bitrat | hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqa1JDd3Bpd0lmZmJYYnEwWEFHYnAydEpSMWtMZ3xBQ3Jtc0ttdEh4WnRUWmZCUVpPMVVMM01ob2dFTlFJSnloYkdtWGFOd0JCaGFFR3cwTms1RnctdUJXdmJhN1p1OFZVbDZycUtNTXdvakQzOGt4Rzl1MFgwRHhNUXpLWms0aVB3WjNPR3Q1Qmc4UG9sMjB5Z0dhcw&q=https%3A%2F%2Fanonfiles[.]com%2FR1Vebf30p4%2FDiscord_Spammer_rar&v=orNVCha9N2I

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	tokengen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	tokengen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	tokengen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	python-3.11.2-amd64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	tokengen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 57 IoCs

pid	Process
3736	spammer.exe
3540	spammer.exe
5112	tokengen.exe
1968	python-3.11.2-amd64.exe
1996	python-3.11.2-amd64.exe
3444	python-3.11.2-amd64.exe
1912	tokengen.exe
3180	tokengen.exe
4392	tokengen.exe
4308	python.exe
552	python.exe
4704	spammer.exe
1340	py.exe
848	py.exe
2464	tokengen.exe
3400	python.exe
964	python.exe
996	python.exe
3264	spammer.exe
3936	py.exe
4968	py.exe
988	tokengen.exe
1160	python.exe
3472	python.exe
4000	python.exe
1492	spammer.exe
2268	py.exe
4728	py.exe
4784	tokengen.exe
2892	python.exe
4596	python.exe
1136	python.exe
4656	tokengen.exe
4580	tokengen.exe
1540	tokengen.exe
4728	py.exe
1792	python.exe
4984	spammer.exe
3204	py.exe
1732	py.exe
112	tokengen.exe
3972	python.exe
3836	python.exe
4792	python.exe
3480	python.exe
4628	py.exe
4180	python.exe
3352	tokengen.exe
4956	py.exe
1520	python.exe
2104	py.exe
4728	python.exe
1744	py.exe
868	python.exe
2092	python.exe
1292	python.exe
4236	python.exe

Loads dropped DLL 64 IoCs

pid	Process
1996	python-3.11.2-amd64.exe
4404	MsiExec.exe
4308	python.exe
4308	python.exe
4308	python.exe
4308	python.exe
4308	python.exe
4308	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
552	python.exe
3400	python.exe
3400	python.exe
964	python.exe
964	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
964	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
3400	python.exe
996	python.exe
996	python.exe
1160	python.exe
1160	python.exe
1160	python.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	python-3.11.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{4d5f29cf-3d3f-455f-bd47-5a52fb830b25} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{4d5f29cf-3d3f-455f-bd47-5a52fb830b25}\\python-3.11.2-amd64.exe\" /burn.runonce"	python-3.11.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
187	api.ipify.org
188	api.ipify.org
196	api.ipify.org
204	api.ipify.org
619	api.ipify.org
620	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4392	tokengen.exe
4392	tokengen.exe
4392	tokengen.exe
4392	tokengen.exe
4580	tokengen.exe
1540	tokengen.exe
3352	tokengen.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 4392	5112	tokengen.exe	178
PID 2464 set thread context of 4580	2464	tokengen.exe	265
PID 4784 set thread context of 1540	4784	tokengen.exe	286
PID 112 set thread context of 3352	112	tokengen.exe	349

Drops file in Windows directory 59 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5993a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB500.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993bb.msi	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D6BE8071-9505-4EE4-9E42-916584C2D21C}	msiexec.exe
File opened for modification	C:\Windows\Installer\e59939f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2DD.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F13A394-E3EA-4585-9ADE-046B69F1F902}	msiexec.exe
File created	C:\Windows\Installer\e5993bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59939b.msi	msiexec.exe
File created	C:\Windows\Installer\e5993b7.msi	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File created	C:\Windows\Installer\e5993c2.msi	msiexec.exe
File created	C:\Windows\Installer\e59939b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F5C7063-8305-4755-A643-32DE2BE966F9}	msiexec.exe
File created	C:\Windows\Installer\{C28EE783-FA9C-4E09-910E-181A4A28C29C}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993a7.msi	msiexec.exe
File created	C:\Windows\Installer\e5993ae.msi	msiexec.exe
File created	C:\Windows\Installer\e5993af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78B1.tmp	msiexec.exe
File created	C:\Windows\Installer\e5993b3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993b3.msi	msiexec.exe
File created	C:\Windows\Installer\e59939f.msi	msiexec.exe
File created	C:\Windows\Installer\e59939e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A15F08D3-26E4-4F0B-BA8B-ED59A52D6A02}	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA688.tmp	msiexec.exe
File created	C:\Windows\Installer\e5993a2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993bf.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993b7.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6E84DCAA-19DD-4560-AAE7-043EADF5C1F8}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0D38B9A4-4312-465D-A472-450BF75A0460}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1081.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID26C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C28EE783-FA9C-4E09-910E-181A4A28C29C}\ARPIcon	msiexec.exe
File created	C:\Windows\Installer\e5993ba.msi	msiexec.exe
File created	C:\Windows\Installer\e5993aa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C65.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9959.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C28EE783-FA9C-4E09-910E-181A4A28C29C}	msiexec.exe
File created	C:\Windows\Installer\e5993bf.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6C19B2EE-FA34-4270-A87F-1FF008C1AC6E}	msiexec.exe
File created	C:\Windows\Installer\e5993a6.msi	msiexec.exe
File created	C:\Windows\Installer\e5993a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5993a3.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6CE85987-8440-409D-BE75-F5128943F67B}	msiexec.exe
File created	C:\Windows\Installer\e5993b6.msi	msiexec.exe
File created	C:\Windows\Installer\e5993be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D50.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{83C32D05-F3C4-4D61-877E-0A4C6717E7DC}	msiexec.exe
File created	C:\Windows\Installer\e5993b2.msi	msiexec.exe
File created	C:\Windows\Installer\e5993ab.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2280	schtasks.exe
2924	schtasks.exe
620	schtasks.exe
828	schtasks.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Python.File\Shell\editwithidle	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{0D38B9A4-4312-465D-A472-450BF75A0460}\Version = "3.11.2150.0"	python-3.11.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{1F5C7063-8305-4755-A643-32DE2BE966F9}\Dependents\{4d5f29cf-3d3f-455f-bd47-5a52fb830b25}	python-3.11.2-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\387EE82CC9AF90E419E081A1A4822CC9\Version = "51054694"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\CPython-3.11\Dependents	python-3.11.2-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{0D38B9A4-4312-465D-A472-450BF75A0460}	python-3.11.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyc	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyd	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.Extension\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{0D38B9A4-4312-465D-A472-450BF75A0460}\ = "{0D38B9A4-4312-465D-A472-450BF75A0460}"	python-3.11.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Python.File\Shell\editwithidle\Subcommands	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{1F5C7063-8305-4755-A643-32DE2BE966F9}\DisplayName = "Python 3.11.2 Documentation (64-bit)"	python-3.11.2-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\387EE82CC9AF90E419E081A1A4822CC9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{1F5C7063-8305-4755-A643-32DE2BE966F9}\ = "{1F5C7063-8305-4755-A643-32DE2BE966F9}"	python-3.11.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{D6BE8071-9505-4EE4-9E42-916584C2D21C}\Version = "3.11.2150.0"	python-3.11.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\387EE82CC9AF90E419E081A1A4822CC9\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\387EE82CC9AF90E419E081A1A4822CC9\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C28EE783-FA9C-4E09-910E-181A4A28C29C}v3.11.2150.0\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit311\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python311\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit311	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",2"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{6C19B2EE-FA34-4270-A87F-1FF008C1AC6E}\ = "{6C19B2EE-FA34-4270-A87F-1FF008C1AC6E}"	python-3.11.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\ = "Python File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{6F13A394-E3EA-4585-9ADE-046B69F1F902}\Dependents	python-3.11.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\387EE82CC9AF90E419E081A1A4822CC9\DeploymentFlags = "2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{A15F08D3-26E4-4F0B-BA8B-ED59A52D6A02}\Version = "3.11.2150.0"	python-3.11.2-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyw\ = "Python.NoConFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies	python-3.11.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\387EE82CC9AF90E419E081A1A4822CC9\SourceList\PackageName = "launcher.msi"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{6C19B2EE-FA34-4270-A87F-1FF008C1AC6E}\Version = "3.11.2150.0"	python-3.11.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\{D6BE8071-9505-4EE4-9E42-916584C2D21C}	python-3.11.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Installer\Dependencies\CPython-3.11\Dependents\{4d5f29cf-3d3f-455f-bd47-5a52fb830b25}	python-3.11.2-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\387EE82CC9AF90E419E081A1A4822CC9\AuthorizedLUAApp = "0"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local:21-02-2023	tokengen.exe
File opened for modification	C:\Users\Admin\AppData\Local:21-02-2023	tokengen.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
3352	7zFM.exe
3352	7zFM.exe
3352	7zFM.exe
3352	7zFM.exe
5112	tokengen.exe
5112	tokengen.exe
4856	chrome.exe
4856	chrome.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
5112	tokengen.exe
5112	tokengen.exe
5112	tokengen.exe
5112	tokengen.exe
5112	tokengen.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
1592	msiexec.exe
2464	tokengen.exe
2464	tokengen.exe
988	tokengen.exe
988	tokengen.exe
4784	tokengen.exe
4784	tokengen.exe
2464	tokengen.exe
2464	tokengen.exe
2464	tokengen.exe
1196	chrome.exe
1196	chrome.exe
4784	tokengen.exe
4152	chrome.exe
4152	chrome.exe
112	tokengen.exe
112	tokengen.exe
112	tokengen.exe
1804	chrome.exe
1804	chrome.exe
1132	chrome.exe
1132	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3352	7zFM.exe
4392	tokengen.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4156	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4900	OpenWith.exe
4392	tokengen.exe
4392	tokengen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2276	4696	chrome.exe	85
PID 4696 wrote to memory of 2276	4696	chrome.exe	85
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 5112	4696	chrome.exe	86
PID 4696 wrote to memory of 4916	4696	chrome.exe	87
PID 4696 wrote to memory of 4916	4696	chrome.exe	87
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88
PID 4696 wrote to memory of 1960	4696	chrome.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
848	attrib.exe
4284	attrib.exe
4348	attrib.exe
3644	attrib.exe
1076	attrib.exe
3304	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa1JDd3Bpd0lmZmJYYnEwWEFHYnAydEpSMWtMZ3xBQ3Jtc0ttdEh4WnRUWmZCUVpPMVVMM01ob2dFTlFJSnloYkdtWGFOd0JCaGFFR3cwTms1RnctdUJXdmJhN1p1OFZVbDZycUtNTXdvakQzOGt4Rzl1MFgwRHhNUXpLWms0aVB3WjNPR3Q1Qmc4UG9sMjB5Z0dhcw&q=https%3A%2F%2Fanonfiles.com%2FR1Vebf30p4%2FDiscord_Spammer_rar&v=orNVCha9N2I
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec4339758,0x7ffec4339768,0x7ffec4339778
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:1
  2⤵
  PID:528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4804 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5372 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4828 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5016 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1788,i,7737706109310488887,15246568105075451343,131072 /prefetch:8
  2⤵
  PID:4612

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1844

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Discord Spammer.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3352
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO81DB16C7\Read Me.txt
  2⤵
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\7zO81D21608\spammer.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO81D21608\spammer.exe"
  2⤵
  - Executes dropped EXE
  PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
    3⤵
    PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
      4⤵
      Views/modifies file attributes
      PID:848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp58574.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp58574.bat"
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp59064.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp59064.exe"
    3⤵
    PID:392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp58574.bat "C:\Users\Admin\AppData\Local\Temp\7zO81D21608\spammer.exe"
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp58574.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp58574.bat"
    3⤵
    PID:244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp59064.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp59064.exe"
    3⤵
    PID:2280

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Discord Spammer\" -ad -an -ai#7zMap14459:92:7zEvent29214
1⤵
PID:4428

C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe
"C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
1⤵
- Executes dropped EXE
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"
  2⤵
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
  2⤵
  PID:3212
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
    3⤵
    - Views/modifies file attributes
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp97544.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp97544.bat"
  2⤵
  PID:4160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85514.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85514.exe"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp97544.bat "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
  2⤵
  PID:3808
- - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
    RTBFiles\tokengen.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:5112
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HryKpWXXRaDA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF6F4.tmp"
      4⤵
      Creates scheduled task(s)
      PID:620
  - - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1912
  - - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:3180
  - - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      NTFS ADS
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:4392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp97544.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp97544.bat"
  2⤵
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85514.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85514.exe"
  2⤵
  PID:2812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffec4339758,0x7ffec4339768,0x7ffec4339778
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:2
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4720 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5012 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5148 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5340 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5164 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5560 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6140 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6000 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6740 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3960 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:1336
- C:\Users\Admin\Downloads\python-3.11.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.11.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Windows\Temp\{73BC7365-AB47-4205-81F6-9EB0D7C0C75D}\.cr\python-3.11.2-amd64.exe
    "C:\Windows\Temp\{73BC7365-AB47-4205-81F6-9EB0D7C0C75D}\.cr\python-3.11.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.2-amd64.exe" -burn.filehandle.attached=720 -burn.filehandle.self=568
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    PID:1996
  - - C:\Windows\Temp\{2EE3C8F3-E8A2-4ABC-A89E-139D0FE9BF7A}\.be\python-3.11.2-amd64.exe
      "C:\Windows\Temp\{2EE3C8F3-E8A2-4ABC-A89E-139D0FE9BF7A}\.be\python-3.11.2-amd64.exe" -q -burn.elevated BurnPipe.{D0620173-22C3-49CE-A55C-18E5BFC197F7} {27CFFFB3-2361-427C-A7F2-091449CF8760} 1996
      4⤵
      Executes dropped EXE
      PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3120 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2384 --field-trial-handle=1948,i,222471969085489056,12850830290734662701,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec4339758,0x7ffec4339768,0x7ffec4339778
  2⤵
  PID:2396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4456

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 31F4D4A8C931FE349020A4E238F45D48
  2⤵
  - Loads dropped DLL
  PID:4404
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4308
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpwsa_c_nb\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpwsa_c_nb\\pip-22.3.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpwsa_c_nb', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2760

C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe
"C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
1⤵
- Executes dropped EXE
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
  2⤵
  PID:60
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"
  2⤵
  PID:4004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
  2⤵
  PID:3020
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
    3⤵
    - Views/modifies file attributes
    PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp49044.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp49044.bat"
  2⤵
  PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85984.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85984.exe"
  2⤵
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp49044.bat "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:1232
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
    3⤵
    - Executes dropped EXE
    PID:1340
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -m pip install PySimpleGUI --user --upgrade
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:996
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
    3⤵
    - Executes dropped EXE
    PID:848
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:964
- - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
    RTBFiles\tokengen.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:2464
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HryKpWXXRaDA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp73DB.tmp"
      4⤵
      Creates scheduled task(s)
      PID:828
  - - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:4656
  - - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp49044.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp49044.bat"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85984.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp85984.exe"
  2⤵
  PID:1428

C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe
"C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
1⤵
- Executes dropped EXE
PID:3264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
  2⤵
  PID:1460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
  2⤵
  PID:4344
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
    3⤵
    - Views/modifies file attributes
    PID:3644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp31654.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp31654.bat"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp20054.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp20054.exe"
  2⤵
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp31654.bat "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
  2⤵
  - Checks computer location settings
  PID:4424
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
    3⤵
    - Executes dropped EXE
    PID:3936
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -m pip install PySimpleGUI --user --upgrade
        5⤵
        Executes dropped EXE
        
        PID:4000
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
    3⤵
    - Executes dropped EXE
    PID:4968
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
      4⤵
      Executes dropped EXE
      PID:3472
- - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
    RTBFiles\tokengen.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp31654.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp31654.bat"
  2⤵
  PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp20054.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp20054.exe"
  2⤵
  PID:1092

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4064

C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe
"C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
1⤵
- Executes dropped EXE
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
  2⤵
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"
  2⤵
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
  2⤵
  PID:848
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
    3⤵
    - Views/modifies file attributes
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp13674.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp13674.bat"
  2⤵
  PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp83504.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp83504.exe"
  2⤵
  PID:3296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp13674.bat "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:2100
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
    3⤵
    - Executes dropped EXE
    PID:2268
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
      4⤵
      Executes dropped EXE
      PID:2892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -m pip install PySimpleGUI --user --upgrade
        5⤵
        Executes dropped EXE
        
        PID:1136
- - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
    RTBFiles\tokengen.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HryKpWXXRaDA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB515.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2280
  - - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1540
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
    3⤵
    - Executes dropped EXE
    PID:4728
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
      4⤵
      Executes dropped EXE
      PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp13674.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp13674.bat"
  2⤵
  PID:1460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp83504.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp83504.exe"
  2⤵
  PID:2108

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\requirements.txt
1⤵
PID:4916

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\requirements_mac.txt
1⤵
PID:368

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\install.log
1⤵
PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffec4339758,0x7ffec4339768,0x7ffec4339778
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4592 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4744 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4904 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4752 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2896 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3948 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2300 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=988 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5452 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2836 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4480 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4608 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4708 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5620 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=1620 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5784 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5756 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5948 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6208 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 --field-trial-handle=1884,i,7335161864580933795,17744206598034028176,131072 /prefetch:8
  2⤵
  PID:3644

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:2588

C:\Windows\py.exe
"C:\Windows\py.exe"
1⤵
- Executes dropped EXE
PID:4728
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  2⤵
  - Executes dropped EXE
  PID:1792

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\get-pip-main\" -ad -an -ai#7zMap2176:86:7zEvent5197
1⤵
PID:3804

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4396

C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe
"C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
1⤵
- Executes dropped EXE
PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
  2⤵
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"
  2⤵
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
    3⤵
    - Views/modifies file attributes
    PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp88664.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp88664.bat"
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp62524.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp62524.exe"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp88664.bat "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\spammer.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:244
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTB.py"
      4⤵
      Executes dropped EXE
      PID:3972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -m pip install PySimpleGUI --user --upgrade
        5⤵
        Executes dropped EXE
        
        PID:4792
- - C:\Windows\py.exe
    "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
    3⤵
    - Executes dropped EXE
    PID:1732
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\attack_tok.py"
      4⤵
      Executes dropped EXE
      PID:3836
- - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
    RTBFiles\tokengen.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:112
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HryKpWXXRaDA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC1D5.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2924
  - - C:\Users\Admin\Downloads\Discord Spammer\Discord Spammer\tools\RTBFiles\tokengen.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp88664.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp88664.bat"
  2⤵
  PID:184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp62524.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp62524.exe"
  2⤵
  PID:3924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:4212
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python get pip
  2⤵
  - Executes dropped EXE
  PID:3480

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\pip.pyz"
1⤵
- Executes dropped EXE
PID:4628
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\AppData\Local\Programs\Python\Python311\pip.pyz"
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2964

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\pip.pyz"
1⤵
- Executes dropped EXE
PID:4956
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\AppData\Local\Programs\Python\Python311\pip.pyz"
  2⤵
  - Executes dropped EXE
  PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1968

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\pip.pyz"
1⤵
- Executes dropped EXE
PID:2104
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\AppData\Local\Programs\Python\Python311\pip.pyz"
  2⤵
  - Executes dropped EXE
  PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1740
- C:\Windows\system32\curl.exe
  curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
  2⤵
  PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec4339758,0x7ffec4339768,0x7ffec4339778
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4476 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:1
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4672 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5032 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3200 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=940 --field-trial-handle=1856,i,5268070425991336743,3282931413287214307,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1332

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1996

C:\Windows\py.exe
"C:\Windows\py.exe"
1⤵
- Executes dropped EXE
PID:1744
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  2⤵
  - Executes dropped EXE
  PID:868

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1824
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python get-pip.py,
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python get-pip.py
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4356

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4316
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python get-pip.py
  2⤵
  - Executes dropped EXE
  PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery