blankgrabber | hxxps://limewire[.]com/d/FxhNH#MSG3faygL9

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Zetox.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Zetox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Zetox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Zetox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Zetox.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2580	powershell.exe
4000	powershell.exe
3608	powershell.exe
1836	powershell.exe
1564	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

credential_access stealer

pid	Process
2580	powershell.exe

Uses browser remote debugging 2 TTPs 7 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
4868	msedge.exe
4520	msedge.exe
4724	chrome.exe
3864	chrome.exe
3784	chrome.exe
3604	chrome.exe
1784	msedge.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4372	Zetox.exe
1676	Zetox.exe

Loads dropped DLL 35 IoCs

pid	Process
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe
1676	Zetox.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
178	discord.com
181	discord.com
185	discord.com
312	discord.com
314	discord.com
315	discord.com
316	discord.com
184	discord.com
313	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
178	ip-api.com
179	api.ipify.org
182	api.ipify.org

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4440	sc.exe
2844	sc.exe
2832	sc.exe
892	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Zetox.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1352	msedge.exe
1316	msedge.exe
3548	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 37 IoCs

defense_evasion

pid	Process
484	taskkill.exe
2544	taskkill.exe
1564	taskkill.exe
5056	taskkill.exe
344	taskkill.exe
4300	taskkill.exe
2532	taskkill.exe
1796	taskkill.exe
5072	taskkill.exe
1188	taskkill.exe
3176	taskkill.exe
1148	taskkill.exe
2532	taskkill.exe
3908	taskkill.exe
3648	taskkill.exe
3528	taskkill.exe
4488	taskkill.exe
2092	taskkill.exe
404	taskkill.exe
2064	taskkill.exe
1348	taskkill.exe
2432	taskkill.exe
4152	taskkill.exe
484	taskkill.exe
2020	taskkill.exe
4220	taskkill.exe
1772	taskkill.exe
3252	taskkill.exe
1284	taskkill.exe
2944	taskkill.exe
3568	taskkill.exe
2304	taskkill.exe
3716	taskkill.exe
2580	taskkill.exe
3308	taskkill.exe
3028	taskkill.exe
2912	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223122736344835"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{1E87FC25-4D89-4923-8177-7BF44AA86E64}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{A4EF5DB2-2046-4C5F-BEA8-80481C979E65}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Zetox.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2580	powershell.exe
2580	powershell.exe
2580	powershell.exe
4000	powershell.exe
4000	powershell.exe
4000	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
1836	powershell.exe
1836	powershell.exe
1836	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	2532	taskkill.exe
Token: SeDebugPrivilege	3908	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
1784	msedge.exe
4724	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4664	3680	msedge.exe	79
PID 3680 wrote to memory of 5024	3680	msedge.exe	80
PID 3680 wrote to memory of 1352	3680	msedge.exe	81
PID 3680 wrote to memory of 5024	3680	msedge.exe	80
PID 3680 wrote to memory of 5024	3680	msedge.exe	80
PID 3680 wrote to memory of 3184	3680	msedge.exe	83
PID 3680 wrote to memory of 3184	3680	msedge.exe	83
PID 3680 wrote to memory of 3592	3680	msedge.exe	85
PID 3680 wrote to memory of 3592	3680	msedge.exe	85
PID 3680 wrote to memory of 3592	3680	msedge.exe	85
PID 3680 wrote to memory of 1096	3680	msedge.exe	84
PID 3680 wrote to memory of 1096	3680	msedge.exe	84
PID 3680 wrote to memory of 1096	3680	msedge.exe	84
PID 3680 wrote to memory of 4220	3680	msedge.exe	86
PID 3680 wrote to memory of 4220	3680	msedge.exe	86
PID 3680 wrote to memory of 4220	3680	msedge.exe	86
PID 3680 wrote to memory of 760	3680	msedge.exe	87
PID 3680 wrote to memory of 4640	3680	msedge.exe	88
PID 3680 wrote to memory of 2532	3680	msedge.exe	89
PID 3680 wrote to memory of 760	3680	msedge.exe	87
PID 3680 wrote to memory of 760	3680	msedge.exe	87
PID 3680 wrote to memory of 4640	3680	msedge.exe	88
PID 3680 wrote to memory of 4640	3680	msedge.exe	88
PID 3680 wrote to memory of 2532	3680	msedge.exe	89
PID 3680 wrote to memory of 2532	3680	msedge.exe	89
PID 3680 wrote to memory of 3000	3680	msedge.exe	91
PID 3680 wrote to memory of 3000	3680	msedge.exe	91
PID 3680 wrote to memory of 3508	3680	msedge.exe	93
PID 3680 wrote to memory of 3508	3680	msedge.exe	93
PID 3680 wrote to memory of 1524	3680	msedge.exe	94
PID 3680 wrote to memory of 1640	3680	msedge.exe	95
PID 3680 wrote to memory of 1524	3680	msedge.exe	94
PID 3680 wrote to memory of 1640	3680	msedge.exe	95
PID 3680 wrote to memory of 4004	3680	msedge.exe	97
PID 3680 wrote to memory of 3776	3680	msedge.exe	98
PID 3776 wrote to memory of 3116	3776	msedge.exe	99
PID 3680 wrote to memory of 2140	3680	msedge.exe	100
PID 3680 wrote to memory of 2140	3680	msedge.exe	100
PID 3680 wrote to memory of 3836	3680	msedge.exe	101
PID 3680 wrote to memory of 3836	3680	msedge.exe	101
PID 3680 wrote to memory of 1676	3680	msedge.exe	102
PID 3680 wrote to memory of 2944	3680	msedge.exe	103
PID 3680 wrote to memory of 1676	3680	msedge.exe	102
PID 3680 wrote to memory of 2944	3680	msedge.exe	103
PID 3680 wrote to memory of 4672	3680	msedge.exe	104
PID 3680 wrote to memory of 4672	3680	msedge.exe	104
PID 3680 wrote to memory of 1056	3680	msedge.exe	105
PID 3680 wrote to memory of 1056	3680	msedge.exe	105
PID 3680 wrote to memory of 1056	3680	msedge.exe	105
PID 3680 wrote to memory of 4480	3680	msedge.exe	106
PID 3680 wrote to memory of 4480	3680	msedge.exe	106
PID 3680 wrote to memory of 4480	3680	msedge.exe	106
PID 3680 wrote to memory of 2676	3680	msedge.exe	107
PID 3680 wrote to memory of 2676	3680	msedge.exe	107
PID 3680 wrote to memory of 2676	3680	msedge.exe	107
PID 3680 wrote to memory of 3116	3680	msedge.exe	108
PID 3680 wrote to memory of 3696	3680	msedge.exe	109
PID 3680 wrote to memory of 3116	3680	msedge.exe	108
PID 3680 wrote to memory of 3116	3680	msedge.exe	108
PID 3680 wrote to memory of 3696	3680	msedge.exe	109
PID 3680 wrote to memory of 3696	3680	msedge.exe	109
PID 3680 wrote to memory of 2288	3680	msedge.exe	110
PID 3680 wrote to memory of 3596	3680	msedge.exe	111
PID 3680 wrote to memory of 2288	3680	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://limewire.com/d/FxhNH#MSG3faygL9
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffd2e5bc188,0x7ffd2e5bc194,0x7ffd2e5bc1a0
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,7823636759860943872,2169765599163098074,262144 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,3291334983714326010,16837953499163433748,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,12039138310015994327,13204108557519094631,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,2780764045539758925,15456195732204193363,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,234407649312841156,6774784325720581720,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4056,i,1778113689836141100,41223004922871201,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,15904159000237402740,17234645410812766175,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:9
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4144,i,6180967276565480136,7578472749999365509,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4156,i,9281320632579309585,16850741300054593035,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,14854503105823875948,14994697137848772606,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,17426368571222447200,8707209309786374928,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,15280585288061528848,5119842726970348448,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,12202953706683795949,295173437805326948,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,5270951935012487662,9246315808641794347,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,5270951935012487662,9246315808641794347,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,15089181006261580418,13375755099225274373,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11983842153257186747,421193429388873878,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,998542618819487533,6188414901028028342,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15904509431941942752,10250357858135196525,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,5716313105385325919,9367746224924682933,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3957304855891964291,13180540225344397006,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5032,i,3223345185491859641,14176045416955462383,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4424,i,15668367721394944144,8830748382533548846,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6816,i,1109691209631281561,1192995851098914556,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6308,i,10905799101264340183,14677876725091658230,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5792,i,9928914031872215561,7320550846657418949,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,8287929210323282962,13661171718686633233,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7212,i,14240919647140813778,896680054921128792,2097152 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,17092389508347926439,15440276424974769765,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,8077298423691287349,17317966104452495485,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,4619987398794407667,3497623479613777046,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,6401806551370918451,3548575302724940313,524288 --field-trial-handle=2136,i,13076818669567774852,6298219759673802100,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
  2⤵
  PID:2940
- C:\Users\Admin\Downloads\Zetox.exe
  "C:\Users\Admin\Downloads\Zetox.exe"
  2⤵
  - Executes dropped EXE
  PID:4372
- - C:\Users\Admin\Downloads\Zetox.exe
    C:\Users\Admin\Downloads\Zetox.exe
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /IM MsMpEng.exe 2>nul"
      4⤵
      PID:3900
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM MsMpEng.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /IM NisSrv.exe 2>nul"
      4⤵
      PID:4744
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM NisSrv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "sc stop WinDefend 2>nul"
      4⤵
      PID:2636
    - - C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        
        PID:2832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled 2>nul"
      4⤵
      PID:1328
    - - C:\Windows\system32\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        
        PID:892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "sc stop wscsvc 2>nul"
      4⤵
      PID:3388
    - - C:\Windows\system32\sc.exe
        
        sc stop wscsvc
        5⤵
        Launches sc.exe
        
        PID:4440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "sc config wscsvc start= disabled 2>nul"
      4⤵
      PID:2456
    - - C:\Windows\system32\sc.exe
        
        sc config wscsvc start= disabled
        5⤵
        Launches sc.exe
        
        PID:2844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force; Set-MpPreference -DisableIOAVProtection $true -Force; Set-MpPreference -MAPSReporting Disabled -Force; Set-MpPreference -SubmitSamplesConsent NeverSend -Force""
      4⤵
      PID:1256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force; Set-MpPreference -DisableIOAVProtection $true -Force; Set-MpPreference -MAPSReporting Disabled -Force; Set-MpPreference -SubmitSamplesConsent NeverSend -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows_TimeSync' -Force""
      4⤵
      PID:560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows_TimeSync' -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
      4⤵
      PID:5080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop' -Force""
      4⤵
      PID:2140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop' -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads' -Force""
      4⤵
      PID:2060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads' -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2304
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3716
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:484
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM zen.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM palemoon.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1284
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM floorp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:404
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1796
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2544
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1564
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5072
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1188
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chromium.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2532
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM seamonkey.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3908
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM icedragon.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2432
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM cyberfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2944
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --disable-extensions --disable-sync --no-first-run --disable-features=RendererCodeIntegrity
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:1784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x22c,0x230,0x234,0x228,0x2e0,0x7ffd2e5bc188,0x7ffd2e5bc194,0x7ffd2e5bc1a0
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
        5⤵
        
        PID:2220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
        5⤵
        
        PID:1116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
        5⤵
        
        PID:1732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
        5⤵
        
        PID:2184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
        5⤵
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,15402828003141135793,4487809383877441172,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
        5⤵
        
        PID:3932
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2064
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --disable-extensions --disable-sync --no-first-run --disable-features=RendererCodeIntegrity
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ccac728,0x7ffd3ccac734,0x7ffd3ccac740
        5⤵
        
        PID:3472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1812 /prefetch:2
        5⤵
        
        PID:404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1928 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1972 /prefetch:13
        5⤵
        
        PID:1804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2932 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2956 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3904 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4512 /prefetch:14
        5⤵
        
        PID:1108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5000 /prefetch:14
        5⤵
        
        PID:4488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4916 /prefetch:14
        5⤵
        
        PID:412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,7977671392591839253,9711693708856241885,262144 --disable-features=PaintHolding,RendererCodeIntegrity --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4900 /prefetch:14
        5⤵
        
        PID:2840
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2912
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3440
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4152
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM librewolf.exe
      4⤵
      Kills process with taskkill
      PID:3028
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM waterfox.exe
      4⤵
      Kills process with taskkill
      PID:344
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM zen.exe
      4⤵
      Kills process with taskkill
      PID:1148
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM palemoon.exe
      4⤵
      Kills process with taskkill
      PID:484
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM floorp.exe
      4⤵
      Kills process with taskkill
      PID:4300
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:2020
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2532
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:1348
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:4220
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:1772
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chromium.exe
      4⤵
      Kills process with taskkill
      PID:3176
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM seamonkey.exe
      4⤵
      Kills process with taskkill
      PID:3568
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM icedragon.exe
      4⤵
      Kills process with taskkill
      PID:3528
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM cyberfox.exe
      4⤵
      Kills process with taskkill
      PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Modify Authentication Process

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process