDEEP 6144:T7IDhn9dvYUVLK9VHPAQF5isBtRdjtm1vYpiMyp:T0DDNYAYhPxF5isTtm1vYpiMyp
TLSH
T110550CCE923EEE890F93288F0319536912986155C47BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\te.pak
Size 1.2MB
SHA256 8264244c6de861817f5b19cef282844a18ed8cb7d4e059451489652749fe931e
MD5 3a71904057869c23d1bc108f1e8d0d31
SHA1 6fb6e60c80bc332a2bb66d02a1e3db69961a9c41
SHA512 7248058b2d357c4a8b9c2e95d580a2000a96d9a5adb0b822adeeba5c4422e08cc12ef84b9b9a627a1f6cd07a08698ec000510885d14d64afd40c6e8d69376022
SSDEEP 12288:AJlpcT7U7McKNOJI0ydc6dwIIRT5EbNQ8W8thBk3p1FZ5Kitlb2wsXgy3PiorOTu:azI7cmT5D+Hti
TLSH
T1435591023A6AD310DAE60273752CF66C49781B8161D6732C1EAFA357FB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\th.pak
Size 1.0MB
SHA256 647ad394e92e7610bd0f6c4e08d28748408fcd5a816a35e4622ea7f71cfa7a9d
MD5 879a881174501e22c3de65b9f80bc19b
SHA1 a2e020d5ed1be7dee50a495a2f8581e751cbf735
SHA512 b8961a90036b94340283237da57659cc277e65e545764251f7d3e406dc5f70c9ae29366184d0aa8831aaa0a7cb5c12ff825078bb87528606cae223fba58c73d3
SSDEEP 12288:ho5WEVQN9LyZYAPTJz1L/L1XLJ7sgU6yaiW+v/K5U/afL3fgj80RUIwunRHpG4L0:C5W8+56Np
TLSH
T1E3354CB37247DDD479441B5B262A7789673DAE693F73F8E00089215A73F071A8422EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\tr.pak
Size 539KB
SHA256 f58ed19be62706fb4fd797a6bfd3af5c6ad4b39aef994a577cd28968fcac0291
MD5 414b557adfe76e3564d43cb93f513c5a
SHA1 f775095f7c55e834a777c7f25fdfb81f1e63ca08
SHA512 8b1be522ef23888d46c13888a18229f4c9cb6e1c6e6730cca79d9b13d71eb86ecd3d0c172ade6f70ff63a7fb5242e4de7d9742b93376669d13c77de0cb622f94
SSDEEP 12288:s5acoqN+y4HzNs7DxqoOF1n1BXl35M7Je:sNEysXl35EJe
TLSH
T124C4FA8178EF781C8BB9278FD6E90666F89F0766B331F4469A16863A774535303E360C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\uk.pak
Size 923KB
SHA256 13e40208e2c9f4f4b83dcf422610dc82314a8f99ba50acdbd286c508f92eb232
MD5 241fc33569b22647e7d2c4189a8ee7bf
SHA1 f56a73cc81b1e96560b74ee5e73d7af792720ada
SHA512 ad16f84482f0c7c3d3c3fb98caa3dbd0048138f361aa6eba2b6338ff6e25da4c3ab39450354f2a86a53d655cad99e92fab2c030b5771d7e6a25190617f1a9385
SSDEEP 12288:lw+oY5IMlh3TVIsSr+Oh7+4w0ZZDSIHmBm5eB3IjCHA3brUkcuhLNiXEvqbz1TX:lZpK15Prw
TLSH
T1CA1599A19A9D58DF0106F05BE84C7A0D7DA741FE7FA6471625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\ur.pak
Size 808KB
SHA256 60310f9a3457fae0395b447a30646211ef4160ba84bd7c36d291af4c8ec2b79a
MD5 fb978b7d211112a0774ce09ca54ca96f
SHA1 fb0c69801230437dcd20e3803db81ee60fc042b0
SHA512 abde8d79f46b27e0e315034025837a3126d6e5d2bc52504d49c946fe96828bd9b20cc4a5c05283fb9f8813e6820a28249cfd68b30cb27fba216970c16ecc8d44
SSDEEP 12288:VXiP4WLa3w8PYsR5Nimy0ciU55eOmEhuCEO5xlKQYrbYOwadcJKwUSu9co/9Njjw:VX8wI50Cs4
TLSH
T167050FD2E6BC96B25A21D92780D33C34CB635F13D34BF286E52246C54E9A0135F6DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\vi.pak
Size 639KB
SHA256 fb9463d5655e73fa69cace9800d95f8cd077ee9284fef3bfe162d2bfe220c257
MD5 565abf3f9b296fcff95fa5b169a7d598
SHA1 24de1221b2adec13b5bcc23c4a54b8e987e9f12e
SHA512 53bfe0c1c289ecdf48114048e15807c3143dbbe357736753cb845a31a6a3fccd0dbae652294508706076ca4b30e5da00e53bc6aad11b06fffbf2621997e7de36
SSDEEP 12288:ewR2TuFaVN+cywJ2roEsGV63wueX0Fxzn4xs9FgGhx5a8hI+8qiOXLziKHhv0ZiB:ewRlGN+cywJ2pVPuS0Fxwto5a8u+OOXX
TLSH
T16ED4741117E1702680AC553EC6CD540E6FCAE42FF7C18FE56FF429787A221A45F21AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\zh-CN.pak
Size 460KB
SHA256 f0c0ba53c954325b3bbefb333ba23f7fb40a7a4e506043e9f7886089f611943b
MD5 3fe312d9859b299c3a332373172c33f8
SHA1 ce6a99d79dcfc363bcf68bdb1ddd4e6862236020
SHA512 488a6043381834c9d69a906edd9e3273da01b618e9f3351a89082e6a4727f9f882e435eca3d590cb30336cab289fc71b109322d43804ddde5fa038a63a0b84f7
SSDEEP 6144:U6mVxC6vh+uQ00tB2HwWzv9O7F56Sb4fa1DZ59x6m4kIk1Nd9Mlz:U3/hQtBUfzlc56Sb4fMZ53b4kIkz4
TLSH
T1BCA47EA951ECBCEC014640E03729627D7C40B50BF667AF76ADD248DD2AA2F9D0717E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\locales\zh-TW.pak
Size 455KB
SHA256 d4033cb3264c7c4cd2636ea2a202421650c449e5bfb10f29949e4c44e91ca93b
MD5 e302e1102f3f5a21860f38f41b3c30f8
SHA1 78b5d1c451cf674a7641dfcc815f966fc920cf57
SHA512 1f96b197eb7ae6b7983ed38d4ce33ea0c845ffe527fedfbc9e53a6009871dd3c39084a04cd1d43fd6dd24e7f26e3ec4845d4225df828de0b9ba346cbc98efea4
SSDEEP 6144:zKOBV6L33vWecZM1uJJVI23uNw+H05exvnknN+nHE/ehTq:dV31ZM8Qw+H05exvn2Ok
TLSH
T11AA47DA608FFDAEF0A01F884B7CD522FBC8B746CDD773636FC8918D42D6AA540661149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\resources.pak
Size 5.3MB
SHA256 a5908171bfbb738ac015e7c9903c838d93359ed12c3b7d86545514dc1f0e9d62
MD5 84df318c3fd9ab693dff15582132fc65
SHA1 6b436939d3dd3d5300af46c238c085276bbf1b55
SHA512 189fd83f008c29d9b38e5024975050c8e3dfd5e99a0c5eccec06fce54e865f0d8bef03a4bf3dc3564f2bb640f38259957f8f38e0d39599aec6ecba95eb21f848
SSDEEP 98304:5N9bNj3xZRkPe04srtXK5EmXJfnimTgK5M/AyrwreSjujBrTAVD:tbNTxTk1rlK9gKckreSjuxTK
TLSH
T1B346330677E1913EC82ED33C42494F76169CBA730665712B718C6269FF391AA4E4E0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\resources\app.asar
Size 29.7MB
SHA256 d7905ecd25d896189ceba60b7162ea67f93e3ea4bf0a41b05ab24dcbcf0cf444
MD5 f1ddd17c119ff4348a05e63459f08184
SHA1 fdd5b678e1454692c7280519eceb1ad7474b824f
SHA512 a8763c1de5b9601c7b4ae9efac2cac3a7949eb10093f546d1b1fc9196ca9ff6a706cb34ef632811906d4cf5b79f5a5e96b39f1cdf00b3fd557ce9e4f8ea6c1b9
SSDEEP 49152:zi7HdgYfIJBV7NCIqr1PKcxfmfFMyC6Mx1pH1GWtPBxwdZw73DqhRCxwdZw+crhb:PCI61nc+
TLSH
T11B67172266D761634F5F0EB703CD210AAD79912F750498103B9EC71D7788F26E2ABEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\snapshot_blob.bin
Size 302KB
SHA256 22a46de643045805a3e588f9a18ebaa377f9fba3dee46b2d60f3ae300a09cc4e
MD5 62b9e00c46ed829e06d0c2494aa994af
SHA1 988882632b95bb78d80db60e4787c576e48338e4
SHA512 03b7c57782923ca3a011fcb85f74e865bb7ff9976c89152758770be3bd3d40684ebd216fe34f0d0050936b536c8bab5eafcaa35fc26e893d30a108e36687876f
SSDEEP 3072:O639kvvDaxLwqU1pedJ/sK6VrKe5VtZW1P3BU5qt5IiVboVKdc5:O62vvKwqIu+KgV0PRU5qticrdc5
TLSH
T11264D884B780CF56E8292E709DFE979A2239F3DE6E07825BB245032D3B7D6350E0654D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\v8_context_snapshot.bin
Size 646KB
SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
MD5 a62fbbb671bf975ed46b42d9cf437bcd
SHA1 408b595b1dc6658533e0db1d35f509ab9ee70525
SHA512 87c934670df70afcced0ea5c73449a17ad27d5b6a25cedad9eb61634aaff8a42b713f578e861c2efbc77593793bba240a1495822b69c99a8ecaef64b07b6a62c
SSDEEP 12288:f97k1vtORkeGWFDjesZeLEY4QUH7zRpA8W:f97k1v42eGWFDjZ427/RpAB
TLSH
T1A0E4B5A2B784EF56E1DA6EB0DDFAEB923234F5D99E0B419B7149036E323D7242D0450C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\vk_swiftshader.dll
Size 5.2MB
SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
MD5 15d9ca6f1d87f15f5c67740df2bfa874
SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
TLSH
T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\7z-out\vulkan-1.dll
Size 938KB
SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
MD5 8bd643a9f7ef2619b792cf2544f27a8c
SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
TLSH
T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBDCE.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\KernelTweak\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\KernelTweak\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\KernelTweak\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\KernelTweak\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\KernelTweak\Network\Network Persistent State
Size 300B
SHA256 b95056866d84cddc1e0d7e044eb8a4221102efd6c504ffeebf37057cfeeb6d27
MD5 50e58f6416b3be2c7243611dce6fe3f4
SHA1 750b76934ea3bcd0c0acb1d10fe6f4c30db98739
SHA512 79ad41c557ddc2310b8464c47fe1ef9e0aaa7f968acfa7ace7bf220f6393f655b8f06591a625f6f863709b0f10f55bd1941aa4850c08e00690e04f504bbebcf1
TLSH
T1C7E07292C2D45CFE068543F02A243963C2BA088A42282E46D9E8BB1E83A64B8490084B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a1e09.TMP

Path C:\Users\Admin\AppData\Roaming\KernelTweak\Network\Network Persistent State~RFe5a1e09.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

kernel-tweak.log

Path C:\Users\Admin\AppData\Roaming\KernelTweak\kernel-tweak.log
Size 4KB
SHA256 6cf447b8f61bd22604337d583bf5d62002e934f51b2a0d3bc928dcf73b6bf4a4
MD5 2766523b0679b784c885a99062ea6ea9
SHA1 4b039ca3091186196127c3308ddfc9a71837383f
SHA512 19e718a2ad47f53e819415f6c564be8823537ea0f99a1badfcc00c34992068b7a89f6ffdbcf88e77f8e6869839c7f783f49236d8abb627f3703a660d544c5ad6
SSDEEP 96:oSIHHHmHexHFp/eIH5a5j56N5HZKV/qHYHtXGHpWMb+0wwHoXJUFl8oSsHti11hT:JInH0eVFp/e65a5j56N9ZKV/oYHtXUp8
TLSH
T18F913E93F46C2822B50708A9921DE5169FC1B8F3C3115C346B394BC83B29FB69B7D9B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

KernelTweak.lnk

Path C:\Users\Public\Desktop\KernelTweak.lnk
Size 1KB
SHA256 e6f98c4b95b05acc3b34493ff82a5392461bd4158a1b144f4f20b65a2b63a4be
MD5 2c1420bbf50d489ec3f77920b05a8a9a
SHA1 9055373b64574ed6962312b6cea8de20c14ba1e8
SHA512 250a810c1730f80417de1126f7d2c25091fdd3c245e3cdbf090be288735b21457459b561a083af550a8d752fa802e97b108c0b69bf41ba9137b0763563a8db04
TLSH
T14441A0240FE91B59F2739FB2EFB63651413DBC00A226425F5D88438418B4560CA1EF7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2436-2428-0x00000292FED10000-0x00000292FED2E000-memory.dmp

Download

memory/2436-2429-0x00000292FED40000-0x00000292FEDF2000-memory.dmp

Download

memory/2436-2430-0x00000292FEE00000-0x00000292FEE0A000-memory.dmp

Download

memory/2436-2431-0x00000292FF080000-0x00000292FF09E000-memory.dmp

Download

memory/2672-280-0x0000026AE0F00000-0x0000026AE105F000-memory.dmp

Download

memory/2672-466-0x0000026AE0F00000-0x0000026AE105F000-memory.dmp

Download

memory/6920-2491-0x0000023AC9040000-0x0000023AC90F2000-memory.dmp

Download

memory/7048-921-0x0000020FB28B0000-0x0000020FB28D2000-memory.dmp

Download