Overview
overview
7Static
static
3DiscordBoo...ol.exe
windows7-x64
7DiscordBoo...ol.exe
windows10-2004-x64
7DiscordRAT.vbs
windows7-x64
1DiscordRAT.vbs
windows10-2004-x64
1DiscordBoo...rp.dll
windows7-x64
1DiscordBoo...rp.dll
windows10-2004-x64
1DiscordBoo...on.dll
windows7-x64
1DiscordBoo...on.dll
windows10-2004-x64
1DiscordBoo...et.dll
windows7-x64
1DiscordBoo...et.dll
windows10-2004-x64
1Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 17:07
Behavioral task
behavioral1
Sample
DiscordBoostTool v1.35.0/DiscordBoostTool.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
DiscordBoostTool v1.35.0/DiscordBoostTool.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
DiscordRAT.vbs
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
DiscordRAT.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
DiscordBoostTool v1.35.0/GoSrp.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
DiscordBoostTool v1.35.0/GoSrp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
DiscordBoostTool v1.35.0/System.Windows.Controls.Ribbon.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
DiscordBoostTool v1.35.0/System.Windows.Controls.Ribbon.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
DiscordBoostTool v1.35.0/xNet.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
DiscordBoostTool v1.35.0/xNet.dll
Resource
win10v2004-20240611-en
General
-
Target
DiscordBoostTool v1.35.0/System.Windows.Controls.Ribbon.dll
-
Size
717KB
-
MD5
c938bb2a9537df587d9a4ce01de447b9
-
SHA1
8aee2b2e1c7c6786817a5136d011f8427ac9b92e
-
SHA256
c3fd046e992f96a0f4b729a6864d07f2320dc2f87fb34033874429c1f03b6931
-
SHA512
70eb8ee86a99f25dc9a35bad85e1dcb82dd16babbea6f2a9e540687caa96de3ccbd1205117820802853b3aa922a302183df8ec9c2cd459a4d5c111958de34e3b
-
SSDEEP
12288:CDZDWzv+aVPZDpPBi87JBIgu7PO447irbrM+murmje0Prjk3rNr0kzqA7+pHlj99:OmUzpXlzEOIF6HX6
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 17292 dwm.exe Token: SeChangeNotifyPrivilege 17292 dwm.exe Token: 33 17292 dwm.exe Token: SeIncBasePriorityPrivilege 17292 dwm.exe Token: SeShutdownPrivilege 17292 dwm.exe Token: SeCreatePagefilePrivilege 17292 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3236 wrote to memory of 1640 3236 rundll32.exe 83 PID 3236 wrote to memory of 1640 3236 rundll32.exe 83 PID 3236 wrote to memory of 1640 3236 rundll32.exe 83 PID 1640 wrote to memory of 2264 1640 rundll32.exe 85 PID 1640 wrote to memory of 2264 1640 rundll32.exe 85 PID 1640 wrote to memory of 2264 1640 rundll32.exe 85 PID 2264 wrote to memory of 3976 2264 rundll32.exe 86 PID 2264 wrote to memory of 3976 2264 rundll32.exe 86 PID 2264 wrote to memory of 3976 2264 rundll32.exe 86 PID 3976 wrote to memory of 3080 3976 rundll32.exe 87 PID 3976 wrote to memory of 3080 3976 rundll32.exe 87 PID 3976 wrote to memory of 3080 3976 rundll32.exe 87 PID 3080 wrote to memory of 1004 3080 rundll32.exe 88 PID 3080 wrote to memory of 1004 3080 rundll32.exe 88 PID 3080 wrote to memory of 1004 3080 rundll32.exe 88 PID 1004 wrote to memory of 60 1004 rundll32.exe 89 PID 1004 wrote to memory of 60 1004 rundll32.exe 89 PID 1004 wrote to memory of 60 1004 rundll32.exe 89 PID 60 wrote to memory of 4136 60 rundll32.exe 90 PID 60 wrote to memory of 4136 60 rundll32.exe 90 PID 60 wrote to memory of 4136 60 rundll32.exe 90 PID 4136 wrote to memory of 3768 4136 rundll32.exe 91 PID 4136 wrote to memory of 3768 4136 rundll32.exe 91 PID 4136 wrote to memory of 3768 4136 rundll32.exe 91 PID 3768 wrote to memory of 636 3768 rundll32.exe 92 PID 3768 wrote to memory of 636 3768 rundll32.exe 92 PID 3768 wrote to memory of 636 3768 rundll32.exe 92 PID 636 wrote to memory of 3120 636 rundll32.exe 93 PID 636 wrote to memory of 3120 636 rundll32.exe 93 PID 636 wrote to memory of 3120 636 rundll32.exe 93 PID 3120 wrote to memory of 4660 3120 rundll32.exe 94 PID 3120 wrote to memory of 4660 3120 rundll32.exe 94 PID 3120 wrote to memory of 4660 3120 rundll32.exe 94 PID 4660 wrote to memory of 2612 4660 rundll32.exe 95 PID 4660 wrote to memory of 2612 4660 rundll32.exe 95 PID 4660 wrote to memory of 2612 4660 rundll32.exe 95 PID 2612 wrote to memory of 5048 2612 rundll32.exe 96 PID 2612 wrote to memory of 5048 2612 rundll32.exe 96 PID 2612 wrote to memory of 5048 2612 rundll32.exe 96 PID 5048 wrote to memory of 464 5048 rundll32.exe 97 PID 5048 wrote to memory of 464 5048 rundll32.exe 97 PID 5048 wrote to memory of 464 5048 rundll32.exe 97 PID 464 wrote to memory of 1516 464 rundll32.exe 98 PID 464 wrote to memory of 1516 464 rundll32.exe 98 PID 464 wrote to memory of 1516 464 rundll32.exe 98 PID 1516 wrote to memory of 3596 1516 rundll32.exe 99 PID 1516 wrote to memory of 3596 1516 rundll32.exe 99 PID 1516 wrote to memory of 3596 1516 rundll32.exe 99 PID 3596 wrote to memory of 5068 3596 rundll32.exe 100 PID 3596 wrote to memory of 5068 3596 rundll32.exe 100 PID 3596 wrote to memory of 5068 3596 rundll32.exe 100 PID 5068 wrote to memory of 772 5068 rundll32.exe 101 PID 5068 wrote to memory of 772 5068 rundll32.exe 101 PID 5068 wrote to memory of 772 5068 rundll32.exe 101 PID 772 wrote to memory of 2860 772 rundll32.exe 102 PID 772 wrote to memory of 2860 772 rundll32.exe 102 PID 772 wrote to memory of 2860 772 rundll32.exe 102 PID 2860 wrote to memory of 4488 2860 rundll32.exe 103 PID 2860 wrote to memory of 4488 2860 rundll32.exe 103 PID 2860 wrote to memory of 4488 2860 rundll32.exe 103 PID 4488 wrote to memory of 4272 4488 rundll32.exe 104 PID 4488 wrote to memory of 4272 4488 rundll32.exe 104 PID 4488 wrote to memory of 4272 4488 rundll32.exe 104 PID 4272 wrote to memory of 4996 4272 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#13⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#14⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#15⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#16⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#17⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#18⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#19⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#110⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#111⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#112⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#113⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#114⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#115⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#116⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#117⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#118⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#119⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#120⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#121⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#122⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#123⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#124⤵PID:3804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#125⤵PID:1388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#126⤵PID:3032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#127⤵PID:4208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#128⤵PID:1296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#129⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#130⤵PID:4600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#131⤵PID:1888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#132⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#133⤵PID:3764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#134⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#135⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#136⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#137⤵PID:3880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#138⤵PID:1800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#139⤵PID:760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#140⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#141⤵PID:3144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#142⤵PID:880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#143⤵PID:1016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#144⤵PID:3752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#145⤵PID:1172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#146⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#147⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#148⤵PID:4908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#149⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#150⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#151⤵PID:2616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#152⤵PID:3020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#153⤵PID:2968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#154⤵PID:4768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#155⤵PID:4756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#156⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#157⤵PID:1068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#158⤵PID:2872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#159⤵PID:3712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#160⤵PID:3100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#161⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#162⤵PID:3476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#163⤵PID:2116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#164⤵PID:4228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#165⤵PID:1288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#166⤵PID:2444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#167⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#168⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#169⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#170⤵PID:2500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#171⤵PID:652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#172⤵PID:1620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#173⤵PID:3636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#174⤵PID:1952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#175⤵PID:4160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#176⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#177⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#178⤵PID:4500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#179⤵PID:4744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#180⤵PID:4624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#181⤵PID:1108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#182⤵PID:3704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#183⤵PID:4532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#184⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#185⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#186⤵PID:1568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#187⤵PID:4144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#188⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#189⤵PID:3892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#190⤵PID:4420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#191⤵PID:3364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#192⤵PID:392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#193⤵PID:4964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#194⤵PID:4864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#195⤵PID:312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#196⤵PID:4736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#197⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#198⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#199⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1100⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1101⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1102⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1103⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1104⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1105⤵PID:5252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1106⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1107⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1108⤵PID:5344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1109⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1110⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1111⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1112⤵PID:5408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1113⤵PID:5424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1114⤵PID:5440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1115⤵PID:5456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1116⤵PID:5472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1117⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1118⤵PID:5504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1119⤵PID:5516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1120⤵PID:5536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1121⤵PID:5548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1122⤵PID:5564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-