quasar | hxxps://dosya[.]co/tpamgtvbvyuf/windows[.]exe[.]html

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Windows.exe

Executes dropped EXE 11 IoCs

pid	Process
1764	windows.exe
3440	Windows.exe
2732	Windows.exe
5388	Windows.exe
5636	Windows.exe
2532	Windows.exe
4028	Windows.exe
2388	Windows.exe
6072	Windows.exe
3888	windows.exe
5936	Windows.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2312	cmd.exe
2396	cmd.exe
5356	cmd.exe
2156	cmd.exe
4140	cmd.exe
2520	cmd.exe
5172	cmd.exe
4548	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1108	PING.EXE
5916	PING.EXE
4816	PING.EXE
5880	PING.EXE
1028	PING.EXE
1072	PING.EXE
2788	PING.EXE
6120	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2780	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288170028717008"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{E3978FBA-264E-40FB-B2F6-D8EA1B78DA8E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
1108	PING.EXE
5916	PING.EXE
4816	PING.EXE
5880	PING.EXE
1028	PING.EXE
1072	PING.EXE
2788	PING.EXE
6120	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4120	schtasks.exe
4172	schtasks.exe
2620	schtasks.exe
6108	schtasks.exe
5980	schtasks.exe
5492	schtasks.exe
5672	schtasks.exe
4664	schtasks.exe
2184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	windows.exe
Token: SeDebugPrivilege	3440	Windows.exe
Token: SeDebugPrivilege	2732	Windows.exe
Token: SeDebugPrivilege	5328	taskmgr.exe
Token: SeSystemProfilePrivilege	5328	taskmgr.exe
Token: SeCreateGlobalPrivilege	5328	taskmgr.exe
Token: SeDebugPrivilege	5388	Windows.exe
Token: SeDebugPrivilege	5636	Windows.exe
Token: SeDebugPrivilege	2532	Windows.exe
Token: SeDebugPrivilege	4028	Windows.exe
Token: SeDebugPrivilege	2388	Windows.exe
Token: SeDebugPrivilege	6072	Windows.exe
Token: SeDebugPrivilege	3888	windows.exe
Token: SeDebugPrivilege	5936	Windows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
3440	Windows.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
3440	Windows.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe
5388	Windows.exe
5328	taskmgr.exe
5328	taskmgr.exe
5328	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2924	1032	msedge.exe	86
PID 1032 wrote to memory of 2780	1032	msedge.exe	87
PID 1032 wrote to memory of 3896	1032	msedge.exe	88
PID 1032 wrote to memory of 3896	1032	msedge.exe	88
PID 1032 wrote to memory of 3896	1032	msedge.exe	88
PID 1032 wrote to memory of 1184	1032	msedge.exe	90
PID 1032 wrote to memory of 1184	1032	msedge.exe	90
PID 1032 wrote to memory of 2152	1032	msedge.exe	91
PID 1032 wrote to memory of 2152	1032	msedge.exe	91
PID 1032 wrote to memory of 2152	1032	msedge.exe	91
PID 1032 wrote to memory of 3808	1032	msedge.exe	92
PID 1032 wrote to memory of 3808	1032	msedge.exe	92
PID 1032 wrote to memory of 3808	1032	msedge.exe	92
PID 1032 wrote to memory of 3960	1032	msedge.exe	93
PID 1032 wrote to memory of 3960	1032	msedge.exe	93
PID 1032 wrote to memory of 3960	1032	msedge.exe	93
PID 1032 wrote to memory of 3976	1032	msedge.exe	94
PID 1032 wrote to memory of 3976	1032	msedge.exe	94
PID 1032 wrote to memory of 3976	1032	msedge.exe	94
PID 1032 wrote to memory of 1328	1032	msedge.exe	97
PID 1032 wrote to memory of 2316	1032	msedge.exe	98
PID 1032 wrote to memory of 1328	1032	msedge.exe	97
PID 1032 wrote to memory of 2316	1032	msedge.exe	98
PID 1032 wrote to memory of 4792	1032	msedge.exe	100
PID 1032 wrote to memory of 2084	1032	msedge.exe	101
PID 1032 wrote to memory of 2084	1032	msedge.exe	101
PID 1032 wrote to memory of 2084	1032	msedge.exe	101
PID 1032 wrote to memory of 4960	1032	msedge.exe	102
PID 1032 wrote to memory of 4960	1032	msedge.exe	102
PID 1032 wrote to memory of 4960	1032	msedge.exe	102
PID 1032 wrote to memory of 540	1032	msedge.exe	103
PID 1032 wrote to memory of 540	1032	msedge.exe	103
PID 1032 wrote to memory of 540	1032	msedge.exe	103
PID 1032 wrote to memory of 3336	1032	msedge.exe	104
PID 1032 wrote to memory of 3336	1032	msedge.exe	104
PID 1032 wrote to memory of 3336	1032	msedge.exe	104
PID 1032 wrote to memory of 2472	1032	msedge.exe	107
PID 1032 wrote to memory of 2792	1032	msedge.exe	108
PID 1032 wrote to memory of 2096	1032	msedge.exe	109
PID 1032 wrote to memory of 3820	1032	msedge.exe	110
PID 1032 wrote to memory of 3820	1032	msedge.exe	110
PID 1032 wrote to memory of 4504	1032	msedge.exe	111
PID 1032 wrote to memory of 4504	1032	msedge.exe	111
PID 1032 wrote to memory of 4504	1032	msedge.exe	111
PID 1032 wrote to memory of 868	1032	msedge.exe	112
PID 2588 wrote to memory of 704	2588	msedge.exe	122
PID 1032 wrote to memory of 4380	1032	msedge.exe	123
PID 1032 wrote to memory of 4380	1032	msedge.exe	123
PID 1032 wrote to memory of 4380	1032	msedge.exe	123
PID 1032 wrote to memory of 4312	1032	msedge.exe	131
PID 1032 wrote to memory of 4312	1032	msedge.exe	131
PID 1032 wrote to memory of 4312	1032	msedge.exe	131
PID 1032 wrote to memory of 372	1032	msedge.exe	132
PID 1032 wrote to memory of 372	1032	msedge.exe	132
PID 1764 wrote to memory of 6108	1764	windows.exe	136
PID 1764 wrote to memory of 3440	1764	windows.exe	138
PID 3440 wrote to memory of 5980	3440	Windows.exe	141
PID 3440 wrote to memory of 2156	3440	Windows.exe	143
PID 2156 wrote to memory of 4368	2156	cmd.exe	145
PID 2156 wrote to memory of 5916	2156	cmd.exe	146
PID 2156 wrote to memory of 5388	2156	cmd.exe	148
PID 5388 wrote to memory of 5492	5388	Windows.exe	149
PID 5388 wrote to memory of 4140	5388	Windows.exe	151
PID 4140 wrote to memory of 1932	4140	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/tpamgtvbvyuf/windows.exe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8026cc188,0x7ff8026cc194,0x7ff8026cc1a0
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,10021087030386726779,2728863021907853986,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,13326874109225505469,12588712716937031913,262144 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,6712352195726899052,3548611678635810577,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,8547423105869245142,1736762490992599405,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,12940123048482589714,12645845739409615960,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,8120279183227565426,6694256438007401049,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,13233641425069572393,734650687368799827,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,4245622838128517351,14431732953878621487,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,11829920071084737834,14044375230784200609,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,11161032376937656422,4571077659442390446,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,11161032376937656422,4571077659442390446,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4476,i,8252825881381927020,16035904050167349045,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6528,i,3556886199708429379,14077278460818754654,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4268,i,10948467646794846958,15702515886146375155,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4228,i,12124892347390563096,5561062692398964384,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,10982714613735207034,12118827647318239237,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,11534384503624751496,3204007696560220555,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,10300788741563192488,5897843052468010833,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,171171689910589986,1549175226824529186,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7144,i,11801660595590188344,6616531306121094452,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,18077862904872209517,6309440559549885872,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4336,i,10378187652141386860,8820004310901574425,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4348,i,12241596103174434046,6655432772808613272,2097152 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,17833763375140792053,13119595951987629941,524288 --field-trial-handle=2392,i,17247759486335978098,1772182694120974433,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
  2⤵
  PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc13767d3h7234h4522hbbfch8448ad44c6dd
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc13767d3h7234h4522hbbfch8448ad44c6dd --edge-skip-compat-layer-relaunch
  2⤵
  PID:704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4fe25cb6hf056h4200ha8bfhd2fe2e14d2f9
1⤵
PID:5408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:532

C:\Users\Admin\Downloads\windows.exe
"C:\Users\Admin\Downloads\windows.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6108
- C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YTAVIVCrOh2z.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4368
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5916
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5388
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\00pmCI1dJV08.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1932
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4816
      - C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5636
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KqtuzEUYrE2N.bat" "
        7⤵
        Executes a command shell one-liner
        
        PID:2520
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3576
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5880
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQCpwfEwbTJd.bat" "
        9⤵
        Executes a command shell one-liner
        
        PID:5172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4792
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1028
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4028
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NJfl9FcEDioc.bat" "
        11⤵
        Executes a command shell one-liner
        
        PID:4548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1164
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1072
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\64koiq5lf84K.bat" "
        13⤵
        Executes a command shell one-liner
        
        PID:2312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:60
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2788
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:6072
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ouRAYn8JV4xl.bat" "
        15⤵
        Executes a command shell one-liner
        
        PID:2396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:5960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6120
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5936
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F17vlulezFyE.bat" "
        17⤵
        Executes a command shell one-liner
        
        PID:5356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1108

C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
C:\Users\Admin\AppData\Roaming\SubDir\Windows.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5328

C:\Users\Admin\Downloads\windows.exe
"C:\Users\Admin\Downloads\windows.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery