skuld | hxxps://ezfn-dev[.]pages[.]dev/EzFN-Manager[.]exe

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
594	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 1824	3012	WinRAR.exe	100
PID 5600 set thread context of 5748	5600	WinRar.exe	118
PID 5572 set thread context of 5480	5572	WinRar.exe	120
PID 5704 set thread context of 6060	5704	WinRar.exe	122
PID 5940 set thread context of 3392	5940	WinRar.exe	124
PID 2224 set thread context of 5188	2224	WinRar.exe	126
PID 1904 set thread context of 5176	1904	WinRar.exe	145
PID 5188 set thread context of 3324	5188	WinRar.exe	147
PID 1976 set thread context of 3488	1976	WinRar.exe	149
PID 5948 set thread context of 2944	5948	WinRar.exe	153
PID 932 set thread context of 5532	932	WinRar.exe	156
PID 1984 set thread context of 1860	1984	WinRar.exe	158
PID 1052 set thread context of 4784	1052	WinRar.exe	164
PID 5772 set thread context of 3172	5772	WinRar.exe	176
PID 5888 set thread context of 4632	5888	WinRar.exe	179
PID 4712 set thread context of 2476	4712	WinRar.exe	183
PID 2304 set thread context of 7228	2304	WinRar.exe	214
PID 8244 set thread context of 5776	8244	WinRar.exe	216

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002aad0-368.dat	upx
behavioral1/memory/4708-372-0x00000000008F0000-0x0000000001355000-memory.dmp	upx
behavioral1/memory/4708-398-0x00000000008F0000-0x0000000001355000-memory.dmp	upx

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\EZFN Launcher\_up_\public\default_skin.png	msiexec.exe
File created	C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season7.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season11.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\certs\placeholder.txt	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season15.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\EZFN Launcher.exe	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season9.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season1.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season4.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season8.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season5.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season6.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season2.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season3.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season10.webp	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{0C27167A-56ED-4093-AFA9-38C1037E1ED3}	msiexec.exe
File opened for modification	C:\Windows\Installer\{0C27167A-56ED-4093-AFA9-38C1037E1ED3}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE211D4D7373D0F61.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8CA.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e7ef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e7ef.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57e7f1.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0618E49CD3A2BF6B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAFD7DD6FD7CCCF10.TMP	msiexec.exe
File created	C:\Windows\Installer\{0C27167A-56ED-4093-AFA9-38C1037E1ED3}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB7073BC8723B7530.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\EzFN-Manager.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\EzFN-Manager(1).exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5772	msedgewebview2.exe
5292	msedgewebview2.exe
820	msedgewebview2.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc80c284bade0450000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002fc80c280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002fc80c28000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2fc80c28000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002fc80c2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\ProductIcon = "C:\\Windows\\Installer\\{0C27167A-56ED-4093-AFA9-38C1037E1ED3}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\ProductName = "EZFN Launcher"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298\A76172C0DE653904FA9A831C30E7E13D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	EzFN-Manager.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe110000001c31590bae18db017df586d08242db016a2a93d08242db0114000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\PackageCode = "76FDA8E8A116A814189D1AA5C72D5D7D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A76172C0DE653904FA9A831C30E7E13D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A76172C0DE653904FA9A831C30E7E13D\External	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A76172C0DE653904FA9A831C30E7E13D\SourceList	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A76172C0DE653904FA9A831C30E7E13D\MainProgram	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\EzFN-Manager.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\EzFN-Manager(1).exe:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3404	msiexec.exe
3404	msiexec.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
5324	powershell.exe
5324	powershell.exe
5324	powershell.exe
5616	powershell.exe
5616	powershell.exe
5616	powershell.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
2252	msedgewebview2.exe
2252	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4884	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5428	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeDebugPrivilege	3012	WinRAR.exe
Token: SeSecurityPrivilege	3404	msiexec.exe
Token: SeCreateTokenPrivilege	584	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	584	msiexec.exe
Token: SeLockMemoryPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeMachineAccountPrivilege	584	msiexec.exe
Token: SeTcbPrivilege	584	msiexec.exe
Token: SeSecurityPrivilege	584	msiexec.exe
Token: SeTakeOwnershipPrivilege	584	msiexec.exe
Token: SeLoadDriverPrivilege	584	msiexec.exe
Token: SeSystemProfilePrivilege	584	msiexec.exe
Token: SeSystemtimePrivilege	584	msiexec.exe
Token: SeProfSingleProcessPrivilege	584	msiexec.exe
Token: SeIncBasePriorityPrivilege	584	msiexec.exe
Token: SeCreatePagefilePrivilege	584	msiexec.exe
Token: SeCreatePermanentPrivilege	584	msiexec.exe
Token: SeBackupPrivilege	584	msiexec.exe
Token: SeRestorePrivilege	584	msiexec.exe
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeDebugPrivilege	584	msiexec.exe
Token: SeAuditPrivilege	584	msiexec.exe
Token: SeSystemEnvironmentPrivilege	584	msiexec.exe
Token: SeChangeNotifyPrivilege	584	msiexec.exe
Token: SeRemoteShutdownPrivilege	584	msiexec.exe
Token: SeUndockPrivilege	584	msiexec.exe
Token: SeSyncAgentPrivilege	584	msiexec.exe
Token: SeEnableDelegationPrivilege	584	msiexec.exe
Token: SeManageVolumePrivilege	584	msiexec.exe
Token: SeImpersonatePrivilege	584	msiexec.exe
Token: SeCreateGlobalPrivilege	584	msiexec.exe
Token: SeDebugPrivilege	4708	Microsoft Teams.exe
Token: SeCreateTokenPrivilege	584	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	584	msiexec.exe
Token: SeLockMemoryPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeMachineAccountPrivilege	584	msiexec.exe
Token: SeTcbPrivilege	584	msiexec.exe
Token: SeSecurityPrivilege	584	msiexec.exe
Token: SeTakeOwnershipPrivilege	584	msiexec.exe
Token: SeLoadDriverPrivilege	584	msiexec.exe
Token: SeSystemProfilePrivilege	584	msiexec.exe
Token: SeSystemtimePrivilege	584	msiexec.exe
Token: SeProfSingleProcessPrivilege	584	msiexec.exe
Token: SeIncBasePriorityPrivilege	584	msiexec.exe
Token: SeCreatePagefilePrivilege	584	msiexec.exe
Token: SeCreatePermanentPrivilege	584	msiexec.exe
Token: SeBackupPrivilege	584	msiexec.exe
Token: SeRestorePrivilege	584	msiexec.exe
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeDebugPrivilege	584	msiexec.exe
Token: SeAuditPrivilege	584	msiexec.exe
Token: SeSystemEnvironmentPrivilege	584	msiexec.exe
Token: SeChangeNotifyPrivilege	584	msiexec.exe
Token: SeRemoteShutdownPrivilege	584	msiexec.exe
Token: SeUndockPrivilege	584	msiexec.exe
Token: SeSyncAgentPrivilege	584	msiexec.exe
Token: SeEnableDelegationPrivilege	584	msiexec.exe
Token: SeManageVolumePrivilege	584	msiexec.exe
Token: SeImpersonatePrivilege	584	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
584	msiexec.exe
584	msiexec.exe
4292	EZFN Launcher.exe
5428	msedgewebview2.exe
5428	msedgewebview2.exe
4884	firefox.exe
4884	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4884	firefox.exe
4884	firefox.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe
4884	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 1292 wrote to memory of 4884	1292	firefox.exe	77
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 2352	4884	firefox.exe	78
PID 4884 wrote to memory of 1100	4884	firefox.exe	79
PID 4884 wrote to memory of 1100	4884	firefox.exe	79
PID 4884 wrote to memory of 1100	4884	firefox.exe	79
PID 4884 wrote to memory of 1100	4884	firefox.exe	79
PID 4884 wrote to memory of 1100	4884	firefox.exe	79
PID 4884 wrote to memory of 1100	4884	firefox.exe	79
PID 4884 wrote to memory of 1100	4884	firefox.exe	79
PID 4884 wrote to memory of 1100	4884	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1932	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ezfn-dev.pages.dev/EzFN-Manager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ezfn-dev.pages.dev/EzFN-Manager.exe
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7be359a5-352a-4874-b3ef-c6c5c9ebe03a} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" gpu
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5e423eb-2f50-4706-a936-f4d002fad496} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" socket
    3⤵
    PID:1100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3180 -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3160 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc7eaffb-244e-4030-af9e-e2e8ffe27780} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e459b478-d3e1-4d9f-bb35-a97529f987ac} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4792 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4784 -prefMapHandle 4780 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f690f02-51e2-4fef-8a27-7c1ac9393a28} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" utility
    3⤵
    - Checks processor information in registry
    PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5628 -childID 3 -isForBrowser -prefsHandle 5652 -prefMapHandle 5648 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41561dce-6564-4d0a-8940-5cd0671efc52} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5832 -childID 4 -isForBrowser -prefsHandle 5752 -prefMapHandle 5756 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cbd2093-1647-43b7-b610-0b748154a61b} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5944 -childID 5 -isForBrowser -prefsHandle 5948 -prefMapHandle 5952 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {223b5968-7f10-4fc3-a9cc-ce832de08fed} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3912 -childID 6 -isForBrowser -prefsHandle 3908 -prefMapHandle 3556 -prefsLen 29316 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f1e5052-64df-4f70-9ec0-e2b2d7fbb50d} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:1448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6888 -childID 7 -isForBrowser -prefsHandle 6860 -prefMapHandle 6892 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1723daf1-4f76-4983-b62e-d11108ef6eae} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6796 -childID 8 -isForBrowser -prefsHandle 6864 -prefMapHandle 7048 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc07fac9-e28c-4840-b420-9dc3c8fa12e3} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7220 -childID 9 -isForBrowser -prefsHandle 7208 -prefMapHandle 7204 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d3843de-93c9-47f9-9a2b-b1ec23b5b997} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3416 -childID 10 -isForBrowser -prefsHandle 4552 -prefMapHandle 7468 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7013cc63-aa8a-4381-83ce-d5df69f2cf60} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4256 -childID 11 -isForBrowser -prefsHandle 4680 -prefMapHandle 4684 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2f848ce-a8e1-45fc-96a1-7cfbda9d4589} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2556 -childID 12 -isForBrowser -prefsHandle 8136 -prefMapHandle 6824 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebc34efb-272c-49ca-976e-736d391c3c52} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7360 -childID 13 -isForBrowser -prefsHandle 6376 -prefMapHandle 6160 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d06fd92-e98f-45b0-a133-0aba661abbbf} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 14 -isForBrowser -prefsHandle 7360 -prefMapHandle 6848 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1444980d-3c5f-413f-ab99-28e0c245e90c} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7964 -childID 15 -isForBrowser -prefsHandle 5268 -prefMapHandle 7972 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {549ccc86-a7be-4910-976e-b2a27ac1659e} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8188 -childID 16 -isForBrowser -prefsHandle 8472 -prefMapHandle 8180 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7d87633-c16e-46e3-89fd-7d3c0f2a15e8} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6216 -childID 17 -isForBrowser -prefsHandle 7468 -prefMapHandle 9156 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8827f52b-a3ee-48f7-ae73-380a5e35f47e} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7348 -childID 18 -isForBrowser -prefsHandle 8660 -prefMapHandle 8720 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3083266d-0d85-4ee1-bc95-f53bd4c02df0} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4920 -childID 19 -isForBrowser -prefsHandle 7504 -prefMapHandle 9244 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a75623fb-a7bd-4641-b941-5fef173a4512} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8380 -childID 20 -isForBrowser -prefsHandle 9616 -prefMapHandle 9628 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {601a8a56-384f-4ac8-b870-4237c56316d3} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9840 -childID 21 -isForBrowser -prefsHandle 9664 -prefMapHandle 9668 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c2151f2-61c0-4da8-9226-2790f6b09e27} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8996 -childID 22 -isForBrowser -prefsHandle 9424 -prefMapHandle 9432 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9dd4dce-4adf-4cab-8ecb-0556cb768ca4} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:1648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9056 -childID 23 -isForBrowser -prefsHandle 7640 -prefMapHandle 8984 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b13c8577-6fd2-4476-a55c-e89ca598e851} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6060 -childID 24 -isForBrowser -prefsHandle 3756 -prefMapHandle 2844 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd9a1052-e160-4c4b-89dc-107912501857} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7832 -childID 25 -isForBrowser -prefsHandle 8700 -prefMapHandle 7776 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8fc6a40-3901-4c50-8c57-7ab5b18684be} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9236 -childID 26 -isForBrowser -prefsHandle 6832 -prefMapHandle 6796 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0b99a1b-ac83-41bf-a482-5dbf0f45e8df} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9232 -childID 27 -isForBrowser -prefsHandle 9300 -prefMapHandle 9296 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1a80d0c-027b-488d-8196-838b97e2b9f7} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 28 -isForBrowser -prefsHandle 9164 -prefMapHandle 8632 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d21c09a0-1e07-4eda-8d4e-9d74f14807f7} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7560 -childID 29 -isForBrowser -prefsHandle 8644 -prefMapHandle 7336 -prefsLen 28537 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed343afa-24ed-49a8-b0a0-4ffb463d1c76} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10200 -childID 30 -isForBrowser -prefsHandle 7900 -prefMapHandle 8104 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c00e714b-11e8-4b23-88c8-5337e60fe8e2} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10260 -childID 31 -isForBrowser -prefsHandle 10268 -prefMapHandle 10272 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {046b4eb8-ab1f-4d45-84cb-fc2e1df89b8f} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11076 -childID 32 -isForBrowser -prefsHandle 11068 -prefMapHandle 11064 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ae1653e-aa8b-4f3c-80cb-88280a84909e} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11372 -childID 33 -isForBrowser -prefsHandle 11432 -prefMapHandle 9264 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f81f23fb-2b8b-4689-97cd-b6fac103af0a} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10480 -childID 34 -isForBrowser -prefsHandle 11632 -prefMapHandle 8576 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9029b280-86e5-4c3d-8629-2aa41cb113b1} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11640 -childID 35 -isForBrowser -prefsHandle 11652 -prefMapHandle 11648 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {179c497e-0de2-4431-9afb-d3e53700373e} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11864 -childID 36 -isForBrowser -prefsHandle 11948 -prefMapHandle 11944 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c65adab3-41d0-441b-a377-3e53e41bd27c} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11788 -childID 37 -isForBrowser -prefsHandle 12052 -prefMapHandle 12056 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e9f32c4-84df-4907-a4de-2406dd2bfef2} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11776 -childID 38 -isForBrowser -prefsHandle 12324 -prefMapHandle 12328 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2489a884-08a2-442c-9566-88102281fb3a} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12372 -childID 39 -isForBrowser -prefsHandle 12124 -prefMapHandle 12120 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {758594da-db71-4f40-ab0a-812de9b18bc2} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12356 -childID 40 -isForBrowser -prefsHandle 12556 -prefMapHandle 12560 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c986599-f2eb-4dc6-a2b4-92f71573b564} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12592 -childID 41 -isForBrowser -prefsHandle 12776 -prefMapHandle 7556 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4c7434d-cec4-4406-bee3-3ebb24d520be} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12668 -childID 42 -isForBrowser -prefsHandle 12556 -prefMapHandle 12956 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34f26a65-10a3-47e5-99f3-77cefef97a9d} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13052 -childID 43 -isForBrowser -prefsHandle 13128 -prefMapHandle 13132 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8750a4a-ecaf-4752-959e-88099faf4650} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13252 -childID 44 -isForBrowser -prefsHandle 13240 -prefMapHandle 13244 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb4e8b87-245e-49d2-b583-948534d1792b} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13224 -childID 45 -isForBrowser -prefsHandle 13228 -prefMapHandle 13232 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ad59faa-8629-41a0-91d9-213ad1483b47} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13712 -childID 46 -isForBrowser -prefsHandle 13704 -prefMapHandle 13700 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b778f3b2-6c39-410f-a735-f9e866f58cb2} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:6836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13656 -childID 47 -isForBrowser -prefsHandle 13992 -prefMapHandle 13988 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93085074-ad31-4b8f-82de-33545c457ff8} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13872 -childID 48 -isForBrowser -prefsHandle 14128 -prefMapHandle 14132 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fcac82a-1d15-4aa0-a71c-8447341d1c10} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=14188 -childID 49 -isForBrowser -prefsHandle 14292 -prefMapHandle 14288 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcb4ba72-4936-4365-b310-beda4eac32a7} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=14372 -childID 50 -isForBrowser -prefsHandle 14380 -prefMapHandle 14384 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d885e77e-f6ba-48ca-bd3c-5cefefb88d9b} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13868 -childID 51 -isForBrowser -prefsHandle 14128 -prefMapHandle 13536 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37a40b7a-c7a5-4d2d-ba1c-8f37f9a1dcfd} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:7544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7808 -childID 52 -isForBrowser -prefsHandle 14796 -prefMapHandle 14408 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04c56dca-1fad-4ec1-8627-75e089f6ad46} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:8260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=14740 -childID 53 -isForBrowser -prefsHandle 14780 -prefMapHandle 14784 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1163b3a5-d6e5-4e0b-b258-1076f2173477} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:8268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=14976 -childID 54 -isForBrowser -prefsHandle 15076 -prefMapHandle 15080 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52dee419-50cf-490e-a915-ffdc38427863} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:8284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=15320 -parentBuildID 20240401114208 -prefsHandle 15024 -prefMapHandle 12800 -prefsLen 31344 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55a954dc-8608-48a2-80ea-083495359070} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" rdd
    3⤵
    PID:8532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=15312 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 14224 -prefMapHandle 15248 -prefsLen 31344 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f945f1d7-2a93-4d2d-828d-a9f6dfaae05a} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" utility
    3⤵
    - Checks processor information in registry
    PID:8540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=13508 -childID 55 -isForBrowser -prefsHandle 11440 -prefMapHandle 14816 -prefsLen 28629 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f913d862-b740-4d07-a9cf-6eed56be1410} 4884 "\\.\pipe\gecko-crash-server-pipe.4884" tab
    3⤵
    PID:4988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4292

C:\Users\Admin\Downloads\EzFN-Manager.exe
"C:\Users\Admin\Downloads\EzFN-Manager.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
PID:72
- C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe"
    3⤵
    - Views/modifies file attributes
    PID:1932
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\EZFN Launcher_1.2.7_x64_en-US (1).msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:584
- - C:\Program Files\EZFN Launcher\EZFN Launcher.exe
    "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:4292
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=4292.5412.693565101730382476
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5428
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ffc75643cb8,0x7ffc75643cc8,0x7ffc75643cd8
        5⤵
        
        PID:5544
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1928,7311979657269705848,132869820843649559,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:820
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,7311979657269705848,132869820843649559,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2252
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,7311979657269705848,132869820843649559,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2484 /prefetch:8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5772
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1928,7311979657269705848,132869820843649559,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5292
- C:\Users\Admin\AppData\Roaming\WinRAR.exe
  "C:\Users\Admin\AppData\Roaming\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- - C:\Users\Admin\AppData\Roaming\WinRAR.exe
    "C:\Users\Admin\AppData\Roaming\WinRAR.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WinRAR.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5468
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRAR.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5324
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WinRar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5616
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5920
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinRar" /tr "C:\ProgramData\WinRar.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:6100

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 20F4C275A9D524F0B0F83C0CFE3A93C4 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2288

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5600
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5748

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5572
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5480

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5704
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6060

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5940
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3392

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2224
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5252

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1904
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5176

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5188
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3324

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1976
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3488

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5948
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2944

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:932
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5532

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1984
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1860

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1052
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4784

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5772
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5888
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4632

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4712
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D0
1⤵
PID:8612

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2304
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7228

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:8244
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery