6f80eddcda8478e3756dcd982b3e031ddb8ef96bc78b5fe550f189a301c69560

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{e15803b8-d809-47f3-8818-73f0d155cf58} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{e15803b8-d809-47f3-8818-73f0d155cf58}\\python-3.10.5-amd64.exe\" /burn.runonce"	python-3.10.5-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	camo.githubusercontent.com
53	camo.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFDC7988983D90E807.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF111D2AAA20B73BF4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0F1A832EF0117A88.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e62d990.msi	msiexec.exe
File created	C:\Windows\Installer\e62d994.msi	msiexec.exe
File created	C:\Windows\Installer\e62d99f.msi	msiexec.exe
File created	C:\Windows\Installer\e62d98f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11C8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE23F17276B9B84F3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9AFF6A355B17872D.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5b2f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B22B5FB8C7FB36B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8169.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1DCA000B2970F243.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF96D687E5041211CE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1E101285C4D8489A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5b49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e62d98b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5b26.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4ED6B145D35D836B.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BD32BDE9-835D-4013-8F9A-45FF11456F02}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e62d980.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6B7B347202BA6446.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5b43.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A10B52110C03AC1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e62d977.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE143100598C6E88B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1234.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF648A12E5D051F12B.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF85823EDC046F4F38.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	msiexec.exe
File created	C:\Windows\Installer\e5a5b35.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5b52.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7B0F6EAD-C8A1-4496-8492-801EDE1A6323}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{67F90672-C696-4DBB-8F33-95CCCFA21DCE}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7E74D7FC71331079.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE7246D9BDD8A5D9E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBFA6C5FE6021AA50.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5b4e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{496B2CAE-CF79-440A-82F1-7587559ABA00}	msiexec.exe
File created	C:\Windows\Installer\e62d986.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF27F5B175BCD1B981.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7245.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5b3a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3D497B2D82DCC3F7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F88.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF44D1C626D09A807.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CF6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF15D35FCD87B201A3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6EAE4F1BF9B8393F.TMP	msiexec.exe
File created	C:\Windows\Installer\e62d985.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A90183988AD69A8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF01F4ADFD3848B6F4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD53FE4CF08BA2663.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5b44.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7778.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5b4e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D552469C-E810-468F-A139-1EA43D0E2BE0}	msiexec.exe
File created	C:\Windows\Installer\e62d99a.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133536076342517248"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{67F90672-C696-4DBB-8F33-95CCCFA21DCE}\DisplayName = "Python 3.10.5 Standard Library (64-bit)"	python-3.10.5-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\DisplayName = "Python 3.12.2 Core Interpreter (64-bit)"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{3B36061E-A25F-4E12-BFD1-68E724723D48}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{3B36061E-A25F-4E12-BFD1-68E724723D48}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{D552469C-E810-468F-A139-1EA43D0E2BE0}\ = "{D552469C-E810-468F-A139-1EA43D0E2BE0}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{514A924A-361B-4BF4-8FD0-1A431CE7C56E}\Dependents	python-3.10.5-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\ = "{4534F2ED-1616-434D-98A6-0DA358DCD466}"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\.pyw	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\.pyw\Content Type = "text/x-python"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{0FE1250F-6DD6-4948-B211-741B7CDBB335}	python-3.10.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",2"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\ = "{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{7F7E3C5D-2A37-4F1D-8E8C-3BB073D36BFE}\Dependents\{e15803b8-d809-47f3-8818-73f0d155cf58}	python-3.10.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell\editwithidle\shell\edit312	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{496B2CAE-CF79-440A-82F1-7587559ABA00}	python-3.10.5-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{269FCA5D-D0CF-43B2-B656-24DF6DAA0D4E}\ = "{269FCA5D-D0CF-43B2-B656-24DF6DAA0D4E}"	python-3.10.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.NoConFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.ArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.NoConFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.CompiledFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{67F90672-C696-4DBB-8F33-95CCCFA21DCE}\Version = "3.10.5150.0"	python-3.10.5-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.NoConFile\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{BBD9CCC0-981B-4976-91EC-4C1E637BCF85}\Version = "3.10.5150.0"	python-3.10.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{D552469C-E810-468F-A139-1EA43D0E2BE0}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{67F90672-C696-4DBB-8F33-95CCCFA21DCE}\ = "{67F90672-C696-4DBB-8F33-95CCCFA21DCE}"	python-3.10.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell\editwithidle	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{67F90672-C696-4DBB-8F33-95CCCFA21DCE}\Dependents	python-3.10.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{3BC23B98-3D25-4A74-98FD-A1BE957A1340}	python-3.10.5-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{C3B084B6-D193-4633-BBB4-E890AAB946A2}\ = "{C3B084B6-D193-4633-BBB4-E890AAB946A2}"	python-3.10.5-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6178a40-1665-4565-b73e-48dd6e039a65}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{BBD9CCC0-981B-4976-91EC-4C1E637BCF85}\Dependents\{e15803b8-d809-47f3-8818-73f0d155cf58}	python-3.10.5-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit310	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Installer\Dependencies\{3B36061E-A25F-4E12-BFD1-68E724723D48}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Python.File\Shell\editwithidle\shell\edit310\command	msiexec.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Discord-Boost-Tool-main.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\python-3.12.2-amd64.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\python-3.10.5-amd64.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\EZ-Discord-Raider-main.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
1240	chrome.exe
1240	chrome.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
4896	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe
3616	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3128	OpenWith.exe
4860	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of SetWindowsHookEx 54 IoCs

pid	Process
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
4860	OpenWith.exe
1948	AcroRd32.exe
1948	AcroRd32.exe
1948	AcroRd32.exe
1948	AcroRd32.exe
4888	OpenWith.exe
3668	AcroRd32.exe
3668	AcroRd32.exe
3668	AcroRd32.exe
3668	AcroRd32.exe
3752	OpenWith.exe
5056	OpenWith.exe
5812	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4120	3344	chrome.exe	82
PID 3344 wrote to memory of 4120	3344	chrome.exe	82
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 2200	3344	chrome.exe	88
PID 3344 wrote to memory of 1720	3344	chrome.exe	84
PID 3344 wrote to memory of 1720	3344	chrome.exe	84
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87
PID 3344 wrote to memory of 1932	3344	chrome.exe	87

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Boost-Tool
1⤵
PID:1116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8554e9758,0x7ff8554e9768,0x7ff8554e9778
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3180 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4464 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5072 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4980 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6040 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6016 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4632 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6056 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2328 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5796 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4948 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5460 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1060 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:1944
- C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Windows\Temp\{1F03F8B4-3D51-4046-A030-B603C0CDADB2}\.cr\python-3.12.2-amd64.exe
    "C:\Windows\Temp\{1F03F8B4-3D51-4046-A030-B603C0CDADB2}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3296 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3412 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5168 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6548 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5180 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5532 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6500 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6960 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=7164 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6548 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6444 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5092 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6400 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6764 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6136 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=5284 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=956 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=6436 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=2356 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3884 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6668 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6828 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6644 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:3144
- C:\Users\Admin\Downloads\python-3.10.5-amd64.exe
  "C:\Users\Admin\Downloads\python-3.10.5-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:748
- - C:\Windows\Temp\{BF661C19-CFE6-47DA-9E70-78C3228A73AE}\.cr\python-3.10.5-amd64.exe
    "C:\Windows\Temp\{BF661C19-CFE6-47DA-9E70-78C3228A73AE}\.cr\python-3.10.5-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.10.5-amd64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=752
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    PID:4508
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe
      "C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"
      4⤵
      Executes dropped EXE
      PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=1740 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=3352 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=1548 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=1152 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5092 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=1840 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=5256 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=3468 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1856,i,14340544476762425975,5961996189282200444,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:5840

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\input\3m_tokens.txt
1⤵
PID:4560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\error_boosting.txt
1⤵
PID:956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4860
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\README.md"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:488
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1DC01D63419EE6B787DE7A95706D774 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EA1B16892596E2F2E2A13422E1E7C7E2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EA1B16892596E2F2E2A13422E1E7C7E2 --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=24BB4585D2437D9E6FD7A3CDC96E0D4A --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B20EF2EB3C987F14A01489D6E83F67DF --mojo-platform-channel-handle=2180 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2648654E06CE9BCBBC845BD6E6C6F2A5 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\start.bat" "
1⤵
PID:3812
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python main.py
  2⤵
  PID:2844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4896
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E50303BBEAC6544A0AD97A454C00D870
  2⤵
  - Loads dropped DLL
  PID:5076
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4648
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp_egcruhi\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp_egcruhi', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3408

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:2932
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1052

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:2412
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4636

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:2648
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4008

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-Boost-Tool-main.zip\Discord-Boost-Tool-main\README.md"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3668
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:1508
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=696F2448B8B4B088EE525391BBFA504B --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3776
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D6A8708AC70876F7512958EC70F19016 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D6A8708AC70876F7512958EC70F19016 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3392
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=894D43BF6446EBF7E4BF1B86A2471718 --mojo-platform-channel-handle=2184 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2140
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0BDB9F6EE84BD92A6DBDE994244D9622 --mojo-platform-channel-handle=2528 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2636
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EBEE7132825123CB97478EE20D196A94 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2184

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:3292
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3552

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:3932
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\start.bat" "
1⤵
PID:1180
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:424

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:5076
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2752

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:3356
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2640

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:2184
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\start.bat" "
1⤵
PID:2488
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3752

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:3556
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3436

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\input\proxies.txt
1⤵
PID:2912

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:3420
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1184

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:3260
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1452

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:3808
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1572

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:920
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:648

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E0
1⤵
PID:3940

C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
1⤵
- Executes dropped EXE
PID:900
- C:\Windows\Temp\{577370EF-D79C-45A0-8497-172FDD38A89B}\.cr\python-3.12.2-amd64.exe
  "C:\Windows\Temp\{577370EF-D79C-45A0-8497-172FDD38A89B}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=568
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  PID:2180

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3616
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FDB0F895CB84815F5472271811826BAD
  2⤵
  - Loads dropped DLL
  PID:244
- - C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1624
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbc8_aul5\\setuptools-58.1.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbc8_aul5\\pip-22.0.4-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpbc8_aul5', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      PID:2316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe"
1⤵
- Executes dropped EXE
PID:1616

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:4620
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  PID:4260

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
1⤵
- Executes dropped EXE
PID:2124
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\main.py"
  2⤵
  - Executes dropped EXE
  PID:3024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\start.bat" "
1⤵
PID:3812
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  PID:5048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\start.bat" "
1⤵
PID:4648
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  PID:2372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Discord-Boost-Tool-main\Discord-Boost-Tool-main\start.bat" "
1⤵
PID:4800
- C:\Users\Admin\AppData\Local\Programs\Python\Python310\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  PID:1480

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
1⤵
- Executes dropped EXE
PID:5264
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
  2⤵
  - Executes dropped EXE
  PID:5360

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
1⤵
- Executes dropped EXE
PID:5412
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
  2⤵
  - Executes dropped EXE
  PID:5452

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
1⤵
- Executes dropped EXE
PID:5388
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
  2⤵
  - Executes dropped EXE
  PID:3208

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
1⤵
- Executes dropped EXE
PID:3024
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
  2⤵
  - Executes dropped EXE
  PID:5480

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
1⤵
- Executes dropped EXE
PID:2084
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
  2⤵
  - Executes dropped EXE
  PID:1716

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\tokens.txt
1⤵
PID:4764

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\massleave.py"
1⤵
- Executes dropped EXE
PID:1308
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\massleave.py"
  2⤵
  - Executes dropped EXE
  PID:900

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
1⤵
- Executes dropped EXE
PID:3704
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
  2⤵
  - Executes dropped EXE
  PID:784

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
1⤵
- Executes dropped EXE
PID:4420
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_EZ-Discord-Raider-main.zip\EZ-Discord-Raider-main\raider.py"
  2⤵
  - Executes dropped EXE
  PID:5776

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery