9ad43994be27b8156dfcb82fbe8549b258985f3579adcc94d8712a3e4d1c3294

Modify Registry

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\103.0.5060.66\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe

Registers COM server for autorun 1 TTPs 58 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

setup.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\103.0.5060.66\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\103.0.5060.66\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}\InProcServer32	GoogleUpdateComRegisterShell64.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

GoogleUpdate.exeGoogleUpdate.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	chrome.exe

Loads dropped DLL 64 IoCs

Processes:

Chrome.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exe103.0.5060.66_chrome_installer.exesetup.exesetup.exeGoogleUpdateOnDemand.exeGoogleUpdate.exeGoogleUpdate.exechrome.exechrome.exe

pid	process
560	Chrome.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1396	GoogleUpdate.exe
1396	GoogleUpdate.exe
1396	GoogleUpdate.exe
1520	GoogleUpdate.exe
436	GoogleUpdate.exe
436	GoogleUpdate.exe
436	GoogleUpdate.exe
1932	GoogleUpdateComRegisterShell64.exe
436	GoogleUpdate.exe
436	GoogleUpdate.exe
1888	GoogleUpdateComRegisterShell64.exe
436	GoogleUpdate.exe
436	GoogleUpdate.exe
1908	GoogleUpdateComRegisterShell64.exe
436	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1256	GoogleUpdate.exe
1900	GoogleUpdate.exe
1900	GoogleUpdate.exe
1900	GoogleUpdate.exe
1100	GoogleUpdate.exe
1100	GoogleUpdate.exe
1100	GoogleUpdate.exe
1100	GoogleUpdate.exe
1900	GoogleUpdate.exe
1100	GoogleUpdate.exe
1832	103.0.5060.66_chrome_installer.exe
1568	setup.exe
1568	setup.exe
1716	setup.exe
1716	setup.exe
1716	setup.exe
1268
1268
1268
1716	setup.exe
1568	setup.exe
1568	setup.exe
1268
1268
1268
1268
1100	GoogleUpdate.exe
1100	GoogleUpdate.exe
1100	GoogleUpdate.exe
1100	GoogleUpdate.exe
1172	GoogleUpdateOnDemand.exe
300	GoogleUpdate.exe
1904	GoogleUpdate.exe
1904	GoogleUpdate.exe
1904	GoogleUpdate.exe
1904	GoogleUpdate.exe
320	chrome.exe
1940	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

chrome.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	chrome.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exeGoogleUpdateSetup.exeGoogleUpdate.exeChrome.exeGoogleUpdate.exe103.0.5060.66_chrome_installer.exeGoogleUpdate.exeGoogleUpdate.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\fa.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\GoogleUpdateComRegisterShell64.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\goopdateres_lt.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_cs.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\es-419.pak	setup.exe
File created	C:\Program Files (x86)\GUM1862.tmp\GoogleUpdateOnDemand.exe	Chrome.exe
File created	C:\Program Files (x86)\GUM1862.tmp\psmachine_64.dll	Chrome.exe
File created	C:\Program Files (x86)\GUM1862.tmp\goopdateres_pt-BR.dll	Chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_sv.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\SETUP.EX_	103.0.5060.66_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\v8_context_snapshot.bin	setup.exe
File created	C:\Program Files (x86)\GUM1862.tmp\GoogleUpdate.exe	Chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_pt-PT.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\103.0.5060.66\103.0.5060.66_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\am.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\ro.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\GoogleUpdateSetup.exe	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\goopdateres_es-419.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_hi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\GUM1862.tmp\GoogleUpdateSetup.exe	Chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\af.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\ml.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ja.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\GUM1862.tmp\goopdateres_is.dll	Chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_no.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\chrome_elf.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\Install\{0CBACF14-6B51-4F33-9AB6-13E22354F669}\GoogleUpdateSetup.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_ar.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_et.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_hr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\GUM1862.tmp\goopdateres_sv.dll	Chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_es.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_fr.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_sk.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\GUM1862.tmp\goopdateres_ja.dll	Chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_fil.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_sw.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\fil.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\goopdateres_nl.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_cs.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.34.11\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\ar.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source1568_1279447182\Chrome-bin\103.0.5060.66\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\goopdateres_ur.dll	GoogleUpdateSetup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.132\goopdateres_en-GB.dll	GoogleUpdate.exe

Drops file in Windows directory 7 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\70d665.ipi	msiexec.exe
File created	C:\Windows\Installer\70d663.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\70d663.msi	msiexec.exe
File created	C:\Windows\Installer\70d665.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE18A.tmp	msiexec.exe
File created	C:\Windows\Installer\70d667.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

Processes:

GoogleUpdate.exeGoogleUpdate.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppName = "GoogleUpdateBroker.exe"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\AppPath = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11"	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\Policy = "3"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\AppName = "GoogleUpdateWebPlugin.exe"	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\Policy = "3"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}	GoogleUpdate.exe

Modifies data under HKEY_USERS 14 IoCs

Processes:

msiexec.exeGoogleUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 2a80194c0cca2a67be0bd5d9579565853896ad3913402d471621d38464b1826d	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	GoogleUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	GoogleUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 640a0000806aa7d61f8ed801	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	msiexec.exe

Modifies registry class 64 IoCs

Processes:

GoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exesetup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\goopdate.dll,-3000"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ = "ICoCreateAsync"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods\ = "24"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\ELEVATION	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VersionIndependentProgID	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\Elevation\Enabled = "1"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Google.Update3WebControl.3\CLSID\ = "{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ = "IAppCommand2"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ = "IAppBundle"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\ = "{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync\CurVer\ = "GoogleUpdate.CoCreateAsync.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine.1.0\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods\ = "23"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\ = "{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ProgID	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID\ = "GoogleUpdate.Update3WebSvc"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32\ = "{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\ = "{A6B5068B-8F3E-4850-B5C8-B004AFE2B38B}"	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VERSIONINDEPENDENTPROGID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ChromeHTML\Application	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\INPROCSERVER32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{97C73AB9-10F4-474D-B65F-9943BE694247}\InprocHandler32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.34.11\\goopdate.dll,-3000"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.132\\GoogleUpdateOnDemand.exe\""	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\ = "{600FDFA3-1EA7-4792-9436-ABB5154A9EB2}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}	GoogleUpdate.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

GoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exechrome.exeGoogleUpdate.exemsiexec.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exe

pid	process
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1900	GoogleUpdate.exe
1900	GoogleUpdate.exe
300	GoogleUpdate.exe
300	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
1520	GoogleUpdate.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
1956	GoogleUpdate.exe
1956	GoogleUpdate.exe
2660	msiexec.exe
2660	msiexec.exe
660	GoogleUpdate.exe
660	GoogleUpdate.exe
2944	GoogleUpdate.exe
2944	GoogleUpdate.exe
2992	GoogleUpdate.exe
2992	GoogleUpdate.exe
3044	GoogleUpdate.exe
3044	GoogleUpdate.exe
3044	GoogleUpdate.exe
3044	GoogleUpdate.exe
3044	GoogleUpdate.exe
3044	GoogleUpdate.exe
2408	GoogleUpdate.exe
2408	GoogleUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

GoogleUpdate.exe103.0.5060.66_chrome_installer.exeGoogleUpdate.exeGoogleUpdate.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1520	GoogleUpdate.exe
Token: SeDebugPrivilege	1520	GoogleUpdate.exe
Token: SeDebugPrivilege	1520	GoogleUpdate.exe
Token: 33	1832	103.0.5060.66_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	1832	103.0.5060.66_chrome_installer.exe
Token: SeDebugPrivilege	1900	GoogleUpdate.exe
Token: SeDebugPrivilege	300	GoogleUpdate.exe
Token: SeDebugPrivilege	1520	GoogleUpdate.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

chrome.exe

pid	process
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Chrome.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exe103.0.5060.66_chrome_installer.exesetup.exesetup.exe

description	pid	process	target process
PID 560 wrote to memory of 1520	560	Chrome.exe	GoogleUpdate.exe
PID 560 wrote to memory of 1520	560	Chrome.exe	GoogleUpdate.exe
PID 560 wrote to memory of 1520	560	Chrome.exe	GoogleUpdate.exe
PID 560 wrote to memory of 1520	560	Chrome.exe	GoogleUpdate.exe
PID 560 wrote to memory of 1520	560	Chrome.exe	GoogleUpdate.exe
PID 560 wrote to memory of 1520	560	Chrome.exe	GoogleUpdate.exe
PID 560 wrote to memory of 1520	560	Chrome.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1396	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1396	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1396	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1396	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1396	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1396	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1396	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 436	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 436	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 436	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 436	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 436	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 436	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 436	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 436 wrote to memory of 1932	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1932	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1932	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1932	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1888	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1888	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1888	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1888	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1908	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1908	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1908	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 436 wrote to memory of 1908	436	GoogleUpdate.exe	GoogleUpdateComRegisterShell64.exe
PID 1520 wrote to memory of 1256	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1256	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1256	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1256	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1256	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1256	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1256	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1900	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1900	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1900	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1900	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1900	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1900	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1520 wrote to memory of 1900	1520	GoogleUpdate.exe	GoogleUpdate.exe
PID 1100 wrote to memory of 1832	1100	GoogleUpdate.exe	103.0.5060.66_chrome_installer.exe
PID 1100 wrote to memory of 1832	1100	GoogleUpdate.exe	103.0.5060.66_chrome_installer.exe
PID 1100 wrote to memory of 1832	1100	GoogleUpdate.exe	103.0.5060.66_chrome_installer.exe
PID 1100 wrote to memory of 1832	1100	GoogleUpdate.exe	103.0.5060.66_chrome_installer.exe
PID 1832 wrote to memory of 1568	1832	103.0.5060.66_chrome_installer.exe	setup.exe
PID 1832 wrote to memory of 1568	1832	103.0.5060.66_chrome_installer.exe	setup.exe
PID 1832 wrote to memory of 1568	1832	103.0.5060.66_chrome_installer.exe	setup.exe
PID 1568 wrote to memory of 1108	1568	setup.exe	setup.exe
PID 1568 wrote to memory of 1108	1568	setup.exe	setup.exe
PID 1568 wrote to memory of 1108	1568	setup.exe	setup.exe
PID 1568 wrote to memory of 1716	1568	setup.exe	setup.exe
PID 1568 wrote to memory of 1716	1568	setup.exe	setup.exe
PID 1568 wrote to memory of 1716	1568	setup.exe	setup.exe
PID 1716 wrote to memory of 2024	1716	setup.exe	setup.exe
PID 1716 wrote to memory of 2024	1716	setup.exe	setup.exe
PID 1716 wrote to memory of 2024	1716	setup.exe	setup.exe
PID 1100 wrote to memory of 300	1100	GoogleUpdate.exe	GoogleUpdate.exe

C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Panel\RedLine_20_2\Tools\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Panel\RedLine_20_2\Tools\Chrome.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:560

C:\Program Files (x86)\GUM1862.tmp\GoogleUpdate.exe
"C:\Program Files (x86)\GUM1862.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={147E1A31-5E49-ACD4-7646-E2EE6FA22B56}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1396

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:436

C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1932

C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1888

C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1908

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNC4xMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjM0LjExIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0MxMDFBNDkxLTk3NzUtNDZEMS05MTdDLUFGQkI4Q0YwMkQ3OH0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins4M0E3QTI2Ny1FRjE0LTQ3RkUtQjc2OC00ODc1MzBCQjc1Qjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNi43MSIgbmV4dHZlcnNpb249IjEuMy4zNC4xMSIgbGFuZz0icnUiIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9InsxNDdFMUEzMS01RTQ5LUFDRDQtNzY0Ni1FMkVFNkZBMjJCNTZ9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9Ijg5MzkiLz48L2FwcD48L3JlcXVlc3Q-
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={147E1A31-5E49-ACD4-7646-E2EE6FA22B56}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{C101A491-9775-46D1-917C-AFBB8CF02D78}"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1100

C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\103.0.5060.66_chrome_installer.exe
"C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\103.0.5060.66_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\guiA3EE.tmp"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe
"C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\guiA3EE.tmp"
3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Registers COM server for autorun
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568

C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe
"C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.66 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f83b618,0x13f83b628,0x13f83b638
4⤵
- Executes dropped EXE
PID:1108

C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe
"C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716

C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe
"C:\Program Files (x86)\Google\Update\Install\{9983F834-53B1-41DC-95CF-5F606903DF1A}\CR_F5A1D.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.66 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f83b618,0x13f83b628,0x13f83b638
5⤵
- Executes dropped EXE
PID:2024

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNC4xMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjM0LjExIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0MxMDFBNDkxLTk3NzUtNDZEMS05MTdDLUFGQkI4Q0YwMkQ3OH0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntCODQ1NjA3Qi0yOEZCLTQ1ODQtQTAxNy1BRDA4RjI3N0Y2Q0V9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEwMy4wLjUwNjAuNjYiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InJ1IiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNzgiIGlpZD0iezE0N0UxQTMxLTVFNDktQUNENC03NjQ2LUUyRUU2RkEyMkI1Nn0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2Fjc2t2dGdkZHYyM2ZvNzR0aHY2bjc1ZDdrdnFfMTAzLjAuNTA2MC42Ni8xMDMuMC41MDYwLjY2X2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSI4NDkzNzgxNiIgdG90YWw9Ijg0OTM3ODE2IiBkb3dubG9hZF90aW1lX21zPSIxNTU1MyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjY5NzMiIGRvd25sb2FkX3RpbWVfbXM9IjE2NTIxIiBkb3dubG9hZGVkPSI4NDkzNzgxNiIgdG90YWw9Ijg0OTM3ODE2IiBpbnN0YWxsX3RpbWVfbXM9IjE1MTc5Ii8-PGRhdGEgbmFtZT0iaW5zdGFsbCIgaW5kZXg9ImVtcHR5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.66 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef56a5ba8,0x7fef56a5bb8,0x7fef56a5bc8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1272 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:2
4⤵
- Executes dropped EXE
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1520 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2056 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:1820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2028 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:1160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=2560 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3024 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1332 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:2
4⤵
- Executes dropped EXE
PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --mojo-platform-channel-handle=4116 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4236 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4348 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1700 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4368 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4292 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4484 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=3872 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:1888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:1100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=108 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1088 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 --field-trial-handle=1164,i,10748925454994711005,17118010209444984486,131072 /prefetch:8
4⤵
- Executes dropped EXE
PID:2244

C:\Program Files\Google\Chrome\Application\103.0.5060.66\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\103.0.5060.66\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2296

C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2296_236508804\ChromeRecovery.exe
"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2296_236508804\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=103.0.5060.66 --sessionid={a334033d-54f6-42fe-9aad-f9997bcd9282} --system
2⤵
- Executes dropped EXE
PID:1200

C:\Windows\system32\taskeng.exe
taskeng.exe {86B65B0F-17C7-4B39-B857-D2D731F9B598} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2092

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
2⤵
- Executes dropped EXE
PID:1676

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /cr
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1956

C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler.exe
"C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler.exe"
3⤵
- Executes dropped EXE
PID:2596

C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe
"C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe"
3⤵
- Executes dropped EXE
PID:2592

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:660

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /registermsihelper
4⤵
- Executes dropped EXE
PID:2164

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
2⤵
- Executes dropped EXE
PID:2764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2660

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2944

C:\Program Files (x86)\Google\Update\Install\{0CBACF14-6B51-4F33-9AB6-13E22354F669}\GoogleUpdateSetup.exe
"C:\Program Files (x86)\Google\Update\Install\{0CBACF14-6B51-4F33-9AB6-13E22354F669}\GoogleUpdateSetup.exe" /update /sessionid "{81742022-3E35-4CA1-BE56-B606AC4A0972}"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3016

C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Temp\GUMA20A.tmp\GoogleUpdate.exe" /update /sessionid "{81742022-3E35-4CA1-BE56-B606AC4A0972}"
3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3044

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
4⤵
- Executes dropped EXE
- Modifies registry class
PID:1184

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
4⤵
- Executes dropped EXE
- Modifies registry class
PID:1200

C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:592

C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:1760

C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:2488

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNC4xMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4MTc0MjAyMi0zRTM1LTRDQTEtQkU1Ni1CNjA2QUM0QTA5NzJ9IiBpbnN0YWxsc291cmNlPSJzZWxmdXBkYXRlIiByZXF1ZXN0aWQ9IntDQTlDQzIwNS01NDZELTQ3RjMtOTkyOC0xOEQyNzA0MkU2NDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNC4xMSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMzIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI3OCIgaW5zdGFsbGRhdGU9IjU2NTYiIGNvaG9ydD0iMTo5Y286IiBjb2hvcnRuYW1lPSJFdmVyeW9uZSBFbHNlIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNC4xMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjM0LjExIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezgxNzQyMDIyLTNFMzUtNENBMS1CRTU2LUI2MDZBQzRBMDk3Mn0iIGluc3RhbGxzb3VyY2U9ImNvcmUiIHJlcXVlc3RpZD0ie0MxNUU5QTNCLUQzQjItNEVGNC04Mjg0LTg3RTExN0Q1MEI1QX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM0LjExIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjEzMiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ijc4IiBpaWQ9InsxNDdFMUEzMS01RTQ5LUFDRDQtNzY0Ni1FMkVFNkZBMjJCNTZ9IiBjb2hvcnQ9IjE6OWNvOiIgY29ob3J0bmFtZT0iRXZlcnlvbmUgRWxzZSI-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9lZGdlZGwubWUuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL3VwZGF0ZTIvYWN4cGVzZmF5MzV6cWg2M2FnM2lzcHBjeWN4YV8xLjMuMzYuMTMyL0dvb2dsZVVwZGF0ZVNldHVwLmV4ZSIgZG93bmxvYWRlZD0iMTQxNDYwMCIgdG90YWw9IjE0MTQ2MDAiIGRvd25sb2FkX3RpbWVfbXM9IjkzNTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery