Advanced Threat Protection research

I am seeing the same behavior; however, this is on Sophos Intercept X (not the firewall). I had a hit on one endpoint (C2/Generic-A) and it said the beacon was clickmatters.biz. The process looks to be a legitimate Chrome update (signed by Google). Slightly puzzled.

Might want to google for malware about that domain.  For example
https://www.rapid7.com/blog/post/2021/10/28/sneaking-through-windows-infostealer-malware-masquerades-as-windows-application/

Might want to google for malware about that domain.  For example
https://www.rapid7.com/blog/post/2021/10/28/sneaking-through-windows-infostealer-malware-masquerades-as-windows-application/