fatalrat | 7685e7dd012d5dbf2a22608b4c4b6e38882df8d2d3da1b89ff4a27d6d56061d4

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/2960-56-0x00000000018C0000-0x00000000018E9000-memory.dmp	fatalrat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\134.0.6998.166\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	gocgloe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	GoogleUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 38 IoCs

pid	Process
2960	Agghosts.exe
1424	bin.exe
4340	GoogleUpdate.exe
2332	GoogleUpdate.exe
2320	GoogleUpdate.exe
4808	GoogleUpdateComRegisterShell64.exe
1968	GoogleUpdateComRegisterShell64.exe
3252	GoogleUpdateComRegisterShell64.exe
3156	GoogleUpdate.exe
4884	GoogleUpdate.exe
3028	GoogleUpdate.exe
3764	134.0.6998.166_chrome_installer.exe
4748	setup.exe
4616	setup.exe
1612	setup.exe
2028	setup.exe
2936	GoogleCrashHandler.exe
2440	GoogleCrashHandler64.exe
1580	GoogleUpdate.exe
1968	GoogleUpdateOnDemand.exe
1304	GoogleUpdate.exe
2840	chrome.exe
536	chrome.exe
2632	chrome.exe
4580	chrome.exe
4264	chrome.exe
3680	elevation_service.exe
1148	chrome.exe
1060	chrome.exe
4028	chrome.exe
2504	chrome.exe
1084	chrome.exe
4340	chrome.exe
116	chrome.exe
5444	chrome.exe
5452	chrome.exe
5436	chrome.exe
1564	chrome.exe

Loads dropped DLL 53 IoCs

pid	Process
2960	Agghosts.exe
4340	GoogleUpdate.exe
2332	GoogleUpdate.exe
2320	GoogleUpdate.exe
4808	GoogleUpdateComRegisterShell64.exe
2320	GoogleUpdate.exe
1968	GoogleUpdateComRegisterShell64.exe
2320	GoogleUpdate.exe
3252	GoogleUpdateComRegisterShell64.exe
2320	GoogleUpdate.exe
3156	GoogleUpdate.exe
4884	GoogleUpdate.exe
3028	GoogleUpdate.exe
3028	GoogleUpdate.exe
4884	GoogleUpdate.exe
1580	GoogleUpdate.exe
1304	GoogleUpdate.exe
1304	GoogleUpdate.exe
2840	chrome.exe
536	chrome.exe
2840	chrome.exe
2632	chrome.exe
2632	chrome.exe
4580	chrome.exe
4264	chrome.exe
4580	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
4264	chrome.exe
1060	chrome.exe
1060	chrome.exe
4028	chrome.exe
4028	chrome.exe
2504	chrome.exe
2504	chrome.exe
1084	chrome.exe
4340	chrome.exe
1084	chrome.exe
4340	chrome.exe
116	chrome.exe
116	chrome.exe
5452	chrome.exe
5436	chrome.exe
5452	chrome.exe
5436	chrome.exe
5444	chrome.exe
5444	chrome.exe
1564	chrome.exe
1564	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdata_Service = "C:\\programdata\\lnk\\dick.lnk"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\optimization_guide_internal.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2840_488556057\manifest.json	chrome.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_lt.dll	bin.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\d3dcompiler_47.dll	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_th.dll	bin.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\cs.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_te.dll	GoogleUpdate.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2840_488556057\LICENSE.txt	chrome.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_lt.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_hr.dll	bin.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\GoogleUpdateSetup.exe	bin.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\134.0.6998.166\134.0.6998.166_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\bg.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\notification_helper.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_bn.dll	bin.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_is.dll	bin.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_kn.dll	bin.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_ko.dll	bin.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_id.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\pl.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_id.dll	bin.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fi.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe	134.0.6998.166_chrome_installer.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\GoogleUpdateComRegisterShell64.exe	bin.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_am.dll	bin.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_ms.dll	bin.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_pl.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_sl.dll	bin.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\elevated_tracing_service.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\chrome.VisualElementsManifest.xml	setup.exe
File created	C:\Program Files\Google\Chrome\Application\134.0.6998.166\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_bg.dll	bin.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\af.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\GoogleUpdate.exe	bin.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_cs.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_et.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\CHROME.PACKED.7Z	134.0.6998.166_chrome_installer.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\hr.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\lv.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_nl.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_fi.dll	bin.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_bg.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\ta.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source4748_724079145\Chrome-bin\134.0.6998.166\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_fa.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\134.0.6998.166_chrome_installer.exe	GoogleUpdate.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\GoogleUpdateCore.exe	bin.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_ar.dll	bin.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\goopdateres_it.dll	bin.exe
File opened for modification	C:\Program Files\chrome_installer.log	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\psuser_64.dll	bin.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.312\goopdateres_ja.dll	GoogleUpdate.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agghosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3156	GoogleUpdate.exe
1580	GoogleUpdate.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Agghosts.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Agghosts.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870681126305176"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachine.1.0\CLSID\ = "{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine.1.0\ = "Google Update Broker Class Factory"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine\CurVer	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine.1.0\CLSID\ = "{521FDB42-7130-4806-822A-FC5163FAD983}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods\ = "5"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\ = "17"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.312\\goopdate.dll,-3000"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService = "gupdatem"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\VersionIndependentProgID\ = "GoogleUpdate.Update3WebMachineFallback"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ = "GoogleUpdate Update3Web"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\ = "Google Update Core Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C4CDEFF-756A-4804-9E77-3E8EB9361016}\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoCreateAsync\CurVer\ = "GoogleUpdate.CoCreateAsync.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\ = "TypeLib for Interface {463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ = "IGoogleUpdate"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\ = "{82BB48E2-2057-4C07-A383-B2C2F8A0FD01}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.ProcessLauncher	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ProgID\ = "GoogleUpdate.OnDemandCOMClassSvc.1.0"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID\ = "GoogleUpdate.CoreClass.1"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D656199B-93F2-4D64-AA2F-96BD3F18D40E}\InprocHandler32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ = "IAppCommand2"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ = "IProcessLauncher2"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
1200	gocgloe.exe
4340	GoogleUpdate.exe
4340	GoogleUpdate.exe
4340	GoogleUpdate.exe
4340	GoogleUpdate.exe
4340	GoogleUpdate.exe
4340	GoogleUpdate.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe
2960	Agghosts.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	Agghosts.exe
Token: SeDebugPrivilege	4340	GoogleUpdate.exe
Token: SeDebugPrivilege	4340	GoogleUpdate.exe
Token: SeDebugPrivilege	4340	GoogleUpdate.exe
Token: 33	3764	134.0.6998.166_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	3764	134.0.6998.166_chrome_installer.exe
Token: 33	2440	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	2440	GoogleCrashHandler64.exe
Token: 33	2936	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	2936	GoogleCrashHandler.exe
Token: SeDebugPrivilege	4884	GoogleUpdate.exe
Token: SeDebugPrivilege	1580	GoogleUpdate.exe
Token: SeDebugPrivilege	4340	GoogleUpdate.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2912	1200	gocgloe.exe	94
PID 1200 wrote to memory of 2912	1200	gocgloe.exe	94
PID 1200 wrote to memory of 2960	1200	gocgloe.exe	96
PID 1200 wrote to memory of 2960	1200	gocgloe.exe	96
PID 1200 wrote to memory of 2960	1200	gocgloe.exe	96
PID 2912 wrote to memory of 4692	2912	cmd.exe	97
PID 2912 wrote to memory of 4692	2912	cmd.exe	97
PID 1200 wrote to memory of 864	1200	gocgloe.exe	99
PID 1200 wrote to memory of 864	1200	gocgloe.exe	99
PID 1200 wrote to memory of 1424	1200	gocgloe.exe	100
PID 1200 wrote to memory of 1424	1200	gocgloe.exe	100
PID 1200 wrote to memory of 1424	1200	gocgloe.exe	100
PID 1424 wrote to memory of 4340	1424	bin.exe	102
PID 1424 wrote to memory of 4340	1424	bin.exe	102
PID 1424 wrote to memory of 4340	1424	bin.exe	102
PID 4340 wrote to memory of 2332	4340	GoogleUpdate.exe	103
PID 4340 wrote to memory of 2332	4340	GoogleUpdate.exe	103
PID 4340 wrote to memory of 2332	4340	GoogleUpdate.exe	103
PID 4340 wrote to memory of 2320	4340	GoogleUpdate.exe	104
PID 4340 wrote to memory of 2320	4340	GoogleUpdate.exe	104
PID 4340 wrote to memory of 2320	4340	GoogleUpdate.exe	104
PID 2320 wrote to memory of 4808	2320	GoogleUpdate.exe	105
PID 2320 wrote to memory of 4808	2320	GoogleUpdate.exe	105
PID 2320 wrote to memory of 1968	2320	GoogleUpdate.exe	106
PID 2320 wrote to memory of 1968	2320	GoogleUpdate.exe	106
PID 2320 wrote to memory of 3252	2320	GoogleUpdate.exe	107
PID 2320 wrote to memory of 3252	2320	GoogleUpdate.exe	107
PID 4340 wrote to memory of 3156	4340	GoogleUpdate.exe	108
PID 4340 wrote to memory of 3156	4340	GoogleUpdate.exe	108
PID 4340 wrote to memory of 3156	4340	GoogleUpdate.exe	108
PID 4340 wrote to memory of 4884	4340	GoogleUpdate.exe	109
PID 4340 wrote to memory of 4884	4340	GoogleUpdate.exe	109
PID 4340 wrote to memory of 4884	4340	GoogleUpdate.exe	109
PID 3028 wrote to memory of 3764	3028	GoogleUpdate.exe	116
PID 3028 wrote to memory of 3764	3028	GoogleUpdate.exe	116
PID 3764 wrote to memory of 4748	3764	134.0.6998.166_chrome_installer.exe	117
PID 3764 wrote to memory of 4748	3764	134.0.6998.166_chrome_installer.exe	117
PID 4748 wrote to memory of 4616	4748	setup.exe	118
PID 4748 wrote to memory of 4616	4748	setup.exe	118
PID 4748 wrote to memory of 1612	4748	setup.exe	119
PID 4748 wrote to memory of 1612	4748	setup.exe	119
PID 1612 wrote to memory of 2028	1612	setup.exe	120
PID 1612 wrote to memory of 2028	1612	setup.exe	120
PID 3028 wrote to memory of 2936	3028	GoogleUpdate.exe	123
PID 3028 wrote to memory of 2936	3028	GoogleUpdate.exe	123
PID 3028 wrote to memory of 2936	3028	GoogleUpdate.exe	123
PID 3028 wrote to memory of 2440	3028	GoogleUpdate.exe	124
PID 3028 wrote to memory of 2440	3028	GoogleUpdate.exe	124
PID 3028 wrote to memory of 1580	3028	GoogleUpdate.exe	125
PID 3028 wrote to memory of 1580	3028	GoogleUpdate.exe	125
PID 3028 wrote to memory of 1580	3028	GoogleUpdate.exe	125
PID 1968 wrote to memory of 1304	1968	GoogleUpdateOnDemand.exe	127
PID 1968 wrote to memory of 1304	1968	GoogleUpdateOnDemand.exe	127
PID 1968 wrote to memory of 1304	1968	GoogleUpdateOnDemand.exe	127
PID 1304 wrote to memory of 2840	1304	GoogleUpdate.exe	128
PID 1304 wrote to memory of 2840	1304	GoogleUpdate.exe	128
PID 2840 wrote to memory of 536	2840	chrome.exe	129
PID 2840 wrote to memory of 536	2840	chrome.exe	129
PID 2840 wrote to memory of 2632	2840	chrome.exe	130
PID 2840 wrote to memory of 2632	2840	chrome.exe	130
PID 2840 wrote to memory of 4264	2840	chrome.exe	131
PID 2840 wrote to memory of 4264	2840	chrome.exe	131
PID 2840 wrote to memory of 4264	2840	chrome.exe	131
PID 2840 wrote to memory of 4264	2840	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\gocgloe.exe
"C:\Users\Admin\AppData\Local\Temp\gocgloe.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Downloads\20250321030034\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:4692
- C:\programdata\20250321030034\Agghosts.exe
  "C:\programdata\20250321030034\Agghosts.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v GoogleUpdata_Service /d "C:\programdata\lnk\dick.lnk" /f
  2⤵
  - Adds Run key to start application
  PID:864
- C:\Users\Public\Downloads\20250321030034\bin.exe
  "C:\Users\Public\Downloads\20250321030034\bin.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Temp\GUMB44D.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={798BD0C5-13EB-DE8C-E07C-A7A64270D046}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2332
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4808
    - - C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1968
    - - C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3252
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTc2QzQ0QjUtMzUyMC00REZFLUFENzAtMTQ2Njk4RjMyQTg4fSIgdXNlcmlkPSJ7RkUxOTcyMEYtMTc2Qy00RDYwLThDRDktOEM2RTQ4RjJCMzZGfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0VEQ0MzNkY4LTBCRjgtNDVGMC04MkQxLTE5M0VCMTRCNjYzMX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMTM0LjAuNjk4NS4wIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjMxMiIgbGFuZz0iemgtQ04iIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9Ins3OThCRDBDNS0xM0VCLURFOEMtRTA3Qy1BN0E2NDI3MEQwNDZ9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjcwMyIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3156
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={798BD0C5-13EB-DE8C-E07C-A7A64270D046}&lang=zh-CN&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{A76C44B5-3520-4DFE-AD70-146698F32A88}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4884

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\134.0.6998.166_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\134.0.6998.166_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\gui33EE.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\gui33EE.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.166 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7f4850e98,0x7ff7f4850ea4,0x7ff7f4850eb0
      4⤵
      Executes dropped EXE
      PID:4616
  - - C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{27C92446-1691-4D51-A4B5-37CF92BBA45F}\CR_61370.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.166 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7f4850e98,0x7ff7f4850ea4,0x7ff7f4850eb0
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2028
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTc2QzQ0QjUtMzUyMC00REZFLUFENzAtMTQ2Njk4RjMyQTg4fSIgdXNlcmlkPSJ7RkUxOTcyMEYtMTc2Qy00RDYwLThDRDktOEM2RTQ4RjJCMzZGfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezEyNTc4QkUxLUJFNkEtNDM4Qi04QzNELTU3NEU2NzE4RjkzRH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTM0LjAuNjk5OC4xNjYiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InpoLUNOIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7Nzk4QkQwQzUtMTNFQi1ERThDLUUwN0MtQTdBNjQyNzBEMDQ2fSIgY29ob3J0PSIxOmd1L2kxOToiIGNvaG9ydG5hbWU9IlN0YWJsZSBJbnN0YWxscyAmYW1wOyBWZXJzaW9uIFBpbnMiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYWRjcGRvZHZ4bjN5NW43M2p1dnZmdzRsbWMycV8xMzQuMC42OTk4LjE2Ni8xMzQuMC42OTk4LjE2Nl9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iMTIwMTAzNzkyIiB0b3RhbD0iMTIwMTAzNzkyIiBkb3dubG9hZF90aW1lX21zPSIyMzUwMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNTQ3IiBkb3dubG9hZF90aW1lX21zPSIyNDY3MiIgZG93bmxvYWRlZD0iMTIwMTAzNzkyIiB0b3RhbD0iMTIwMTAzNzkyIiBpbnN0YWxsX3RpbWVfbXM9IjI5NzY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1580

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=134.0.6998.166 --initial-client-data=0xf8,0xfc,0x100,0xbc,0x104,0x7ffb24373ef8,0x7ffb24373f04,0x7ffb24373f10
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2496 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:1148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3920 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4716 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5520 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3328 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3924 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5764 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2012,i,3464329194965745807,17757306751268818749,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4808 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1564

C:\Program Files\Google\Chrome\Application\134.0.6998.166\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\134.0.6998.166\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery