94224c4d601e86418da3906b0e08435507d8e3b617a87b41ff5c3bc33eb22fe0

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iTunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iTunes.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	AppleMobileDeviceHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	iTunes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	AppleMobileDeviceHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	iTunes.exe

Executes dropped EXE 20 IoCs

pid	Process
364	iTunes64Setup.exe
3108	SetupAdmin.exe
4004	mDNSResponder.exe
2660	Process not Found
4348	AppleMobileDeviceService.exe
668	SoftwareUpdate.exe
5724	iPodService.exe
7492	iTunesHelper.exe
5312	iTunes.exe
364	AppleMobileDeviceHelper.exe
1364	iTunesVisualizerHost.exe
6288	distnoted.exe
6432	distnoted.exe
7244	SoftwareUpdate.exe
488	iTunes.exe
5932	AppleMobileDeviceHelper.exe
1412	distnoted.exe
5368	distnoted.exe
6096	iTunesVisualizerHost.exe
1888	Process not Found

Loads dropped DLL 64 IoCs

pid	Process
3664	MsiExec.exe
3664	MsiExec.exe
3664	MsiExec.exe
3664	MsiExec.exe
3664	MsiExec.exe
2652	MsiExec.exe
2652	MsiExec.exe
2652	MsiExec.exe
5104	MsiExec.exe
5104	MsiExec.exe
1040	MsiExec.exe
1600	MsiExec.exe
4136	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
2528	MsiExec.exe
1500	MsiExec.exe
2180	MsiExec.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
2528	MsiExec.exe
3136	MsiExec.exe
3136	MsiExec.exe
4308	MsiExec.exe
4428	MsiExec.exe
668	SoftwareUpdate.exe
668	SoftwareUpdate.exe
668	SoftwareUpdate.exe
4164	DllHost.exe
668	SoftwareUpdate.exe
668	SoftwareUpdate.exe
624	MsiExec.exe
2152	chrome.exe
2884	chrome.exe
5264	Process not Found
5960	MsiExec.exe
5960	MsiExec.exe
5960	MsiExec.exe
5960	MsiExec.exe
5960	MsiExec.exe
2084	MsiExec.exe
2084	MsiExec.exe
976	MsiExec.exe
1844	MsiExec.exe

Registers COM server for autorun 1 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32\ = "C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\OutlookChangeNotifierAddIn.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC0C2640-1415-4644-875C-6F4D769839BA}\LocalServer32\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368F81BC-9439-41A8-B532-39C8D7E7D147}\LocalServer32\ = "\"C:\\Program Files\\iPod\\bin\\iPodService.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F7A782D3-2DDD-4327-BB70-0D1D0F1E38B0}\InprocServer32\ = "C:\\Program Files\\iPod\\bin\\iPodUpdaterExt.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7A7FB085-6068-4898-8CCA-480A9187277C}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{063D34A4-BF84-4B8D-B699-E8CA06504DDE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E9D58BF1-0070-4fcd-B722-A0EE5A3ABCD6}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{368F81BC-9439-41A8-B532-39C8D7E7D147}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6C2589C3-96F8-4863-A511-9C33EB2C7E2A}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{71A1A612-F7B4-4092-8E0F-C79C8FB0391D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B33927D0-89E6-45D8-87C7-27F3DE3EFDE6}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B33927D0-89E6-45D8-87C7-27F3DE3EFDE6}\LocalServer32\ = "\"C:\\Program Files\\iPod\\bin\\iPodService.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{788D599D-FE85-4142-9B47-2498C5C6D0CF}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F7A782D3-2DDD-4327-BB70-0D1D0F1E38B0}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{11E4D223-C650-43F9-AB90-AB3AE4FB38F0}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8DF592B-DE05-49f5-BB21-084F548F12A9}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{063D34A4-BF84-4B8D-B699-E8CA06504DDE}\LocalServer32\ = "\"C:\\Program Files\\iPod\\bin\\iPodService.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DC0C2640-1415-4644-875C-6F4D769839BA}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11E4D223-C650-43F9-AB90-AB3AE4FB38F0}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{62A560B8-09DB-4cc6-AE1B-9D8F7ADDB8F3}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ADDA11-8287-44D0-8C63-27CDA87ACC46}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F7A782D3-2DDD-4327-BB70-0D1D0F1E38B0}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62A560B8-09DB-4cc6-AE1B-9D8F7ADDB8F3}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CCCACE3-3DEE-4659-93AA-19E6C38D8EEC}\LocalServer32\ = "\"C:\\Program Files\\iPod\\bin\\iPodService.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{20ADDA11-8287-44D0-8C63-27CDA87ACC46}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7CCCACE3-3DEE-4659-93AA-19E6C38D8EEC}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9D58BF1-0070-4fcd-B722-A0EE5A3ABCD6}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{08A6AF6A-8FF2-4a3b-BECF-C2FAC8630BBF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08A6AF6A-8FF2-4a3b-BECF-C2FAC8630BBF}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{788D599D-FE85-4142-9B47-2498C5C6D0CF}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11E4D223-C650-43F9-AB90-AB3AE4FB38F0}\InProcServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71A1A612-F7B4-4092-8E0F-C79C8FB0391D}\InprocServer32\ = "C:\\Program Files\\iTunes\\iTunesAdmin.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7A7FB085-6068-4898-8CCA-480A9187277C}\LocalServer32\ = "\"C:\\Program Files\\iPod\\bin\\iPodService.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6C2589C3-96F8-4863-A511-9C33EB2C7E2A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B8DF592B-DE05-49f5-BB21-084F548F12A9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper = "\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""	msiexec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
164	1000	msiexec.exe
166	1000	msiexec.exe

Enumerates connected drives 3 TTPs 54 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\D:	iTunes.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	AppleMobileDeviceHelper.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	iTunes.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	iTunes.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	AppleMobileDeviceHelper.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	AppleMobileDeviceHelper.exe
File opened (read-only)	\??\F:	iTunes.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	AppleMobileDeviceHelper.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\AuditTestContentView.js	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\nl.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\Palette.svg	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\WebSocketLarge.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\Toolbar.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pl.lproj\PrintingTemplates\06.AlbumList.ListOfAlbums.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ko.lproj\iTunesLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\StoreBlankBuyButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt.lproj\ViewLineItemUnsubscribe.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hi.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hu.lproj\PrintingTemplates\11.Insert.TextOnlyBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ms.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\AuthKitWin.resources\ru.lproj\AuthKitWinLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\NetworkTimelineView.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es.lproj\ViewLineItemRatingE.png	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServices\Schemas\Contacts.syncschema\Contents\Resources\English.lproj\Schema.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\da.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\StoreGiftButton.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\DatabaseTreeElement.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\cs.lproj\PrintingTemplates\10.Insert.SingleCover.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.dll	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ScriptTimelineDataGridNode.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\AuditTestCaseResult.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es_419.lproj\iPod License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\ViewLineItemiTunesExtras_dark.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\PrintingTemplates\05.AlbumList.SongsByAlbum.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_TW.lproj\[email protected]	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\com.apple.WindowsMail.client.resources\Description.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\el.lproj\PrintingTemplates\16.Media.PlainPaper.DS.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hu.lproj\PrintingTemplates\16.Media.PlainPaper.DS.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\iTunesExtraGridView.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sv.lproj\PrintingTemplates\04.Playlist.Custom.xml	msiexec.exe
File created	C:\Program Files\iTunes\MediaAccessibility.resources\fi.lproj\ProfileNames.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt.lproj\iTunesLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sk.lproj\ViewLineItemRatingC.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\TypeSymbol.svg	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ColumnWidths.plist	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\IgnoreCaches.svg	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\he.lproj\iTunesLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pl.lproj\PrintingTemplates\12.Insert.MosaicBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\cs.lproj\About iTunes.rtf	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr.lproj\ViewLineItemRatingE.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ro.lproj\PrintingTemplates\03.Playlist.DatesPlayed.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\ViewLineItemSubscribe.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ar.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es.lproj\PrintingTemplates\08.Insert.Mosaic.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nb.lproj\ViewLineItemiTunesExtras_dark.png	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\mediaControlsApple.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\nb.lproj\iPod License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\WebSocketContentView.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\zh_HK.lproj\AppConfig.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\tr.lproj\CleanLyrics.png	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\CFNetwork.resources\ca.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CoreFoundation.resources\de.lproj\Error.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\tr.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sk.lproj\PrintingTemplates\16.Media.PlainPaper.DS.xml	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{E6FF3475-A35E-481F-8A8E-3D73CF3A30A1}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1215.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A3985C05-7386-411F-A4BF-32A73F37EB44}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE04E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9756.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC80E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c356.msi	msiexec.exe
File created	C:\Windows\Installer\{74CC99EB-7DC0-4CB0-847A-F8C2FE39690C}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\e59c361.msi	msiexec.exe
File created	C:\Windows\Installer\e59c365.msi	msiexec.exe
File created	C:\Windows\Installer\e59c366.msi	msiexec.exe
File created	C:\Windows\Installer\{E6FF3475-A35E-481F-8A8E-3D73CF3A30A1}\iTunes.ico	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2169.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFD4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6FF3475-A35E-481F-8A8E-3D73CF3A30A1}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e59c368.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECC5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF17.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{E6FF3475-A35E-481F-8A8E-3D73CF3A30A1}\Installer.ico	msiexec.exe
File created	C:\Windows\Installer\e59c356.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD8D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE188.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c361.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\{E6FF3475-A35E-481F-8A8E-3D73CF3A30A1}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC75F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE03E.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c360.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6F4.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BE99CC470CD70BC448A78F2CEF9396C0\14.5.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC46F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\5743FF6EE53AF184A8E8D337FCA3031A\12.10.11\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e59c35b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{A3985C05-7386-411F-A4BF-32A73F37EB44}\AppleSoftwareUpdateIco.exe	msiexec.exe
File created	C:\Windows\Installer\{E6FF3475-A35E-481F-8A8E-3D73CF3A30A1}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c35c.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ce060165ac6eec080000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ce0601650000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ce060165000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dce060165000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce06016500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SoftwareUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iTunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SoftwareUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iTunes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	SoftwareUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	iTunes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	SoftwareUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	iTunes.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133444454132615146"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL	AppleMobileDeviceService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames\asl.log = "asl.142603_14Nov23.log"	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d\52C64B7E	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	AppleMobileDeviceService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunesAdmin.iTunesAdminParentalControls\ = "iTunesAdminParentalControls Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService\ = "DNSSDService Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C1D8C091-AC66-4159-B738-E70A12B983A4}\1.0\ = "ScriptingObjectModel"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F7E1C5D-4D91-48C9-B09E-3E45D502FFA0}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cda\Content Type = "application/x-cdf"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.PlaySongsOnCD\shell\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.AssocProtocol.italss\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50C5893A6837F1144AFB237AF373BE44\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{349CBB45-2E5A-4822-8E4A-A75555A186F7}\TypeLib\Version = "1.d"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.ipsw	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F6FFB0D-DDD3-407A-8349-7EC794720C60}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9E93C96F-CF0D-43F6-8BA8-B807A3370712}\1.d\ = "iTunes 1.13 Type Library"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\iTunes.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91A9E6A9-3935-4A37-AFBA-F0904B166364}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A52621AD-E10F-477B-9ACB-B6181610788B}\TypeLib\ = "{7C1E4FCC-B47E-44AE-8EA7-FA66EBC8BAC4}"	SoftwareUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{370D7BE0-3A89-4A42-B902-C75FC138BE09}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.mov	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\PerceivedType = "video"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{BE2617AA-4914-45C0-925B-1F3F1DF8007D}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	iTunes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4b\ = "MPEG-4 Audio File (Protected)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.mpg\shell\play\command\ = "\"C:\\Program Files\\iTunes\\iTunes.exe\" /play \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04F33289-C1B6-4FF9-97D5-E74FB157E7C8}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pcast\AppUserModelID = "Apple.iTunes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62A560B8-09DB-4cc6-AE1B-9D8F7ADDB8F3}\Elevation\IconReference = "@C:\\Program Files\\iTunes\\iTunes.exe,-128"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88F48C4A-46DF-4236-A838-364BF1B3FD1E}\InProcServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.m4r\FriendlyTypeName = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,-202"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdda\OpenWithProgIds\iTunes.cdda	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.rmp\FriendlyTypeName = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,-13"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.wav\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\itals\AppUserModelID = "Apple.iTunes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EFC17DA5-1403-4DCF-A67F-E699180ED173}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IPodUpdaterExt.iPodUpdaterInterface\CurVer	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{7063AAF6-ABA0-493B-B4FC-920A9F105875}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8862BCA9-168D-4549-A9D5-ADB35E553BA6}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF4D8ACE-1720-4FB9-B0AE-9877249E89B0}\TypeLib\ = "{9E93C96F-CF0D-43F6-8BA8-B807A3370712}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{063D34A4-BF84-4B8D-B699-E8CA06504DDE}\TypeLib\ = "{46BC1593-FE6B-419C-922D-AF3591AED129}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.aif\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	iTunes.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	iTunes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u8\Content Type = "audio/x-mpegurl"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\ = "iTunes.mp3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B33927D0-89E6-45D8-87C7-27F3DE3EFDE6}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0F6FFB0D-DDD3-407A-8349-7EC794720C60}	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5743FF6EE53AF184A8E8D337FCA3031A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	iTunes.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{FF194254-909D-4437-9C50-3AAC2AE6305C}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipsw\ = "iTunes.ipsw"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.mp2\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunesAdmin.iTunesAdminRepairIPodSW.1\CLSID\ = "{62A560B8-09DB-4cc6-AE1B-9D8F7ADDB8F3}"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iTunes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.wave\FriendlyTypeName = "@C:\\Program Files\\iTunes\\iTunes.Resources\\iTunesRegistry.dll,-15"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m3u\shell\play\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.m3u\OpenWithProgIds	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\iTunes.m4a\shell\play\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pcast\OpenWithProgIds	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iTunes.AssocProtocol.itpc\shell\open	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431	iTunes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 040000000100000010000000ee2931bc327e9ae6e8b5f751b43471900f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b060105050703076200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770b000000010000001e00000045006e00740072007500730074002000280032003000340038002900000014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c7e000000010000000800000000c001b39667d601030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343119000000010000001000000091fad483f14848a8a69b18b805cdbb3a20000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	iTunes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 5c00000001000000040000000008000019000000010000001000000091fad483f14848a8a69b18b805cdbb3a030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34317e000000010000000800000000c001b39667d6011d0000000100000010000000e871723e266f38af5d49cda2a502669c14000000010000001400000055e481d11180bed889b908a331f9a1240916b9700b000000010000001e00000045006e0074007200750073007400200028003200300034003800290000006200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1777f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8040000000100000010000000ee2931bc327e9ae6e8b5f751b434719020000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	iTunes.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
3608	chrome.exe
3608	chrome.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
4348	AppleMobileDeviceService.exe
4348	AppleMobileDeviceService.exe
2388	msiexec.exe
2388	msiexec.exe
5960	MsiExec.exe
5960	MsiExec.exe
364	AppleMobileDeviceHelper.exe
364	AppleMobileDeviceHelper.exe
5312	iTunes.exe
5312	iTunes.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5312	iTunes.exe
488	iTunes.exe
7772	taskmgr.exe
2884	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
644	AcroRd32.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
1000	msiexec.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
1000	msiexec.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe
7772	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
644	AcroRd32.exe
644	AcroRd32.exe
644	AcroRd32.exe
644	AcroRd32.exe
668	SoftwareUpdate.exe
5312	iTunes.exe
5312	iTunes.exe
1364	iTunesVisualizerHost.exe
7244	SoftwareUpdate.exe
7244	SoftwareUpdate.exe
7244	SoftwareUpdate.exe
7244	SoftwareUpdate.exe
488	iTunes.exe
488	iTunes.exe
6096	iTunesVisualizerHost.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
7760	chrome.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
916	chrome.exe
488	iTunes.exe
488	iTunes.exe
5044	chrome.exe
6128	chrome.exe
6024	chrome.exe
6024	chrome.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe
1040	chrome.exe
488	iTunes.exe
488	iTunes.exe
488	iTunes.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3044	2884	chrome.exe	100
PID 2884 wrote to memory of 3044	2884	chrome.exe	100
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 4444	2884	chrome.exe	101
PID 2884 wrote to memory of 2152	2884	chrome.exe	102
PID 2884 wrote to memory of 2152	2884	chrome.exe	102
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103
PID 2884 wrote to memory of 4668	2884	chrome.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Unit_2-136-141.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffba81d9758,0x7ffba81d9768,0x7ffba81d9778
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1916 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1956 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4652 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4960 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5540 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4144 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2336 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6012 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2768 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5824 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1688
- C:\Users\Admin\Downloads\iTunes64Setup.exe
  "C:\Users\Admin\Downloads\iTunes64Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:364
- - C:\Windows\system32\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP919.TMP\iTunes64.msi" INSTALL_SUPPORT_PACKAGES=1
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of FindShellTrayWindow
    PID:1000
  - - C:\Program Files\iTunes\iTunesHelper.exe
      "C:\Program Files\iTunes\iTunesHelper.exe"
      4⤵
      Executes dropped EXE
      PID:7492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=2728 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5800 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3160 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2764 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4000 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=3692 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3352 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6296 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5560 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3516 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5436 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4552 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6564 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=2388 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=6116 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6308 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6228 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4012 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=1580 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6436 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5604 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6212 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5396 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=5188 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6632 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=6636 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=6956 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=7132 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=7604 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=7776 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=7740 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=7472 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=7396 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=8216 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=8372 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=8160 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=8716 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=8892 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=9160 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=9120 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=9048 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=9012 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=9548 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=9472 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=2376 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=5580 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=6196 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=9776 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=9896 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=3268 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=10448 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=4660 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=5708 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=10048 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=11052 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=11180 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=11512 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=11636 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=11808 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --mojo-platform-channel-handle=10376 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=10420 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=11832 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --mojo-platform-channel-handle=11860 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=11872 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=11844 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=11496 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --mojo-platform-channel-handle=5580 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:8120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10120 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:6936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=6976 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=8032 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --mojo-platform-channel-handle=7788 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --mojo-platform-channel-handle=10720 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --mojo-platform-channel-handle=8672 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --mojo-platform-channel-handle=10756 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --mojo-platform-channel-handle=7136 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --mojo-platform-channel-handle=5436 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --mojo-platform-channel-handle=7660 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --mojo-platform-channel-handle=7340 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --mojo-platform-channel-handle=10368 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --mojo-platform-channel-handle=10756 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --mojo-platform-channel-handle=7400 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --mojo-platform-channel-handle=7876 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --mojo-platform-channel-handle=11516 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --mojo-platform-channel-handle=7072 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --mojo-platform-channel-handle=11508 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --mojo-platform-channel-handle=10940 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:8076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --mojo-platform-channel-handle=8512 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --mojo-platform-channel-handle=7604 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10836 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:7376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --mojo-platform-channel-handle=3220 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --mojo-platform-channel-handle=8008 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --mojo-platform-channel-handle=7836 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --mojo-platform-channel-handle=10736 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --mojo-platform-channel-handle=9556 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --mojo-platform-channel-handle=7032 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --mojo-platform-channel-handle=11244 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --mojo-platform-channel-handle=9400 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --mojo-platform-channel-handle=8088 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --mojo-platform-channel-handle=9388 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --mojo-platform-channel-handle=8920 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --mojo-platform-channel-handle=7860 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --mojo-platform-channel-handle=9920 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10504 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --mojo-platform-channel-handle=10504 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:7280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --mojo-platform-channel-handle=1020 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --mojo-platform-channel-handle=6268 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=11516 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8576 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:7012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --mojo-platform-channel-handle=9640 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --mojo-platform-channel-handle=9960 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --mojo-platform-channel-handle=6640 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7040 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --mojo-platform-channel-handle=11964 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --mojo-platform-channel-handle=6700 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:8068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --mojo-platform-channel-handle=10140 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --mojo-platform-channel-handle=11688 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6088 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9776 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --mojo-platform-channel-handle=12212 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:7760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7976 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:6296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --mojo-platform-channel-handle=6368 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11296 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11816 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9764 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8584 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=12260 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:7968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --mojo-platform-channel-handle=2816 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10772 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --mojo-platform-channel-handle=3960 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9640 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10200 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=164 --mojo-platform-channel-handle=9552 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=165 --mojo-platform-channel-handle=7624 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4048 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:6704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7596 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:7384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8580 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8884 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7556 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:7932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7508 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7492 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1764,i,3550129079100157447,17257462957945139166,131072 /prefetch:8
  2⤵
  PID:1688

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2388
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CDA18918DFCE4BBCE7309CF5B447BA93 C
  2⤵
  - Loads dropped DLL
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\IXP919.TMP\SetupAdmin.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP919.TMP\SetupAdmin.exe" /evt E8A4 /pid 3664 /mon 692 800
    3⤵
    - Executes dropped EXE
    PID:3108
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A265C7D91525294B2A814904864A5099
  2⤵
  - Loads dropped DLL
  PID:2652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EA7C49D820FAD0DAF8E93B59772BF879
  2⤵
  - Loads dropped DLL
  PID:5104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 73FC6AA9C1920A03DE5E2753593B9D7A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1040
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:1600
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:4136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 326659C1E5F12F412584555CEBC46537
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B1459A119CA8D5F7A1DE10B702650EE7
  2⤵
  - Loads dropped DLL
  PID:2528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4401F4576BA4D24A8B49E9386412C40A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 655FCFC1C71990B54E3AE0ABC31A900E
  2⤵
  - Loads dropped DLL
  PID:3136
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4308
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4428
- C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
  "C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" /RegServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA54F44C571187D1E964EA9038A45FD6 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:624
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5544
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 73267B929DB435A4460C882C49F293A7
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 48A633587B0B61DDB56A4DAA378AF807
  2⤵
  - Loads dropped DLL
  PID:2084
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 59ED2ECFB6F1BC1E31D214585D791952 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D631BE677E10EEEBA7D3C2428193FC82 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:1844

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:4004

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{16D99191-6280-4B33-A2F5-04805A0FC582}
1⤵
- Loads dropped DLL
PID:4164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x2fc
1⤵
PID:4464

C:\Program Files\iPod\bin\iPodService.exe
"C:\Program Files\iPod\bin\iPodService.exe"
1⤵
- Executes dropped EXE
PID:5724

C:\Program Files\iTunes\iTunes.exe
"C:\Program Files\iTunes\iTunes.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5312
- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
  "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe" --pipe \\.\pipe\3106995952963037186765312 --parentPipe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe
    "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe"
    3⤵
    - Executes dropped EXE
    PID:6288
- - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe
    "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe"
    3⤵
    - Executes dropped EXE
    PID:6432
- C:\Program Files\iTunes\iTunesVisualizerHost.exe
  "C:\Program Files\iTunes\iTunesVisualizerHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1364

C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
"C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" -Embedding
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:7244

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{16D99191-6280-4B33-A2F5-04805A0FC582}
1⤵
PID:4424

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:7772

C:\Program Files\iTunes\iTunes.exe
"C:\Program Files\iTunes\iTunes.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:488
- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
  "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe" --pipe \\.\pipe\31069959125485446413441488 --parentPipe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates connected drives
  PID:5932
- - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe
    "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe"
    3⤵
    - Executes dropped EXE
    PID:1412
- - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe
    "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\distnoted.exe"
    3⤵
    - Executes dropped EXE
    PID:5368
- C:\Program Files\iTunes\iTunesVisualizerHost.exe
  "C:\Program Files\iTunes\iTunesVisualizerHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery