hxxps://dimensioncrystal[.]itch[.]io/900mbfilethattakes2000ormorememory

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	python-3.12.3-amd64.exe

Executes dropped EXE 13 IoCs

pid	Process
2820	python-3.12.3-amd64.exe
2040	python-3.12.3-amd64.exe
3348	python.exe
5776	python.exe
3980	pythonw.exe
1704	python-3.12.3-amd64.exe
5376	python-3.12.3-amd64.exe
3328	py.exe
4676	python.exe
4296	py.exe
1260	python.exe
4548	py.exe
5012	python.exe

Loads dropped DLL 55 IoCs

pid	Process
2040	python-3.12.3-amd64.exe
5508	MsiExec.exe
3348	python.exe
3348	python.exe
3348	python.exe
3348	python.exe
3348	python.exe
3348	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
5776	python.exe
3980	pythonw.exe
3980	pythonw.exe
5376	python-3.12.3-amd64.exe
4676	python.exe
4676	python.exe
4676	python.exe
4676	python.exe
4676	python.exe
4676	python.exe
4676	python.exe
1260	python.exe
1260	python.exe
1260	python.exe
1260	python.exe
1260	python.exe
1260	python.exe
1260	python.exe
5012	python.exe
5012	python.exe
5012	python.exe
5012	python.exe
5012	python.exe
5012	python.exe
5012	python.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	msiexec.exe
File created	C:\Windows\Installer\e5b9faa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fb0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C1C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fbf.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fa0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fe7.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B6E8CDD-4B1F-489F-A003-95DD254D80F4}	msiexec.exe
File created	C:\Windows\Installer\e5b9f88.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9f9c.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fb4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E31B1941-6AD3-4D67-ADF7-80E69E20A1E6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4997.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fce.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D7368C2B-E162-4961-B5CF-CBE0AB811FFF}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fa6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D27.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b9fb0.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fb5.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7A68B338-EE93-49B0-BDF9-31933A763F3C}	msiexec.exe
File created	C:\Windows\Installer\e5b9f92.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fb5.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fa1.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fd8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File created	C:\Windows\Installer\e5b9f9b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F46.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E524C14F-DE35-4E62-ABDD-CBB3D4D41638}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI437A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b9fcd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1696.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b9fe1.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9feb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9f88.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fce.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9f8c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6DD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b9fab.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fba.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA}	msiexec.exe
File created	C:\Windows\Installer\e5b9f91.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fa1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF58E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fab.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9fbe.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{79F57949-6D0D-4861-8087-B4C06689DE52}	msiexec.exe
File created	C:\Windows\Installer\e5b9fe7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9f92.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9f96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1628.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b9fc3.msi	msiexec.exe
File created	C:\Windows\Installer\e5b9f97.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC600.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b9fd7.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C1D07402-395F-47E5-A213-8AF9393F81FC}	msiexec.exe
File created	C:\Windows\Installer\e5b9f8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB41D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fc4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9fd3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b9f97.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\ = "{837260D6-3959-452B-A557-666302BEA663}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}\ = "{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{703EB43F-600F-4FBE-8CBC-564B1416A475}\DisplayName = "Python 3.12.3 Test Suite (64-bit debug)"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4084619521-2220719027-1909462854-1000\{10CBD0C3-6CCB-4F48-8FE6-991399AD16AB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.pyd\ = "Python.Extension"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{E524C14F-DE35-4E62-ABDD-CBB3D4D41638}\ = "{E524C14F-DE35-4E62-ABDD-CBB3D4D41638}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\ = "{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\DisplayName = "Python 3.12.3 Tcl/Tk Support (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{C26019C0-7147-478C-9821-E9E447C153F3}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\DisplayName = "Python Launcher"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.NoConFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{C26019C0-7147-478C-9821-E9E447C153F3}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{E31B1941-6AD3-4D67-ADF7-80E69E20A1E6}\ = "{E31B1941-6AD3-4D67-ADF7-80E69E20A1E6}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\DisplayName = "Python 3.12.3 Executables (64-bit)"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.File\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{7A68B338-EE93-49B0-BDF9-31933A763F3C}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{703EB43F-600F-4FBE-8CBC-564B1416A475}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.File\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\DisplayName = "Python 3.12.3 Executables (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{79F57949-6D0D-4861-8087-B4C06689DE52}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}\ = "{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\ = "{575FEF7A-71FE-437E-91B0-D3838C1026DA}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.File\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.File\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.NoConFile\Shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}\ = "{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{D0A35B98-1897-48CA-A1B8-2DF24BC768A5}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{79F57949-6D0D-4861-8087-B4C06689DE52}\ = "{79F57949-6D0D-4861-8087-B4C06689DE52}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.pyc	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.ArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\DisplayName = "Python 3.12.3 Tcl/Tk Support (64-bit)"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.File\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{E31B1941-6AD3-4D67-ADF7-80E69E20A1E6}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{D7368C2B-E162-4961-B5CF-CBE0AB811FFF}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{C1D07402-395F-47E5-A213-8AF9393F81FC}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\ = "{837260D6-3959-452B-A557-666302BEA663}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.pyw\ = "Python.NoConFile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Installer\Dependencies\{F0104AC4-11E8-4FEF-B0C5-22E324D2430B}\DisplayName = "Python 3.12.3 Executables (64-bit symbols)"	python-3.12.3-amd64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 815027.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
1892	msedge.exe
1892	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
1976	msedge.exe
1976	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
3532	msedge.exe
3532	msedge.exe
2236	msedge.exe
2236	msedge.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2040	python-3.12.3-amd64.exe
Token: SeIncreaseQuotaPrivilege	2040	python-3.12.3-amd64.exe
Token: SeSecurityPrivilege	4908	msiexec.exe
Token: SeCreateTokenPrivilege	2040	python-3.12.3-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	2040	python-3.12.3-amd64.exe
Token: SeLockMemoryPrivilege	2040	python-3.12.3-amd64.exe
Token: SeIncreaseQuotaPrivilege	2040	python-3.12.3-amd64.exe
Token: SeMachineAccountPrivilege	2040	python-3.12.3-amd64.exe
Token: SeTcbPrivilege	2040	python-3.12.3-amd64.exe
Token: SeSecurityPrivilege	2040	python-3.12.3-amd64.exe
Token: SeTakeOwnershipPrivilege	2040	python-3.12.3-amd64.exe
Token: SeLoadDriverPrivilege	2040	python-3.12.3-amd64.exe
Token: SeSystemProfilePrivilege	2040	python-3.12.3-amd64.exe
Token: SeSystemtimePrivilege	2040	python-3.12.3-amd64.exe
Token: SeProfSingleProcessPrivilege	2040	python-3.12.3-amd64.exe
Token: SeIncBasePriorityPrivilege	2040	python-3.12.3-amd64.exe
Token: SeCreatePagefilePrivilege	2040	python-3.12.3-amd64.exe
Token: SeCreatePermanentPrivilege	2040	python-3.12.3-amd64.exe
Token: SeBackupPrivilege	2040	python-3.12.3-amd64.exe
Token: SeRestorePrivilege	2040	python-3.12.3-amd64.exe
Token: SeShutdownPrivilege	2040	python-3.12.3-amd64.exe
Token: SeDebugPrivilege	2040	python-3.12.3-amd64.exe
Token: SeAuditPrivilege	2040	python-3.12.3-amd64.exe
Token: SeSystemEnvironmentPrivilege	2040	python-3.12.3-amd64.exe
Token: SeChangeNotifyPrivilege	2040	python-3.12.3-amd64.exe
Token: SeRemoteShutdownPrivilege	2040	python-3.12.3-amd64.exe
Token: SeUndockPrivilege	2040	python-3.12.3-amd64.exe
Token: SeSyncAgentPrivilege	2040	python-3.12.3-amd64.exe
Token: SeEnableDelegationPrivilege	2040	python-3.12.3-amd64.exe
Token: SeManageVolumePrivilege	2040	python-3.12.3-amd64.exe
Token: SeImpersonatePrivilege	2040	python-3.12.3-amd64.exe
Token: SeCreateGlobalPrivilege	2040	python-3.12.3-amd64.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2740	1892	msedge.exe	87
PID 1892 wrote to memory of 2740	1892	msedge.exe	87
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 4048	1892	msedge.exe	88
PID 1892 wrote to memory of 1000	1892	msedge.exe	89
PID 1892 wrote to memory of 1000	1892	msedge.exe	89
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90
PID 1892 wrote to memory of 4884	1892	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dimensioncrystal.itch.io/900mbfilethattakes2000ormorememory
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac52546f8,0x7ffac5254708,0x7ffac5254718
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:2820
- - C:\Windows\Temp\{C5E931CD-A1B9-4902-A09F-4C68129995AA}\.cr\python-3.12.3-amd64.exe
    "C:\Windows\Temp\{C5E931CD-A1B9-4902-A09F-4C68129995AA}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
      "C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.python.org/3.12/using/windows.html
      4⤵
      PID:6000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffac52546f8,0x7ffac5254708,0x7ffac5254718
        5⤵
        
        PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14973207568527284398,15731176363529533850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4cc
1⤵
PID:2208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4344

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E30C44876CA0F80B47B80571853AFDF4
  2⤵
  - Loads dropped DLL
  PID:5508
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3348
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpmkoeqxvp\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpmkoeqxvp', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5776

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3296

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
1⤵
- Executes dropped EXE
PID:1704
- C:\Windows\Temp\{06FD0AD0-F425-4A77-98AD-13964A012184}\.cr\python-3.12.3-amd64.exe
  "C:\Windows\Temp\{06FD0AD0-F425-4A77-98AD-13964A012184}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=696
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  PID:5376
- - C:\Users\Admin\AppData\Local\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4676
- - C:\Users\Admin\AppData\Local\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -O -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -O -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1260
- - C:\Users\Admin\AppData\Local\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -OO -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -OO -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4cc
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery