hxxp://google[.]com

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.61\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe

Executes dropped EXE 64 IoCs

pid	Process
3364	ChromeSetup.exe
3648	updater.exe
3544	updater.exe
2004	updater.exe
1308	updater.exe
3604	updater.exe
4732	updater.exe
3472	125.0.6422.61_chrome_installer.exe
940	setup.exe
2300	setup.exe
2480	setup.exe
4528	setup.exe
3216	setup.exe
3184	setup.exe
3144	setup.exe
3884	setup.exe
4220	chrome.exe
2780	chrome.exe
2832	chrome.exe
2972	chrome.exe
5100	chrome.exe
1680	chrome.exe
900	chrome.exe
3568	elevation_service.exe
5080	chrome.exe
5092	chrome.exe
1800	chrome.exe
1544	chrome.exe
4876	chrome.exe
680	chrome.exe
3396	chrome.exe
3820	chrome.exe
4532	chrome.exe
1160	chrome.exe
4720	chrome.exe
1512	chrome.exe
3960	chrome.exe
1896	chrome.exe
4788	chrome.exe
1368	chrome.exe
1508	chrome.exe
4780	chrome.exe
3040	chrome.exe
2412	chrome.exe
4548	chrome.exe
4600	chrome.exe
4616	chrome.exe
1748	chrome.exe
2448	chrome.exe
2412	chrome.exe
5104	chrome.exe
4600	chrome.exe
3128	chrome.exe
2640	chrome.exe
488	chrome.exe
1388	chrome.exe
3968	chrome.exe
4236	chrome.exe
2296	chrome.exe
1336	chrome.exe
4828	chrome.exe
5492	remoting_native_messaging_host.exe
6108	remoting_host.exe
5216	remoting_host.exe

Loads dropped DLL 64 IoCs

pid	Process
4220	chrome.exe
2780	chrome.exe
4220	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
2972	chrome.exe
5100	chrome.exe
2972	chrome.exe
2832	chrome.exe
2832	chrome.exe
2832	chrome.exe
5100	chrome.exe
1680	chrome.exe
900	chrome.exe
900	chrome.exe
1680	chrome.exe
5080	chrome.exe
5080	chrome.exe
5092	chrome.exe
1800	chrome.exe
5092	chrome.exe
1800	chrome.exe
1544	chrome.exe
1544	chrome.exe
4876	chrome.exe
4876	chrome.exe
3396	chrome.exe
680	chrome.exe
680	chrome.exe
3396	chrome.exe
3820	chrome.exe
3820	chrome.exe
4532	chrome.exe
4532	chrome.exe
1160	chrome.exe
1160	chrome.exe
4720	chrome.exe
1512	chrome.exe
1512	chrome.exe
4720	chrome.exe
3960	chrome.exe
3960	chrome.exe
1896	chrome.exe
1896	chrome.exe
4788	chrome.exe
4788	chrome.exe
1368	chrome.exe
1368	chrome.exe
1508	chrome.exe
1508	chrome.exe
4780	chrome.exe
4780	chrome.exe
3040	chrome.exe
3040	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
2412	chrome.exe
4548	chrome.exe
4600	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.61\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.61\\notification_helper.exe"	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\inomeogfingihgjfjlpeplalcfajhgai\2.1_0\manifest.json	chrome.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe
File opened for modification	C:\Windows\SysWOW64\debug.log	remoting_host.exe
File opened for modification	C:\Windows\system32\compmgmt.msc	mmc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_core.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\019a7562-a22a-424e-b5c0-8222a860b6fb.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\lv.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\ur.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\WidevineCdm\manifest.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\chrome_proxy.exe	setup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\new_chrome.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\debug.log	remoting_host.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe58cb5a.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\WidevineCdm\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\ko.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\sv.pak	setup.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remote_assistance_host_uiaccess.exe	msiexec.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\VisualElements\LogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\chrome.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\9c9d15a7-e8a2-4714-8a26-75c9efe33b83.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\c1dca3a6-0186-47e1-900b-4b755a1dd99d.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\th.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\com.google.chrome.remote_assistance-firefox.json	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\sk.pak	setup.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_start_host.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\GoogleUpdate.exe	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\ru.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\475d80dc-0ac3-45a4-8184-a4c2ef00953f.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files\Google\Chrome\Application\new_chrome.exe	setup.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\icudtl.dat	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\gu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\475d80dc-0ac3-45a4-8184-a4c2ef00953f.tmp	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\ec59e584-37ad-4fcc-a733-55fe855e89f5.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\fi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\ro.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\resources.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5d5aa6.TMP	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\895a88f1-0a07-4122-a8ab-34b6da6abdb6.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\ms.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files\Google\Chrome\Application\new_chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remote_webauthn.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\895a88f1-0a07-4122-a8ab-34b6da6abdb6.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source940_448873880\Chrome-bin\125.0.6422.61\Locales\et.pak	setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4220_788211051\LICENSE.txt	chrome.exe
File created	C:\Windows\Installer\{EF2787B1-0F5C-449C-86FF-6F4D28DE3C46}\chromoting.ico	msiexec.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\SystemTemp\Google3364_2136153140\UPDATER.PACKED.7Z	ChromeSetup.exe
File created	C:\Windows\Installer\e5bfd39.msi	msiexec.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\SystemTemp\Google3364_101391265\updater.7z	ChromeSetup.exe
File created	C:\Windows\SystemTemp\~DFA6FA816ABBAD311D.TMP	msiexec.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File opened for modification	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe	125.0.6422.61_chrome_installer.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Installer\MSI945.tmp	msiexec.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\manifest.fingerprint	updater.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4220_788211051\manifest.fingerprint	chrome.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe	125.0.6422.61_chrome_installer.exe
File created	C:\Windows\SystemTemp\~DF32F7ECF2993B1640.TMP	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\SystemTemp\Google3364_101391265\bin\updater.exe	ChromeSetup.exe
File opened for modification	C:\Windows\Installer\MSIFF4E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_url_fetcher_3604_107814984\-8a69d345-d564-463c-aff1-a69d9e530f96-_125.0.6422.61_all_adurlzmdiob7av5yp6r2fjnic4sq.crx3	updater.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4220_788211051\Filtering Rules	chrome.exe
File created	C:\Windows\INF\c_primitive.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File opened for modification	C:\Windows\SystemTemp	updater.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1556	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3268	5216	WerFault.exe	202
5044	5464	WerFault.exe	10893
6780	7108	WerFault.exe	11346
3796	6708	WerFault.exe	11825

Checks SCSI registry key(s) 3 TTPs 40 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007974a9d8010144950000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007974a9d80000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007974a9d8000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7974a9d8000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007974a9d800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	mmc.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\AccessibilityCPL.dll,-86 = "Settings"	atbroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	remoting_host.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	remoting_host.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig	atbroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\osk\Dock = "0"	atbroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	remoting_host.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	remoting_host.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	remoting_host.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	remoting_host.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	remoting_host.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\osk\ScanInterval = "1000"	atbroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607243661830622"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290404096"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory3 = "2298344"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	remoting_host.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	remoting_host.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	remoting_host.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATConfig\osk\ShowClearKeyboard = "1"	atbroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	remoting_host.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Network	remoting_host.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT	remoting_host.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors\ColorHistory0 = "14120960"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	atbroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib\ = "{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\126.0.6462.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\125.0.6422.31\\remoting_core.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ = "IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\126.0.6462.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{655bd819-c08c-4b04-80c2-f160739ff6ef}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine\CLSID	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0\ = "GoogleUpdater TypeLib for IGoogleUpdate3Web"	updater.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1097"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\1.0\ = "GoogleUpdater TypeLib for IAppWeb"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Typelib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\ = "{DD42475D-6D46-496A-924E-BD5630B4CBBA}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\ProxyStubClsid32\ = "{b59b96da-83cb-40ee-9b91-c377400fc3e3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\767F12B2751E6AF469C35538C441336A	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib\ = "{699F07AD-304C-5F71-A2DA-ABD765965B54}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\126.0.6462.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B62C003B-DD12-572A-87D4-6AA073CD56B1}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib\ = "{5F793925-C903-4E92-9AE3-77CA5EAB1716}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ = "IUpdateStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\ = "GoogleUpdater TypeLib for IUpdaterAppStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F253E6BF-D9BE-5B1A-9E0D-23FA9FD4D571}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B7872FEC5F0C94468FFF6D482EDC364\Version = "2097158422"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B62C003B-DD12-572A-87D4-6AA073CD56B1}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib\ = "{F4334319-8210-469B-8262-DD03623FEB5B}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib\ = "{B685B009-DBC4-4F24-9542-A162C3793E77}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\126.0.6462.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a22c946-f9f5-51e0-b7b1-ef8ea58a1f65}\TypeLib\ = "{b6396c45-b0cc-456b-9f49-f12964ee6df4}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\126.0.6462.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\126.0.6462.0\\updater.exe\\6"	updater.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ChromeSetup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Webstore Downloads\inomeogfingihgjfjlpeplalcfajhgai_12358.crx:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\scoped_dir4220_583585185\inomeogfingihgjfjlpeplalcfajhgai_12358.crx\:Zone.Identifier:$DATA	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\chromeremotedesktophost.msi:Zone.Identifier	chrome.exe

Runs regedit.exe 1 IoCs

pid	Process
6068	regedit.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3428	remoting_desktop.exe
6416	explorer.exe
4892	remoting_desktop.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
3648	updater.exe
3648	updater.exe
3648	updater.exe
3648	updater.exe
3648	updater.exe
3648	updater.exe
2004	updater.exe
2004	updater.exe
2004	updater.exe
2004	updater.exe
2004	updater.exe
2004	updater.exe
3604	updater.exe
3604	updater.exe
3604	updater.exe
3604	updater.exe
3604	updater.exe
3604	updater.exe
3604	updater.exe
3604	updater.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
2412	chrome.exe
2412	chrome.exe
2272	msiexec.exe
2272	msiexec.exe
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe
5668	updater.exe
5668	updater.exe
5668	updater.exe
5668	updater.exe
5720	updater.exe
5720	updater.exe
5720	updater.exe
5720	updater.exe
5792	updater.exe
5792	updater.exe
5792	updater.exe
5792	updater.exe
5792	updater.exe
5792	updater.exe
5792	updater.exe
5792	updater.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe
6808	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
2388	osk.exe
3428	remoting_desktop.exe
6600	mmc.exe
6808	Taskmgr.exe
4892	remoting_desktop.exe
6068	regedit.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
2068	Process not Found
4956	Process not Found
1408	Process not Found
2596	Process not Found
2556	Process not Found
3164	Process not Found
4524	Process not Found
4500	Process not Found
3744	Process not Found
1344	Process not Found
2292	Process not Found
1580	Process not Found
1008	Process not Found
5508	Process not Found
2016	Process not Found
3452	Process not Found
2868	Process not Found
6468	Process not Found
2740	Process not Found
6212	Process not Found
2896	Process not Found
484	Process not Found
228	Process not Found
5588	Process not Found
5424	Process not Found
3700	Process not Found
4260	Process not Found
6612	Process not Found
6204	Process not Found
2212	Process not Found
1076	Process not Found
2080	Process not Found
4824	Process not Found
4236	Process not Found
5472	Process not Found
3748	Process not Found
5884	Process not Found
488	Process not Found
1148	Process not Found
5648	Process not Found
2444	Process not Found
4868	Process not Found
1252	Process not Found
7132	Process not Found
3220	Process not Found
7156	Process not Found
4548	Process not Found
6460	Process not Found
1496	Process not Found
2140	Process not Found
5744	Process not Found
660	Process not Found
6016	Process not Found
4676	Process not Found
5212	Process not Found
6036	Process not Found
2940	Process not Found
6148	Process not Found
2932	Process not Found
6228	Process not Found
5564	Process not Found
2528	Process not Found
5876	Process not Found
5868	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: 33	1968	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1968	AUDIODG.EXE
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe
4220	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2388	osk.exe
2388	osk.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2388	osk.exe
2388	osk.exe
2388	osk.exe
2388	osk.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2388	osk.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2388	osk.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2608	2500	chrome.exe	79
PID 2500 wrote to memory of 2608	2500	chrome.exe	79
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 4336	2500	chrome.exe	81
PID 2500 wrote to memory of 1532	2500	chrome.exe	82
PID 2500 wrote to memory of 1532	2500	chrome.exe	82
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83
PID 2500 wrote to memory of 2196	2500	chrome.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa331eab58,0x7ffa331eab68,0x7ffa331eab78
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1808 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4128 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4276 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4788 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3156 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4388 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4180 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4184 --field-trial-handle=1848,i,17447006123088001425,2793181508949852049,131072 /prefetch:8
  2⤵
  PID:3216
- C:\Users\Admin\Downloads\ChromeSetup.exe
  "C:\Users\Admin\Downloads\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3364
- - C:\Windows\SystemTemp\Google3364_101391265\bin\updater.exe
    "C:\Windows\SystemTemp\Google3364_101391265\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={C871630E-4BFA-A11C-6085-B1B6E68929AA}&lang=en-GB&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3648
  - - C:\Windows\SystemTemp\Google3364_101391265\bin\updater.exe
      C:\Windows\SystemTemp\Google3364_101391265\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x290,0x2bc,0x294,0x2c0,0xa5965c,0xa59668,0xa59674
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3544

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2408

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:4848

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2004
- C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x12d965c,0x12d9668,0x12d9674
  2⤵
  - Executes dropped EXE
  PID:1308

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3604
- C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x12d965c,0x12d9668,0x12d9674
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4732
- C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\125.0.6422.61_chrome_installer.exe
  "C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\125.0.6422.61_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\9c7c48ae-cc02-41fc-bcef-86ca15cccaf1.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3472
- - C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe
    "C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe" --install-archive="C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\9c7c48ae-cc02-41fc-bcef-86ca15cccaf1.tmp"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:940
  - - C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe
      C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.61 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff691a51698,0x7ff691a516a4,0x7ff691a516b0
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:2300
  - - C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe
      "C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:2480
    - - C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe
        
        C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3604_2095482831\CR_9E8B9.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.61 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff691a51698,0x7ff691a516a4,0x7ff691a516b0
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4528
- C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe" --rename-chrome-exe --system-level --verbose-logging --channel=stable
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3216
- - C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.61 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff78a9e1698,0x7ff78a9e16a4,0x7ff78a9e16b0
    3⤵
    - Executes dropped EXE
    PID:3184
- - C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe" --channel=stable --delete-old-versions --system-level --verbose-logging
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3144
  - - C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe
      "C:\Program Files\Google\Chrome\Application\125.0.6422.61\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.61 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff78a9e1698,0x7ff78a9e16a4,0x7ff78a9e16b0
      4⤵
      Executes dropped EXE
      PID:3884

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
PID:344

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:3676

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:4548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa331eab58,0x7ffa331eab68,0x7ffa331eab78
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1928,i,1058014504324011814,672319641247360839,131072 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1856 --field-trial-handle=1928,i,1058014504324011814,672319641247360839,131072 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --flag-switches-begin --flag-switches-end
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Checks system information in the registry
  - Drops file in Windows directory
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.61 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fe80c70,0x7ffa1fe80c7c,0x7ffa1fe80c88
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1788,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=2000 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2240,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=2396 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2988,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2996,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=4472 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4756,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4864,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=4872 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4824,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --field-trial-handle=5124,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --field-trial-handle=212,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --field-trial-handle=5276,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5328,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3172,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=744,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=5548,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=5540,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=1064,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5704,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3184,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5744,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5748,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5956,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5972 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6120,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6004,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6080,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6084,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4504,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:4616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6356,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6360 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6176,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5712 /prefetch:8
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    PID:2448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6372,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6188 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:2412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6180,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:5104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6152,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6416,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6280,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5580 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:1388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6464,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6256,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6576 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=4728,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=4724 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:3968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=4640,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=6596 /prefetch:1
    3⤵
    - Executes dropped EXE
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4284,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:2296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4616,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6040,i,4128827686092130902,9863991258517453332,262144 --variations-seed-version=20240507-180133.206000 --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_native_messaging_host.exe" chrome-extension://inomeogfingihgjfjlpeplalcfajhgai/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.a40bdff7a8e1f8de > \\.\pipe\chrome.nativeMessaging.out.a40bdff7a8e1f8de
    3⤵
    PID:5440
  - - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_native_messaging_host.exe
      "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_native_messaging_host.exe" chrome-extension://inomeogfingihgjfjlpeplalcfajhgai/ --parent-window=0
      4⤵
      Executes dropped EXE
      PID:5492

C:\Program Files\Google\Chrome\Application\125.0.6422.61\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\125.0.6422.61\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1512

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\chromeremotedesktophost.msi"
1⤵
- Enumerates connected drives
PID:4408

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2272
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8DCD837AB16F7A7492F4263132F494B2 C
  2⤵
  PID:592
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1200212260C152312E567DAA858CD079
  2⤵
  PID:3532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7DDD7CCDE6121F1E8FE18DA8FB7320F E Global\MSI0000
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass New-Item -ItemType SymbolicLink -Path 'C:\Program Files (x86)\Google\Chrome Remote Desktop\CurrentVersion' -Target 'C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:908

C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
"C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=daemon --host-config="C:\ProgramData\Google\Chrome Remote Desktop\host.json"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6108
- C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
  "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=host --mojo-pipe-token=15914876406453655128 --mojo-platform-channel-handle=916
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:5216
- - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
    "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=evaluate_capability --evaluate-type=d3d-support
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 2440
    3⤵
    - Program crash
    PID:3268
- C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
  "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=desktop --elevate="C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe" --mojo-pipe-token=12521226501287275233 --mojo-named-platform-channel-pipe=6108.6128.4521639503259743965
  2⤵
  - Modifies data under HKEY_USERS
  PID:5240
- - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe
    "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe" --mojo-named-platform-channel-pipe=6108.6128.4521639503259743965 --mojo-pipe-token=12521226501287275233 --type=desktop
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3428
  - - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe
      "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe" --type=evaluate_capability --evaluate-type=d3d-support
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
      "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=url_forwarder_configurator
      4⤵
      PID:3760
- C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
  "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=desktop --elevate="C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe" --mojo-pipe-token=2440240560548593378 --mojo-named-platform-channel-pipe=6108.6128.14011261546043704663
  2⤵
  - Modifies data under HKEY_USERS
  PID:1876
- - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe
    "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe" --mojo-named-platform-channel-pipe=6108.6128.14011261546043704663 --mojo-pipe-token=2440240560548593378 --type=desktop
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4892
  - - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe
      "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_desktop.exe" --type=evaluate_capability --evaluate-type=d3d-support
      4⤵
      PID:6952
  - - C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
      "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=url_forwarder_configurator
      4⤵
      PID:4664
- C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
  "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=host --mojo-pipe-token=9730971306493713523 --mojo-platform-channel-handle=1432
  2⤵
  - Modifies data under HKEY_USERS
  PID:5464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 756
    3⤵
    - Program crash
    PID:5044
- C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
  "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=host --mojo-pipe-token=14263206600822704827 --mojo-platform-channel-handle=1464
  2⤵
  - Modifies data under HKEY_USERS
  PID:7108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 828
    3⤵
    - Program crash
    PID:6780
- C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
  "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=host --mojo-pipe-token=1151656633160275343 --mojo-platform-channel-handle=1456
  2⤵
  - Modifies data under HKEY_USERS
  PID:6708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 756
    3⤵
    - Program crash
    PID:3796
- C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe
  "C:\Program Files (x86)\Google\Chrome Remote Desktop\125.0.6422.31\remoting_host.exe" --type=host --mojo-pipe-token=7000705288004476752 --mojo-platform-channel-handle=1472
  2⤵
  - Modifies data under HKEY_USERS
  PID:1576

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:5296

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --wake --system
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5668
- C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x12d965c,0x12d9668,0x12d9674
  2⤵
  - Drops file in Program Files directory
  PID:5692

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5720
- C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x12d965c,0x12d9668,0x12d9674
  2⤵
  - Drops file in Program Files directory
  PID:5732

C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5792
- C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\126.0.6462.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x12d965c,0x12d9668,0x12d9674
  2⤵
  - Drops file in Program Files directory
  PID:5796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3508

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:6044

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:6100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3808

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
PID:4420

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:6192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
PID:6416
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6600
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6068

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
PID:4916
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6808

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3930055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
PID:4720

C:\Windows\system32\atbroker.exe
atbroker.exe
1⤵
- Modifies data under HKEY_USERS
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5216 -ip 5216
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5464 -ip 5464
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7108 -ip 7108
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6708 -ip 6708
1⤵
PID:5660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery