6476f7687d4aee100d659f19a57a0a23af4e5c88df87f24fde105cd5d8b21e02

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.142\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe

Checks computer location settings 2 TTPs 22 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 64 IoCs

pid	Process
4552	ChromeSetup.exe
2792	updater.exe
4912	updater.exe
1888	updater.exe
2640	updater.exe
3928	updater.exe
4372	updater.exe
444	125.0.6422.142_chrome_installer.exe
4808	setup.exe
4592	setup.exe
4212	setup.exe
832	setup.exe
3536	setup.exe
4500	setup.exe
3904	setup.exe
3820	setup.exe
4652	chrome.exe
3156	chrome.exe
3284	chrome.exe
1616	chrome.exe
4752	chrome.exe
5032	chrome.exe
4272	chrome.exe
2628	elevation_service.exe
2768	chrome.exe
4604	chrome.exe
1392	chrome.exe
3996	chrome.exe
5036	chrome.exe
4604	chrome.exe
988	chrome.exe
4528	chrome.exe
2324	chrome.exe
4112	chrome.exe
3716	chrome.exe
2124	chrome.exe
3452	chrome.exe
4300	chrome.exe
3804	chrome.exe
5092	chrome.exe
3668	chrome.exe
5032	chrome.exe
4144	chrome.exe
2224	chrome.exe
4976	chrome.exe
2264	chrome.exe
1572	chrome.exe
2828	chrome.exe
2688	chrome.exe
2376	chrome.exe
4012	chrome.exe
3868	chrome.exe
4172	chrome.exe
2568	chrome.exe
3260	chrome.exe
264	chrome.exe
1036	chrome.exe
3548	chrome.exe
3256	chrome.exe
2944	updater.exe
1028	updater.exe
4036	updater.exe
3624	updater.exe
4252	updater.exe

Loads dropped DLL 64 IoCs

pid	Process
4652	chrome.exe
3156	chrome.exe
4652	chrome.exe
3284	chrome.exe
3284	chrome.exe
4752	chrome.exe
1616	chrome.exe
4752	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
5032	chrome.exe
4272	chrome.exe
5032	chrome.exe
4272	chrome.exe
1616	chrome.exe
1616	chrome.exe
1616	chrome.exe
2768	chrome.exe
2768	chrome.exe
4604	chrome.exe
4604	chrome.exe
1392	chrome.exe
1392	chrome.exe
3996	chrome.exe
3996	chrome.exe
5036	chrome.exe
5036	chrome.exe
4604	chrome.exe
4604	chrome.exe
988	chrome.exe
4528	chrome.exe
4528	chrome.exe
988	chrome.exe
2324	chrome.exe
2324	chrome.exe
4112	chrome.exe
4112	chrome.exe
3716	chrome.exe
3716	chrome.exe
2124	chrome.exe
2124	chrome.exe
3452	chrome.exe
3452	chrome.exe
4300	chrome.exe
4300	chrome.exe
3804	chrome.exe
3804	chrome.exe
5092	chrome.exe
5092	chrome.exe
3668	chrome.exe
5032	chrome.exe
3668	chrome.exe
5032	chrome.exe
4144	chrome.exe
4144	chrome.exe
2224	chrome.exe
2224	chrome.exe
4976	chrome.exe
4976	chrome.exe
2264	chrome.exe
2264	chrome.exe
1572	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.142\\notification_helper.exe\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32\ServerExecutable = "C:\\Program Files\\Google\\Chrome\\Application\\125.0.6422.142\\notification_helper.exe"	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\VisualElements\SmallLogoDev.png	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\es\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\ta.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\sk.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\sv\messages.json	chrome.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\elevation_service.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\de\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google4552_250053795\updater.7z	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\af.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\hi\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\ro\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\gl\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\offscreendocument_main.js	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_metadata\verified_contents.json	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5ed177.TMP	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\fi.pak	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\75ecc974-01b3-47f0-8134-e5e8cfb719da.tmp	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\nb.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\ur.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\VisualElements\SmallLogoCanary.png	setup.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\213719bf-e48e-4564-870f-5f21ee3ed5a7.tmp	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_700235118\_metadata\verified_contents.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\prefs.json	updater.exe
File created	C:\Program Files (x86)\chrome_url_fetcher_3928_599762250\-8a69d345-d564-463c-aff1-a69d9e530f96-_125.0.6422.142_all_acutrvkmuh4txcarzlf55gttysyq.crx3	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\lt.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\ru\messages.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\af\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\35b46e81-3c2f-401d-971a-7345cf6f666b.tmp	updater.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RFe5f7c2e.TMP	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files (x86)\Google4552_36719062\UPDATER.PACKED.7Z	ChromeSetup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\ja.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\mn\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\sl\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\37671739-0a7c-4a74-97a9-cdff54863504.tmp	updater.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\manifest.json	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\fil.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_346874648\manifest.json	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\ta\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\notification_helper.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\zh_TW\messages.json	chrome.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\66bac503-4f6a-4baf-9ba3-8bbfb923a628.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log.old	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\am\messages.json	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\updater.log	updater.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\hu.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\chrome.dll.sig	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\id.pak	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\128.png	chrome.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad\settings.dat	updater.exe
File created	C:\Program Files\Crashpad\settings.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\Locales\ar.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4808_1693924605\Chrome-bin\125.0.6422.142\dxcompiler.dll	setup.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4652_322642084\_locales\en_GB\messages.json	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	msinfo32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133622625005630177"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	setup.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6"	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib\ = "{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ = "IPolicyStatus2System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\1.0\ = "GoogleUpdater TypeLib for IGoogleUpdate3WebSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ = "IPolicyStatus"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib\ = "{05A30352-EB25-45B6-8449-BCA7B0542CE5}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7AA668AD-44C9-562C-B3B0-104376A71AFE}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\ = "{85AE4AE3-8530-516B-8BE4-A456BF2637D3}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF978A78-4301-5160-9D81-9DA6EED2B58F}\ = "IUpdaterInternalSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ = "IUpdaterSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\1.0\0	updater.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\127.0.6490.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ = "ICurrentState"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib\ = "{4DC034A8-4BFC-4D43-9250-914163356BB0}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib\ = "{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GoogleUpdate.Update3WebMachine\CLSID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib\ = "{1588C1A8-27D9-563E-9641-8D20767FB258}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27634814-8E41-4C35-8577-980134A96544}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib	updater.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
2792	updater.exe
2792	updater.exe
2792	updater.exe
2792	updater.exe
2792	updater.exe
2792	updater.exe
1888	updater.exe
1888	updater.exe
1888	updater.exe
1888	updater.exe
1888	updater.exe
1888	updater.exe
3928	updater.exe
3928	updater.exe
3928	updater.exe
3928	updater.exe
3928	updater.exe
3928	updater.exe
3928	updater.exe
3928	updater.exe
4652	chrome.exe
4652	chrome.exe
264	chrome.exe
264	chrome.exe
2944	updater.exe
2944	updater.exe
2944	updater.exe
2944	updater.exe
2944	updater.exe
2944	updater.exe
4036	updater.exe
4036	updater.exe
4036	updater.exe
4036	updater.exe
4252	updater.exe
4252	updater.exe
4252	updater.exe
4252	updater.exe
4780	updater.exe
4780	updater.exe
4780	updater.exe
4780	updater.exe
4780	updater.exe
4780	updater.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	msinfo32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe
Token: SeShutdownPrivilege	3940	chrome.exe
Token: SeCreatePagefilePrivilege	3940	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
3940	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4176	3940	chrome.exe	98
PID 3940 wrote to memory of 4176	3940	chrome.exe	98
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 3144	3940	chrome.exe	99
PID 3940 wrote to memory of 4000	3940	chrome.exe	100
PID 3940 wrote to memory of 4000	3940	chrome.exe	100
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101
PID 3940 wrote to memory of 2188	3940	chrome.exe	101

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Authenticator-7.0.0.zip
1⤵
PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd8380ab58,0x7ffd8380ab68,0x7ffd8380ab78
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2296 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4424 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4592 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4728 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4948 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1684
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff6bddcae48,0x7ff6bddcae58,0x7ff6bddcae68
    3⤵
    PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4912 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4792 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4452 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2480 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3396 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4708 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4340 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5028 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5452 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5376 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:1496
- C:\Users\Admin\Downloads\ChromeSetup.exe
  "C:\Users\Admin\Downloads\ChromeSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4552
- - C:\Program Files (x86)\Google4552_250053795\bin\updater.exe
    "C:\Program Files (x86)\Google4552_250053795\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={00F5DC2A-BF60-C8F5-7D81-D0D4DE0BA649}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&brand=JSBI&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2792
  - - C:\Program Files (x86)\Google4552_250053795\bin\updater.exe
      "C:\Program Files (x86)\Google4552_250053795\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0x133758c,0x1337598,0x13375a4
      4⤵
      Executes dropped EXE
      PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5492 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5580 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5920 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=600 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3360 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4256 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6100 --field-trial-handle=1960,i,16309125070787436675,5405688447755610191,131072 /prefetch:8
  2⤵
  PID:4068

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2580

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:2820

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1888
- C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0xa5758c,0xa57598,0xa575a4
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2640

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3928
- C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0xa5758c,0xa57598,0xa575a4
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\125.0.6422.142_chrome_installer.exe
  "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\125.0.6422.142_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\599964ec-0c06-4346-b58b-f36eff2f2ef7.tmp"
  2⤵
  - Executes dropped EXE
  PID:444
- - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe
    "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\599964ec-0c06-4346-b58b-f36eff2f2ef7.tmp"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    PID:4808
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.142 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7c3752698,0x7ff7c37526a4,0x7ff7c37526b0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4592
  - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe
      "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4212
    - - C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe
        
        "C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3928_1057932714\CR_15289.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.142 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7c3752698,0x7ff7c37526a4,0x7ff7c37526b0
        5⤵
        Executes dropped EXE
        
        PID:832
- C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe" --rename-chrome-exe --system-level --verbose-logging --channel=stable
  2⤵
  - Executes dropped EXE
  PID:3536
- - C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.142 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff731a72698,0x7ff731a726a4,0x7ff731a726b0
    3⤵
    - Executes dropped EXE
    PID:4500
- - C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe" --channel=stable --delete-old-versions --system-level --verbose-logging
    3⤵
    - Executes dropped EXE
    PID:3904
  - - C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe
      "C:\Program Files\Google\Chrome\Application\125.0.6422.142\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.142 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff731a72698,0x7ff731a726a4,0x7ff731a726b0
      4⤵
      Executes dropped EXE
      PID:3820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=125.0.6422.142 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd92891c70,0x7ffd92891c7c,0x7ffd92891c88
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1968,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2076,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4596,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4820,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3808,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3812 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5092,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --field-trial-handle=4548,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3256,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3248,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3456,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4672,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5020,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5240,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=4716,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3444,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4696,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4624,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3396,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5156,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4704 /prefetch:2
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3400,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4800,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5168,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=3288,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=3432,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5008 /prefetch:2
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3800,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=3440,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5944,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6052,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5972,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=3968,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6304,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6384,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6472,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4660,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=3312,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=3388,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4680 /prefetch:2
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=5836,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=6632,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6660,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3236,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=4740,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=4648 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=3972,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6640,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=6888,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=5708 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=6940,i,11523822329531549358,16474260352644029500,262144 --variations-seed-version=20240607-050152.457000 --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5124

C:\Program Files\Google\Chrome\Application\125.0.6422.142\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\125.0.6422.142\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2820

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2944
- C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0xa5758c,0xa57598,0xa575a4
  2⤵
  - Executes dropped EXE
  PID:1028

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --wake --system
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4036
- C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xa5758c,0xa57598,0xa575a4
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3624

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4252
- C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xa5758c,0xa57598,0xa575a4
  2⤵
  - Drops file in Program Files directory
  PID:3484

C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4780
- C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\127.0.6490.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=127.0.6490.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xa5758c,0xa57598,0xa575a4
  2⤵
  PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery