i tried this and security pinged me about behavior based security rules firing because it looks like an infostealer...