5804e4661f3a752725a60a90cdb2b92d18db03a957167940ff4d9c85e558bb20

Analysis

user interaction
yes
max time kernel
108s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ToX Free Utility NEW ERA.exe
Size 37.7MB
Sample260719-2b1bmsgz2t
SHA256 5804e4661f3a752725a60a90cdb2b92d18db03a957167940ff4d9c85e558bb20
MD5 c2c80bfa0411b39ea8f404bfcf7caf0e
SHA1 a8f1413fd238946e9e908d42013961afd497a876
SHA512 4fa551cbf8498dda4c077b31f14cfd30dcfaac338c416df2a0a245c52cc1c9f65ac87c0f6da484208ae61a9815cf534e4affdf2049d075d38fdf7b969d1cae7e
SSDEEP 786432:hTnUeGx+qqZU7/EmbgB83AuPhyr11/rnru4RXc7OtrKI/qzkkEh:BnIhqZKEmOPx1/rg7OtrK4q
TLSH
T19887334033E8095AF2FF5FB9AEBA14808B767D96297AC49D04B854CD09B2F50CD61B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
4156	icacls.exe
2752	takeown.exe
3188	icacls.exe
3168	takeown.exe
1888	icacls.exe
2784	takeown.exe
3096	takeown.exe
2280	icacls.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3168	takeown.exe
1888	icacls.exe
2784	takeown.exe
3096	takeown.exe
2280	icacls.exe
4156	icacls.exe
2752	takeown.exe
3188	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe
2976	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2508	powershell.exe
4012	powershell.exe
2976	powershell.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4012	sc.exe
4992	sc.exe
1964	sc.exe
4796	sc.exe
552	sc.exe
1924	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4464	cmd.exe
4748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToX Free Utility NEW ERA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2012	rundll32.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ToX Free Utility NEW ERA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ToX Free Utility NEW ERA.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ToX Free Utility NEW ERA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ToX Free Utility NEW ERA.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
2312	taskkill.exe
1332	taskkill.exe
1800	taskkill.exe
2012	taskkill.exe
1916	taskkill.exe
1388	taskkill.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe
3356	ToX Free Utility NEW ERA.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3356	ToX Free Utility NEW ERA.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeRestorePrivilege	1720	reg.exe
Token: SeRestorePrivilege	3948	reg.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeManageVolumePrivilege	2484	svchost.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1388	taskkill.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4464	3356	ToX Free Utility NEW ERA.exe	104
PID 4464 wrote to memory of 2312	4464	cmd.exe	106
PID 4464 wrote to memory of 2084	4464	cmd.exe	107
PID 4464 wrote to memory of 4468	4464	cmd.exe	108
PID 4464 wrote to memory of 1720	4464	cmd.exe	109
PID 4464 wrote to memory of 3428	4464	cmd.exe	110
PID 4464 wrote to memory of 3948	4464	cmd.exe	111
PID 4464 wrote to memory of 3168	4464	cmd.exe	112
PID 4464 wrote to memory of 1888	4464	cmd.exe	113
PID 4464 wrote to memory of 1332	4464	cmd.exe	114
PID 4464 wrote to memory of 1800	4464	cmd.exe	115
PID 4464 wrote to memory of 2012	4464	cmd.exe	116
PID 4464 wrote to memory of 4012	4464	cmd.exe	117
PID 4464 wrote to memory of 1964	4464	cmd.exe	118
PID 4464 wrote to memory of 4992	4464	cmd.exe	119
PID 4464 wrote to memory of 4796	4464	cmd.exe	120
PID 4464 wrote to memory of 552	4464	cmd.exe	121
PID 4464 wrote to memory of 1924	4464	cmd.exe	122
PID 4464 wrote to memory of 2508	4464	cmd.exe	123
PID 4464 wrote to memory of 4012	4464	cmd.exe	128
PID 3356 wrote to memory of 4748	3356	ToX Free Utility NEW ERA.exe	129
PID 4748 wrote to memory of 4660	4748	cmd.exe	131
PID 4464 wrote to memory of 4180	4464	cmd.exe	133
PID 4464 wrote to memory of 1148	4464	cmd.exe	134
PID 4464 wrote to memory of 4164	4464	cmd.exe	135
PID 4464 wrote to memory of 4764	4464	cmd.exe	136
PID 4464 wrote to memory of 4080	4464	cmd.exe	137
PID 4464 wrote to memory of 2988	4464	cmd.exe	138
PID 4464 wrote to memory of 4292	4464	cmd.exe	139
PID 4464 wrote to memory of 752	4464	cmd.exe	140
PID 4464 wrote to memory of 4424	4464	cmd.exe	141
PID 4464 wrote to memory of 3496	4464	cmd.exe	142
PID 4464 wrote to memory of 4252	4464	cmd.exe	143
PID 4464 wrote to memory of 2640	4464	cmd.exe	144
PID 4464 wrote to memory of 1400	4464	cmd.exe	145
PID 4464 wrote to memory of 1128	4464	cmd.exe	146
PID 4464 wrote to memory of 5108	4464	cmd.exe	147
PID 4464 wrote to memory of 1044	4464	cmd.exe	148
PID 4464 wrote to memory of 2964	4464	cmd.exe	149
PID 4464 wrote to memory of 3536	4464	cmd.exe	150
PID 4464 wrote to memory of 2784	4464	cmd.exe	151
PID 4464 wrote to memory of 2280	4464	cmd.exe	152
PID 4464 wrote to memory of 3096	4464	cmd.exe	153
PID 4464 wrote to memory of 4156	4464	cmd.exe	154
PID 4464 wrote to memory of 2752	4464	cmd.exe	155
PID 4464 wrote to memory of 3188	4464	cmd.exe	156
PID 4464 wrote to memory of 1916	4464	cmd.exe	157
PID 4464 wrote to memory of 1388	4464	cmd.exe	158
PID 4464 wrote to memory of 4776	4464	cmd.exe	159
PID 4464 wrote to memory of 2976	4464	cmd.exe	177

C:\Users\Admin\AppData\Local\Temp\ToX Free Utility NEW ERA.exe
"C:\Users\Admin\AppData\Local\Temp\ToX Free Utility NEW ERA.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\ToXTweaks\BatchTweaks\WindowsTweaks_Debloat_Windows_apply_20260719_232707_792.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /F /IM "OneDrive.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2084
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCR\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4468
- - C:\Windows\SysWOW64\reg.exe
    reg load "hku\Default" "C:\Users\Default\NTUSER.DAT"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_USERS\Default\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3428
- - C:\Windows\SysWOW64\reg.exe
    reg unload "hku\Default"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy" /r /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3168
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftEdgeUpdate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftEdge*.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Windows\SysWOW64\sc.exe
    sc stop edgeupdate
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4012
- - C:\Windows\SysWOW64\sc.exe
    sc delete edgeupdate
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc stop edgeupdatem
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc delete edgeupdatem
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc stop MicrosoftEdgeElevationService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Windows\SysWOW64\sc.exe
    sc delete MicrosoftEdgeElevationService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -EP Bypass "Get-AppxPackage -AllUsers Microsoft.MicrosoftEdge.Stable* | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -EP Bypass "Get-AppxPackage -AllUsers Microsoft.MicrosoftEdgeDevToolsClient* | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarMigratedBrowserPin /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4164
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\MSEdgeHTM" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4764
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\MSEdgePDF" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4080
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\MSEdgeMHT" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2988
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\RegisteredApplications" /v "Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:752
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\SOFTWARE\RegisteredApplications" /v "Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4424
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3496
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v InstallDefault /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v UpdateDefault /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1400
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v CreateDesktopShortcutDefault /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1128
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\EdgeUpdate" /v DoNotUpdateToEdgeWithChromium /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5108
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\OEM\MicrosoftEdge" /v AutoLaunchOnLogonBehavior /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1044
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EdgeUI" /v DisableMFUTracking /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main" /v AllowPrelaunch /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3536
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Program Files (x86)\Microsoft\Edge" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2784
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Program Files (x86)\Microsoft\Edge" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2280
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Program Files (x86)\Microsoft\EdgeCore" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Program Files (x86)\Microsoft\EdgeCore" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4156
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Program Files (x86)\Microsoft\EdgeUpdate" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2752
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Program Files (x86)\Microsoft\EdgeUpdate" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msteams.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ms-teams.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-AppxPackage *Clipchamp.Clipchamp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ApplicationCompatibilityEnhancements* | Remove-AppxPackage; Get-AppxPackage *Microsoft.AV1VideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.AVCEncoderVideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingNews* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingSearch* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingWeather* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Copilot* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Edge.GameAssist* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Family* | Remove-AppxPackage; Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Getstarted* | Remove-AppxPackage; Get-AppxPackage *Microsoft.HEIFImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.HEVCVideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftEdge.Stable* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftOfficeHub* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MPEG2VideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.OneDriveSync* | Remove-AppxPackage; Get-AppxPackage *Microsoft.OutlookForWindows* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Paint* | Remove-AppxPackage; Get-AppxPackage *Microsoft.People* | Remove-AppxPackage; Get-AppxPackage *Microsoft.PowerAutomateDesktop* | Remove-AppxPackage; Get-AppxPackage *Microsoft.RawImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ScreenSketch* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Todos* | Remove-AppxPackage; Get-AppxPackage *Microsoft.VP9VideoExtensions* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WebMediaExtensions* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WebpImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsAlarms* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsCalculator* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsCamera* | Remove-AppxPackage; Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Windows.DevHome* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsMaps* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsNotepad* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Windows.Photos* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsSoundRecorder* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsTerminal* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Xbox.TCUI* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxGameOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxGamingOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxSpeechToTextOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.YourPhone* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ZuneMusic* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ZuneVideo* | Remove-AppxPackage; Get-AppxPackage *MicrosoftCorporationII.MicrosoftFamily* | Remove-AppxPackage; Get-AppxPackage *MicrosoftCorporationII.QuickAssist* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.CrossDevice* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.LKG.TwinSxS* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WidgetsPlatformRuntime* | Remove-AppxPackage; Get-AppxPackage *MSTeams* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.Client.WebExperience* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Get-Process explorer -ErrorAction SilentlyContinue)) { Start-Process explorer.exe -Verb RunAsUser }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\ToXTweaks\BatchTweaks\WindowsTweaks_Disable GameBarPresenceWriter_apply_20260719_232713_933.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter" /v "ActivationType" /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4180

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Advertising.Xaml_8wekyb3d8bbwe
1⤵
PID:3052

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.BingWeather_8wekyb3d8bbwe
1⤵
PID:1116

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Edge.GameAssist_8wekyb3d8bbwe
1⤵
PID:1788

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe
1⤵
PID:2920

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe
1⤵
- System Time Discovery
PID:2012

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.GetHelp_8wekyb3d8bbwe
1⤵
PID:2644

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Getstarted_8wekyb3d8bbwe
1⤵
PID:456

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.HEIFImageExtension_8wekyb3d8bbwe
1⤵
PID:2976

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe
1⤵
PID:3040

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
1⤵
PID:3344

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe
1⤵
PID:3112

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Services.Store.Engagement_8wekyb3d8bbwe
1⤵
PID:2332

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Services.Store.Engagement_8wekyb3d8bbwe
1⤵
PID:3028

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 baa9a89717f4013b2799bd06490c738246759ecdf7a3200406fad5a443e83669
MD5 95201d9e44c732d9b261b4b334505d6b
SHA1 d5f3f499ef27920d8a614152191a7e0c2f9c0264
SHA512 15ddf637b642144dca99e2794cb4ca4d1dfa9d682e7eb42075d9b269dd5a479b5ea86017db142b599a3f022ebb695baf3691305ab17009060b4f64ddd7254282
TLSH
T1E0518B303161A4D98D525F0608286BC9A3EF434A7FA85F6C7969231DDD36447D7261F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 7d9ff99f44d5ffc8b5d42e7de0cad0e0b09898b74d82a6aaf8ddfdf2dc93c247
MD5 1be6aed058ea25242c99cef1ad4131ba
SHA1 1e0ea2f13a74c660ecfeac1de1647ce59ff50277
SHA512 d44720cc1feff14d5bfcf8796c28476d3bd8c079669a855eb24542b477b982904eed166ced4edceb3945b300cab2a7873c95ba6e66c354efdcde98e6cef5b0af
SSDEEP 384:Krf++c9i+s4HnVmvzeik+o9o2TVK6seYfME/B03SoZAfYSgcjEYitX+8va:ofxKVw0jo2TVNArqSnWCEHRDS
TLSH
T18972A59E610F26C3C4921378D10B095FE4F2DDCD131A17D8BB6A9F3B8AACA5E517C198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 10ccd099944f95453f0e695345f003452fa31206d598526dc65fb1c63ebcf57c
MD5 a47a3c6de419cf64fca16a6400f38641
SHA1 29d9d477ab9fabd802e951e773581ef81a5a4465
SHA512 c07da055fdd183994a41e7c7001c39946218367409ca6e9fda4ca0b0a87c06b8bc9cede197f98eeba48524c2ea3699b301dd62120d3b16cd89bb93efb97cbadf
SSDEEP 384:Ib++Y991+ut/AFcBbFFH8ASwRNY1WO0iQpz+CIUHPWJ+8vVyM71VFDLSbSOi:UU+utf8yRNHapCIU+JDXpVqo
TLSH
T1EC922A5D222F26D6D06263B4E42747AFEDF09ECEC30487DD170E4E3749EBA6A80550E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 3fa1eca1b08c75ab305be20d053c2d5121d7e3992f0b0f463bd3e3c5f52a4cc6
MD5 449ffecaffe143eb048bd0dd8dd2d62e
SHA1 c21600f6bdf988955b7d1e3a91ce8c9ca515b3ac
SHA512 5ba95a19f89fc30fe659a0023a4583e10f6bdd7d55429a5fbcfa17713b3c3a9edcab5d39dd95d72b06b31408f2beeabf2dc1c3203fa7e1fb1de119e0193edaa8
SSDEEP 384:Srf++E91V8dCBhBizbbJZo9uv2RKg6dPHgQpYjJYTdHWWyR+dj86:AfyVNodquv2RL+PgxJudLyRq46
TLSH
T18372195D321F2297C0A213B8D42707EFEEB18DCF834407DEAB58597B08DDB6640A91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsTweaks_Debloat_Windows_apply_20260719_232707_792.bat

Path C:\Users\Admin\AppData\Local\Temp\ToXTweaks\BatchTweaks\WindowsTweaks_Debloat_Windows_apply_20260719_232707_792.bat
Size 8KB
SHA256 cd54c626e202c61b0dff0451ae2020edf99535daf23552be080746659281b6b2
MD5 e61644b92467df5cf1f32c86183e020c
SHA1 72e24cfd274edc99ce5a354bea9676f9dff12917
SHA512 96ff4c61804b381a5d1f98d01680a1b89dc956ad050de1e45fffe2ef013d400419cb42fec428d9fb05f8a00834788d2ffcffa6fc264908ad7bfd59b82fdf630a
SSDEEP 192:tyCptBAihW4QjguOXhJm5uG1FbFMuKndpYd+cwp1d+vCpfd+UTErLY+oT7WrPXCi:tyCptBAituOXhJm5uG1Fodpk+cwpP+v3
TLSH
T106025BA29BD2CF6285B87D4BA4EA885D368E6783F4425FF470C71080D5937E2C32B195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsTweaks_Disable GameBarPresenceWriter_apply_20260719_232713_933.bat

Path C:\Users\Admin\AppData\Local\Temp\ToXTweaks\BatchTweaks\WindowsTweaks_Disable GameBarPresenceWriter_apply_20260719_232713_933.bat
Size 218B
SHA256 8f00a791a9eb6e8062c1fdfc1c59f0062795e99c7b0141b289461370a93b0285
MD5 0e25b21b884c8dc4b68c297136acde74
SHA1 f7e0b27d99fc64a4c337b604066bf2a9eadaeb26
SHA512 8a149be852ac7e9cd7b50a3f00d6932f718fc1f7258af886271f4887bb0b3af2a1859aae8adfbe31420db33009d4f2fafd4c6231fe10b98e1e547d6759f015dd
TLSH
T1E5D0A70764952C49A413E16344DB8043674151C34806AFC679D255639D5FA476626EEF
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ythn0ufw.mvm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ythn0ufw.mvm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2484-89-0x000001DBAB410000-0x000001DBAB411000-memory.dmp

Download

memory/2484-87-0x000001DBAB300000-0x000001DBAB301000-memory.dmp

Download

memory/2484-85-0x000001DBAB2D0000-0x000001DBAB2D1000-memory.dmp

Download

memory/2484-69-0x000001DB9AF60000-0x000001DB9AF70000-memory.dmp

Download

memory/2484-53-0x000001DB9AE60000-0x000001DB9AE70000-memory.dmp

Download

memory/2484-88-0x000001DBAB300000-0x000001DBAB301000-memory.dmp

Download

memory/2508-46-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Download

memory/2508-51-0x0000000005FD0000-0x0000000005FDA000-memory.dmp

Download

memory/2508-52-0x0000000006FD0000-0x0000000006FF6000-memory.dmp

Download

memory/2508-50-0x0000000006DF0000-0x0000000006E06000-memory.dmp

Download

memory/2508-49-0x0000000006D70000-0x0000000006D8A000-memory.dmp

Download

memory/2508-48-0x00000000073C0000-0x0000000007A3A000-memory.dmp

Download

memory/2508-47-0x00000000069F0000-0x0000000006A93000-memory.dmp

Download

memory/2508-22-0x0000000004460000-0x0000000004496000-memory.dmp

Download

memory/2508-23-0x0000000004AD0000-0x00000000050F8000-memory.dmp

Download

memory/2508-24-0x00000000051A0000-0x00000000051C2000-memory.dmp

Download

memory/2508-25-0x0000000005280000-0x00000000052E6000-memory.dmp

Download

memory/2508-37-0x0000000005FF0000-0x0000000006022000-memory.dmp

Download

memory/2508-26-0x00000000053A0000-0x0000000005406000-memory.dmp

Download

memory/2508-32-0x0000000005410000-0x0000000005764000-memory.dmp

Download

memory/2508-35-0x0000000005A20000-0x0000000005A3E000-memory.dmp

Download

memory/2508-36-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Download

memory/2508-38-0x000000006E7C0000-0x000000006E80C000-memory.dmp

Download

memory/2976-146-0x0000000007370000-0x0000000007406000-memory.dmp

Download

memory/2976-147-0x0000000006980000-0x00000000069A2000-memory.dmp

Download

memory/3356-5-0x00000000079F0000-0x00000000079FA000-memory.dmp

Download

memory/3356-107-0x0000000003790000-0x0000000003798000-memory.dmp

Download

memory/3356-17-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-16-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-14-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-15-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-11-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-10-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-9-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-8-0x000000000AFD0000-0x000000000AFF8000-memory.dmp

Download

memory/3356-7-0x000000000AEF0000-0x000000000AEFA000-memory.dmp

Download

memory/3356-6-0x000000000AF10000-0x000000000AFD2000-memory.dmp

Download

memory/3356-0-0x00000000008B0000-0x0000000002E6E000-memory.dmp

Download

memory/3356-12-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-18-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-104-0x0000000003260000-0x0000000003268000-memory.dmp

Download

memory/3356-4-0x0000000007980000-0x00000000079E6000-memory.dmp

Download

memory/3356-105-0x0000000009560000-0x000000000957A000-memory.dmp

Download

memory/3356-106-0x00000000034A0000-0x00000000034AA000-memory.dmp

Download

memory/3356-3-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-13-0x00000000078D0000-0x00000000078E0000-memory.dmp

Download

memory/3356-108-0x00000000038C0000-0x00000000038CA000-memory.dmp

Download

memory/3356-117-0x000000000B570000-0x000000000B588000-memory.dmp

Download

memory/3356-1-0x0000000007E90000-0x0000000008434000-memory.dmp

Download

memory/3356-2-0x00000000078E0000-0x0000000007972000-memory.dmp

Download

memory/4012-109-0x000000006E7C0000-0x000000006E80C000-memory.dmp

Download

memory/4012-100-0x00000000059D0000-0x0000000005D24000-memory.dmp

Download

memory/4776-129-0x000000006E7C0000-0x000000006E80C000-memory.dmp

Download

memory/4776-120-0x00000000062A0000-0x00000000065F4000-memory.dmp

Download