Operation DragonReturn GetTickCount64 Timing Evasion via Mixed Reality.exe or COU_ITR Loader

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects execution patterns associated with the DragonReturn loader, which implements a timing delay loop using GetTickCount64 before executing secondary actions, such as deploying a Windows service via sc.exe.