Overview

overview

10

Static

static

5

13160edab7...b4.pdf

windows10-2004_x64

10

Resubmissions

20-03-2022 09:45

220320-lref4sbghm 10

20-03-2022 08:52

220320-ks5t1sbca7 10

20-03-2022 07:17

220320-h4fyxsaee6 10

20-03-2022 06:45

220320-hjkrdaabg5 10

Analysis

  • max time kernel
    1515s
  • max time network
    1525s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    20-03-2022 08:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf

  • Size

    2.6MB

  • MD5

    7f6060451f81564336bd5d9e5c95797a

  • SHA1

    70c756af084d013e703d5e1c0f561eea6cb2f781

  • SHA256

    13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4

  • SHA512

    c5263836ef7264e48e4166042827340244fe430b490ad41acde7fef378757731e7d3fecfe05c5d75695d32dcba7a13db86bea36366c5f4fb1e0ea3e321032abf

Score
10/10
ryukevasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\sample.txt

Family

ryuk

Ransom Note
%PDF-1.4\\n%%%c%c\\n\" ascii wide \n $s8 = \"%Y-%m-%dT%H:%M:%S+0000\" ascii wide \n $s9 = \"rctrl_renwnd32\" ascii wide \n $s10 = \"NetUIHWND\" ascii wide \n $s11 = \"homePostalAddress\" ascii wide \n $s12 = \"/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=\" ascii wide \n $s13 = \"Re:|FWD:|AW:|FYI:|NT|QUE:\" ascii wide \n $s14 = \"IPM.Note\" ascii wide \n $s15 = \"MAPILogonEx\" ascii wide \n $s16 = \"pipe\\\\The Bat! %d CmdLine\" ascii wide \n $s17 = \"PowerShellRunner.dll\" ascii wide \n $s18 = \"cmd container\" ascii wide \n $s19 = \"mapid.tlb\" ascii wide nocase \n $s20 = \"Content-Type: F)*+\" ascii wide fullword \n condition: \n 5 of them \n }","comment":"","description":"","mitre_techniques":[],"campaigns":[{"id":"d9ba4fe0-ae46-11ea-9477-02d538d9640e","name":"Operation Outlook Backdoor","description":"The campaign was discovered in 2018 and does not use command and control servers to interact with the remote access Trojan installed on the victim but instead uses malicious PDF documents which are transmitted via email. The threat actors have used the backdoor since at least 2013 to stay under the radar in an attempt to steal sensitive information. The attacks are able to go unnoticed by interacting with Microsoft Outlook using the Messaging Application Programming Interface (MAPI).","threat_level_id":2,"kb_article_link":null,"coverage":{"dat_version":{"min":3629}},"updated_on":"2021-05-07T09:35:07.000Z","external_analysis":{"links":["https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"]},"is_coat":1,"created_on":"2020-06-14T13:56:31.000Z"}]},{"id":"553f5c1e-a363-4b45-8eac-425444a78b00","type":"vulnerability","category":"External analysis","value":"CVE-2019-1003029","comment":"A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier","description":"","mitre_techniques":[],"campaigns":[{"id":"6f03a212-a5c5-4146-ac93-b57af6ebcf57","name":"Multiple Vulnerabilities And Tactics Used To Spread Capoae Malware","description":"The Capoae malicious software exploited multiple vulnerabilities and used weak credentials to attack Oracle WebLogic, ThinkPHP, WordPress, and Jenkins servers. Web shells, port scanners, and XMRig mining software were dropped onto the infected systems to mine for digital currency and find additional devices to infect. The malware maintained persistence by adding an entry to crontab and adding a public key into the SSH authorized_keys file. \r\n\r\nMcAfee’s ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by Akamai Technologies and shared publicly https://www.akamai.com/blog/security/capoae-malware-ramps-up-uses-multiple-vulnerabilities-and-tactics-to-spread","threat_level_id":3,"kb_article_link":null,"coverage":null,"updated_on":"2021-09-22T21:08:45.000Z","external_analysis":{"links":["https://www.akamai.com/blog/security/capoae-malware-ramps-up-uses-multiple-vulnerabilities-and-tactics-to-spread"]},"is_coat":0,"created_on":"2021-09-22T21:08:45.000Z"}]},{"id":"55424f67-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts dropped","value":"rule turla_outlook_gen { \n meta: \n author = \"ESET Research\" \n date = \"22-08-2018\" \n description = \"Turla Outlook malware\" \n reference = \"https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf\" \n source = \"https://github.com/eset/malware-ioc/\" \n contact = \"[email protected]\" \n license = \"BSD 2-Clause\" \n strings: \n $s1 = \"Outlook\" ascii wide \n $s2 = \"Outlook Express\" ascii wide \n $s3 = \"Outlook watchdog\" ascii wide \n $s4 = \"Software\\\\RIT\\\\The Bat!\" ascii wide \n $s5 = \"Mail Event Window\" ascii wide \n $s6 = \"Software\\\\Mozilla\\\\Mozilla Thunderbird\\\\Profiles\" ascii wide \n $s7 = \"%%PDF-1.4\\n%%%c%c\\n\" ascii wide \n $s8 = \"%Y-%m-%dT%H:%M:%S+0000\" ascii wide \n $s9 = \"rctrl_renwnd32\" ascii wide \n $s10 = \"NetUIHWND\" ascii wide \n $s11 = \"homePostalAddress\" ascii wide \n $s12 = \"/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=\" ascii wide \n $s13 = \"Re:|FWD:|AW:|FYI:|NT|QUE:\" ascii wide \n $s14 = \"IPM.Note\" ascii wide \n $s15 = \"MAPILogonEx\" ascii wide \n $s16 = \"pipe\\\\The Bat! %d CmdLine\" ascii wide \n $s17 = \"PowerShellRunner.dll\" ascii wide \n $s18 = \"cmd container\" ascii wide \n $s19 = \"mapid.tlb\" ascii wide nocase \n $s20 = \"Content-Type: F)*+\" ascii wide fullword \n condition: \n 5 of them \n }","comment":"","description":"","mitre_techniques":[],"campaigns":[{"id":"d9ba4fe0-ae46-11ea-9477-02d538d9640e","name":"Operation Outlook Backdoor","description":"The campaign was discovered in 2018 and does not use command and control servers to interact with the remote access Trojan installed on the victim but instead uses malicious PDF documents which are transmitted via email. The threat actors have used the backdoor since at least 2013 to stay under the radar in an attempt to steal sensitive information. The attacks are able to go unnoticed by interacting with Microsoft Outlook using the Messaging Application Programming Interface (MAPI).","threat_level_id":2,"kb_article_link":null,"coverage":{"dat_version":{"min":3629}},"updated_on":"2021-05-07T09:35:07.000Z","external_analysis":{"links":["https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"]},"is_coat":1,"created_on":"2020-06-14T13:56:31.000Z"}]},{"id":"55459d45-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts dropped","value":"rule turla_outlook_gen { \n meta: \n author = \"ESET Research\" \n date = \"22-08-2018\" \n description = \"Turla Outlook malware\" \n reference = \"https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf\" \n source = \"https://github.com/eset/malware-ioc/\" \n contact = \"[email protected]\" \n license = \"BSD 2-Clause\" \n strings: \n $s1 = \"Outlook\" ascii wide \n $s2 = \"Outlook Express\" ascii wide \n $s3 = \"Outlook watchdog\" ascii wide \n $s4 = \"Software\\\\RIT\\\\The Bat!\" ascii wide \n $s5 = \"Mail Event Window\" ascii wide \n $s6 = \"Software\\\\Mozilla\\\\Mozilla Thunderbird\\\\Profiles\" ascii wide \n $s7 = \"%%PDF-1.4\\n%%%c%c\\n\" ascii wide \n $s8 = \"%Y-%m-%dT%H:%M:%S+0000\" ascii wide \n $s9 = \"rctrl_renwnd32\" ascii wide \n $s10 = \"NetUIHWND\" ascii wide \n $s11 = \"homePostalAddress\" ascii wide \n $s12 = \"/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=\" ascii wide \n $s13 = \"Re:|FWD:|AW:|FYI:|NT|QUE:\" ascii wide \n $s14 = \"IPM.Note\" ascii wide \n $s15 = \"MAPILogonEx\" ascii wide \n $s16 = \"pipe\\\\The Bat! %d CmdLine\" ascii wide \n $s17 = \"PowerShellRunner.dll\" ascii wide \n $s18 = \"cmd container\" ascii wide \n $s19 = \"mapid.tlb\" ascii wide nocase \n $s20 = \"Content-Type: F)*+\" ascii wide fullword \n condition: \n 5 of them \n }","comment":"","description":"","mitre_techniques":[],"campaigns":[{"id":"d9ba4fe0-ae46-11ea-9477-02d538d9640e","name":"Operation Outlook Backdoor","description":"The campaign was discovered in 2018 and does not use command and control servers to interact with the remote access Trojan installed on the victim but instead uses malicious PDF documents which are transmitted via email. The threat actors have used the backdoor since at least 2013 to stay under the radar in an attempt to steal sensitive information. The attacks are able to go unnoticed by interacting with Microsoft Outlook using the Messaging Application Programming Interface (MAPI).","threat_level_id":2,"kb_article_link":null,"coverage":{"dat_version":{"min":3629}},"updated_on":"2021-05-07T09:35:07.000Z","external_analysis":{"links":["https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"]},"is_coat":1,"created_on":"2020-06-14T13:56:31.000Z"}]},{"id":"5548bf24-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts dropped","value":"rule turla_outlook_gen { \n meta: \n author = \"ESET Research\" \n date = \"22-08-2018\" \n description = \"Turla Outlook malware\" \n reference = \"https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf\" \n source = \"https://github.com/eset/malware-ioc/\" \n contact = \"[email protected]\" \n license = \"BSD 2-Clause\" \n strings: \n $s1 = \"Outlook\" ascii wide \n $s2 = \"Outlook Express\" ascii wide \n $s3 = \"Outlook watchdog\" ascii wide \n $s4 = \"Software\\\\RIT\\\\The Bat!\" ascii wide \n $s5 = \"Mail Event Window\" ascii wide \n $s6 = \"Software\\\\Mozilla\\\\Mozilla Thunderbird\\\\Profiles\" ascii wide \n $s7 = \"%%PDF-1.4\\n%%%c%c\\n\" ascii wide \n $s8 = \"%Y-%m-%dT%H:%M:%S+0000\" ascii wide \n $s9 = \"rctrl_renwnd32\" ascii wide \n $s10 = \"NetUIHWND\" ascii wide \n $s11 = \"homePostalAddress\" ascii wide \n $s12 = \"/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=\" ascii wide \n $s13 = \"Re:|FWD:|AW:|FYI:|NT|QUE:\" ascii wide \n $s14 = \"IPM.Note\" ascii wide \n $s15 = \"MAPILogonEx\" ascii wide \n $s16 = \"pipe\\\\The Bat! %d CmdLine\" ascii wide \n $s17 = \"PowerShellRunner.dll\" ascii wide \n $s18 = \"cmd container\" ascii wide \n $s19 = \"mapid.tlb\" ascii wide nocase \n $s20 = \"Content-Type: F)*+\" ascii wide fullword \n condition: \n 5 of them \n }","comment":"","description":"","mitre_techniques":[],"campaigns":[{"id":"d9ba4fe0-ae46-11ea-9477-02d538d9640e","name":"Operation Outlook Backdoor","description":"The campaign was discovered in 2018 and does not use command and control servers to interact with the remote access Trojan installed on the victim but instead uses malicious PDF documents which are transmitted via email. The threat actors have used the backdoor since at least 2013 to stay under the radar in an attempt to steal sensitive information. The attacks are able to go unnoticed by interacting with Microsoft Outlook using the Messaging Application Programming Interface (MAPI).","threat_level_id":2,"kb_article_link":null,"coverage":{"dat_version":{"min":3629}},"updated_on":"2021-05-07T09:35:07.000Z","external_analysis":{"links":["https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"]},"is_coat":1,"created_on":"2020-06-14T13:56:31.000Z"}]},{"id":"554c1128-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts dropped","value":"rule turla_outlook_gen { \n meta: \n author = \"ESET Research\" \n date = \"22-08-2018\" \n description = \"Turla Outlook malware\" \n reference = \"https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf\" \n source = \"https://github.com/eset/malware-ioc/\" \n contact = \"[email protected]\" \n license = \"BSD 2-Clause\" \n strings: \n $s1 = \"Outlook\" ascii wide \n $s2 = \"Outlook Express\" ascii wide \n $s3 = \"Outlook watchdog\" ascii wide \n $s4 = \"Software\\\\RIT\\\\The Bat!\" ascii wide \n $s5 = \"Mail Event Window\" ascii wide \n $s6 = \"Software\\\\Mozilla\\\\Mozilla Thunderbird\\\\Profiles\" ascii wide \n $s7 = \"%%PDF-1.4\\n%%%c%c\\n\" ascii wide \n $s8 = \"%Y-%m-%dT%H:%M:%S+0000\" ascii wide \n $s9 = \"rctrl_renwnd32\" ascii wide \n $s10 = \"NetUIHWND\" ascii wide \n $s11 = \"homePostalAddress\" ascii wide \n $s12 = \"/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=\" ascii wide \n $s13 = \"Re:|FWD:|AW:|FYI:|NT|QUE:\" ascii wide \n $s14 = \"IPM.Note\" ascii wide \n $s15 = \"MAPILogonEx\" ascii wide \n $s16 = \"pipe\\\\The Bat! %d CmdLine\" ascii wide \n $s17 = \"PowerShellRunner.dll\" ascii wide \n $s18 = \"cmd container\" ascii wide \n $s19 = \"mapid.tlb\" ascii wide nocase \n $s20 = \"Content-Type: F)*+\" ascii wide fullword \n condition: \n 5 of them \n }","comment":"","description":"","mitre_techniques":[],"campaigns":[{"id":"d9ba4fe0-ae46-11ea-9477-02d538d9640e","name":"Operation Outlook Backdoor","description":"The campaign was discovered in 2018 and does not use command and control servers to interact with the remote access Trojan installed on the victim but instead uses malicious PDF documents which are transmitted via email. The threat actors have used the backdoor since at least 2013 to stay under the radar in an attempt to steal sensitive information. The attacks are able to go unnoticed by interacting with Microsoft Outlook using the Messaging Application Programming Interface (MAPI).","threat_level_id":2,"kb_article_link":null,"coverage":{"dat_version":{"min":3629}},"updated_on":"2021-05-07T09:35:07.000Z","external_analysis":{"links":["https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf"]},"is_coat":1,"created_on":"2020-06-14T13:56:31.000Z"}]},{"id":"554f1351-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts dropped","value":"rule turla_outlook_gen { \n meta: \n author = \"ESET Research\" \n date = \"22-08-2018\" \n description = \"Turla Outlook malware\" \n reference = \"https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf\" \n source = \"https://github.com/eset/malware-ioc/\" \n contact = \"[email protected]\" \n license = \"BSD 2-Clause\" \n strings: \n $s1 = \"Outlook\" ascii wide \n $s2 = \"Outlook Express\" ascii wide \n $s3 = \"Outlook watchdog\" ascii wide \n $s4 = \"Software\\\\RIT\\\\The Bat!\" ascii wide \n $s5 = \"Mail Event Window\" ascii wide \n $s6 = \"Software\\\\Mozilla\\\\Mozilla Thunderbird\\\\Profiles\" ascii wide \n $s7 = \"%%PDF-1.4\\n%%%c%c\\n\" ascii wide \n $s8 = \"%Y-%m-%dT%H:%M:%S+0000\" ascii wide \n $s9 = \"rctrl_renwnd32\" ascii wide \n $s10 = \"NetUIHWND\" ascii wide \n $s11 = \"homePostalAddress\" ascii wide \n $s12 = \"/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=\" ascii wide \n $s13 = \"Re:|FWD:|AW:|FYI:|NT|QUE:\" ascii wide \n $s14 = \"IPM.Note\" ascii wide \n $s15 = \"MAPILogonEx\" ascii wide \n $s16 = \"pipe\\\\The Bat! %d CmdLine\" ascii wide \n $s17 = \"PowerShellRunner.dll\" ascii wide \n $s18 = \"cmd container\" ascii wide \n $s19 = \"mapid.tlb\" ascii wide nocase \n $s20 = \"Content-Type: F)*+\" ascii wide fullword \n condition: \n 5 of them \n }","comment":"","description":"","mitre_techniques":[],"campaigns":[{"id":"d9ba4fe0-ae46-11ea-9477-02d538d9640e","name":"Operation Outlook Backdoor","description":"The campaign was discovered in 2018 and does not use command and control servers to
Emails

\"[email protected]\"

\"[email protected]\"\r\n
URLs

https://www.akamai.com/blog/security/capoae-malware-ramps-up-uses-multiple-vulnerabilities-and-tactics-to-spread","threat_level_id":3,"kb_article_link":null,"coverage":null,"updated_on":"2021-09-22T21:08:45.000Z","external_analysis":{"links":["https://www.akamai.com/blog/security/capoae-malware-ramps-up-uses-multiple-vulnerabilities-and-tactics-to-spread"]},"is_coat":0,"created_on":"2021-09-22T21:08:45.000Z"}]},{"id":"55424f67-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts

https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/","threat_level_id":2,"kb_article_link":null,"coverage":null,"updated_on":"2021-07-16T21:00:52.000Z","external_analysis":{"links":["https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/","https://www.cadosecurity.com/post/triage-analysis-of-serv-u-ftp-user-backdoor-deployed-by-cve-2021-35211","https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"]},"is_coat":0,"created_on":"2021-07-16T21:00:52.000Z"}]},{"id":"55521ab5-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts

https://www.trellix.com/en-gb/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html","threat_level_id":1,"kb_article_link":null,"coverage":{"dat_version":{"min":4695}},"updated_on":"2022-03-10T22:12:48.000Z","external_analysis":{"links":["https://www.trellix.com/en-gb/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html","https://www.trellix.com/en-gb/about/newsroom/stories/threat-labs/looking-over-the-nation-state-actors-shoulders.html"]},"is_coat":1,"created_on":"2022-01-25T16:59:37.000Z"}]},{"id":"55587287-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts

https://unit42.paloaltonetworks.com/bazarloader-malware/.","threat_level_id":2,"kb_article_link":"https://kc.mcafee.com/corporate/index?page=content&id=KB95149","coverage":{"dat_version":{"min":4458}},"updated_on":"2022-02-21T18:23:50.000Z","external_analysis":{"links":["https://unit42.paloaltonetworks.com/bazarloader-malware/"]},"is_coat":1,"created_on":"2021-05-21T19:46:56.000Z"}]},{"id":"555b74bd-afc2-11eb-9d72-02d538d9640e","type":"yara","category":"Artifacts

https://unit42.paloaltonetworks.com/bazarloader-malware/.","threat_level_id":2,"kb_article_link":"https://kc.mcafee.com/corporate/index?page=content&id=KB95149","coverage":{"dat_version":{"min":4458}},"updated_on":"2022-02-21T18:23:50.000Z","external_analysis":{"links":["https://unit42.paloaltonetworks.com/bazarloader-malware/"]},"is_coat":1,"created_on":"2021-05-21T19:46:56.000Z"}]},{"id":"556b77d0-82d6-48e3-bc24-e19274b7298a","type":"yara","category":"Payload

https://github.com/Neo23x0/signature-base/blob/master/LICENSE\"\r\n\t\tauthor

https://www.trendmicro.com/en_us/research/21/i/cryptominer-z0miner-uses-newly-discovered-vulnerability-cve-2021.html","threat_level_id":3,"kb_article_link":null,"coverage":null,"updated_on":"2021-09-23T21:08:39.000Z","external_analysis":{"links":["https://www.trendmicro.com/en_us/research/21/i/cryptominer-z0miner-uses-newly-discovered-vulnerability-cve-2021.html"]},"is_coat":0,"created_on":"2021-09-23T05:08:48.000Z"}]},{"id":"5572c500-4fb6-4ecf-b438-558cefa2a0f1","type":"yara","category":"Payload

https://www.microsoft.com/security/blog/2021/07/22/when-coin-miners-evolve-part-1-exposing-lemonduck-and-lemoncat-modern-mining-malware-infrastructure/","threat_level_id":2,"kb_article_link":null,"coverage":null,"updated_on":"2021-07-30T21:00:36.000Z","external_analysis":{"links":["https://www.microsoft.com/security/blog/2021/07/22/when-coin-miners-evolve-part-1-exposing-lemonduck-and-lemoncat-modern-mining-malware-infrastructure/","https://github.com/craiu/iocs/blob/main/lemonduck/hashes.txt","https://www.microsoft.com/security/blog/2021/07/29/when-coin-miners-evolve-part-2-hunting-down-lemonduck-and-lemoncat-attacks/"]},"is_coat":0,"created_on":"2021-07-28T21:00:44.000Z"}]},{"id":"5600d974-8c73-4140-895d-664d35e4d812","type":"vulnerability","category":"External

https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html","threat_level_id":3,"kb_article_link":null,"coverage":null,"updated_on":"2021-10-20T21:08:42.000Z","external_analysis":{"links":["https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html#more"]},"is_coat":0,"created_on":"2021-10-20T21:08:42.000Z"}]},{"id":"5619e328-4e9c-4ed5-a95a-d627e0def0eb","type":"command-line","category":"Other","value":"\"CSIDL_SYSTEM\\wscript.exe\"

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine","threat_level_id":2,"kb_article_link":null,"coverage":null,"updated_on":"2022-03-10T20:06:17.000Z","external_analysis":{"links":["https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"]},"is_coat":0,"created_on":"2022-02-01T06:14:49.000Z"}]},{"id":"56223e89-06ec-40a4-a152-24e10b3bbe8e","type":"command-line","category":"Other","value":"curl

http://45.9.148[.]182/bin/bot/chimera.cc

https://www.uptycs.com/blog/team-tnt-deploys-malicious-docker-image-on-docker-hub-with-pentesting-tools","threat_level_id":3,"kb_article_link":null,"coverage":null,"updated_on":"2021-10-19T21:08:39.000Z","external_analysis":{"links":["https://www.uptycs.com/blog/team-tnt-deploys-malicious-docker-image-on-docker-hub-with-pentesting-tools","https://securityaffairs.co/wordpress/123535/cyber-crime/teamtnt-docker-attack.html"]},"is_coat":0,"created_on":"2021-10-08T21:08:42.000Z"}]},{"id":"5625cca8-c8ea-4a20-8770-2cd1da012ec9","type":"yara","category":"Payload

https://www.manageengine.com/data-security/how-to/how-to-detect-ransomware-attacks.html\nlogsource:\n

https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment\n

https://blog.talosintelligence.com/2017/05/wannacry.html\n

https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/\n

https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/\n

https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100\n

https://github.com/Neo23x0/Raccine#the-process\n

https://github.com/Neo23x0/Raccine/blob/main/yara/gen_ransomware_command_lines.yar\ntags:\n

Signatures

  • Registers COM server for autorun 1 TTPs
    persistence
  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Executes dropped EXE 6 IoCs
  • Sets file execution options in registry 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 48 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 48 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf"
    1⤵
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=25261554BA6875CEC2F05930A1988DB5 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
          PID:2000
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5B449177FEA78C565D3D21CC195B455D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5B449177FEA78C565D3D21CC195B455D --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
          3⤵
            PID:4952
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=602C54D72C54B70B06EB21265AA3D9E5 --mojo-platform-channel-handle=2260 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
              PID:4004
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0F002292CAC95A092DCAF5A9E3D8E1C4 --mojo-platform-channel-handle=1884 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              3⤵
                PID:3652
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=66C6A26FD3CBA4D7C6BC635E624EC2A2 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                3⤵
                  PID:2544
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                2⤵
                  PID:2960
                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:3
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:396
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
                    3⤵
                      PID:3420
                    • C:\ProgramData\Adobe\ARM\S\30839\AdobeARMHelper.exe
                      "C:\ProgramData\Adobe\ARM\S\30839\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\30839" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Checks whether UAC is enabled
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4784
                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\30839" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
                        4⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:1660
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                  1⤵
                  • Modifies data under HKEY_USERS
                  PID:2500
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:1420
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                    1⤵
                      PID:4252
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Enumerates connected drives
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Modifies Internet Explorer settings
                      • Modifies data under HKEY_USERS
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1132
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding 0FDCED77DCC4D2E6CECBD714E2A0D9E1
                        2⤵
                        • Loads dropped DLL
                        PID:812
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding CDDC96E8DBCA4B9FB719C7527B62291B E Global\MSI0000
                        2⤵
                        • Loads dropped DLL
                        PID:4688
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding E56B4C8007BAAE3D8CD2FDECB55C8B0E
                        2⤵
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        PID:2240
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding D663CE915EA1CB6A3CF99D3735B30667 E Global\MSI0000
                        2⤵
                        • Loads dropped DLL
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1852
                      • C:\Windows\Installer\MSIA7CA.tmp
                        "C:\Windows\Installer\MSIA7CA.tmp" /b 2 120 0
                        2⤵
                        • Executes dropped EXE
                        PID:2288
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 19.010.20098 19.010.20069.0
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        PID:1900
                    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:4344
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:1088
                      • C:\Windows\system32\OpenWith.exe
                        C:\Windows\system32\OpenWith.exe -Embedding
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4976
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\13160edab74cc2dd34653920d4bf56e487fea2fd6adf8249e0be9215ced902b4.pdf
                          2⤵
                          • Opens file in notepad (likely ransom note)
                          PID:2064
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\sample.txt
                        1⤵
                        • Opens file in notepad (likely ransom note)
                        PID:548
                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:1436
                      • C:\Windows\system32\compattelrunner.exe
                        C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                        1⤵
                        • Modifies data under HKEY_USERS
                        PID:372
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                        1⤵
                        • Enumerates system info in registry
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4748
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8962a4f50,0x7ff8962a4f60,0x7ff8962a4f70
                          2⤵
                            PID:2448
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -u -p 2448 -s 1048
                              3⤵
                              • Program crash
                              PID:860
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
                            2⤵
                              PID:1448
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1976 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1296
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
                              2⤵
                                PID:5036
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
                                2⤵
                                  PID:1740
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
                                  2⤵
                                    PID:4972
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
                                    2⤵
                                      PID:1584
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4400 /prefetch:8
                                      2⤵
                                        PID:3992
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4484 /prefetch:8
                                        2⤵
                                          PID:4248
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:8
                                          2⤵
                                            PID:4688
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
                                            2⤵
                                              PID:4880
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
                                              2⤵
                                                PID:180
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5776 /prefetch:8
                                                2⤵
                                                  PID:3276
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5448 /prefetch:8
                                                  2⤵
                                                    PID:1452
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:8
                                                    2⤵
                                                      PID:3036
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
                                                      2⤵
                                                        PID:3552
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4628 /prefetch:8
                                                        2⤵
                                                          PID:1776
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4580 /prefetch:8
                                                          2⤵
                                                            PID:3324
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5440 /prefetch:8
                                                            2⤵
                                                              PID:2168
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
                                                              2⤵
                                                                PID:4732
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                                                                2⤵
                                                                  PID:3196
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                                                  2⤵
                                                                    PID:3236
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
                                                                    2⤵
                                                                      PID:1548
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1856 /prefetch:8
                                                                      2⤵
                                                                        PID:2464
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
                                                                        2⤵
                                                                          PID:4940
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
                                                                          2⤵
                                                                            PID:1352
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
                                                                            2⤵
                                                                              PID:4532
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=244 /prefetch:1
                                                                              2⤵
                                                                                PID:4208
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
                                                                                2⤵
                                                                                  PID:2724
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 /prefetch:8
                                                                                  2⤵
                                                                                    PID:5000
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
                                                                                    2⤵
                                                                                      PID:4684
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4512
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
                                                                                        2⤵
                                                                                          PID:1640
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
                                                                                          2⤵
                                                                                            PID:1328
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
                                                                                            2⤵
                                                                                              PID:936
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                                                                                              2⤵
                                                                                                PID:3696
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:4908
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5096
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2620
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:3576
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:4952
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:2164
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7908 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:2076
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4876
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:3848
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:3636
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:1184
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8396 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:4752
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8632 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:4760
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8600 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:3608
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:1228
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:4020
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:2808
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:4552
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:2500
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9192 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:1348
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:4880
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9156 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:3756
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:1996
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8872 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:5232
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8960 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:5240
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9540 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5264
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9564 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5272
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5280
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9716 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5292
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9776 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5300
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9916 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5308
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10060 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5324
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9952 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5316
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9344 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5332
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10412 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5340
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9452 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5852
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5868
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9464 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5860
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5968
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6080
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:4752
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7724 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3136
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4404
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8916 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3504
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3988
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3928
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9828 /prefetch:1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4872
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1632
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8264 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2628
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8968 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5420
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:984
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8616 /prefetch:1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9976 /prefetch:1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2728
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1856
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3772
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9944 /prefetch:1
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3036
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5508 /prefetch:2
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:8
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5488
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10248 /prefetch:1
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1580
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9420 /prefetch:1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10900 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1584
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1664
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10580 /prefetch:1
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9892 /prefetch:1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:336
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7780 /prefetch:1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1328
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1580 /prefetch:1
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1320
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9688 /prefetch:1
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:6120
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:3192
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:6108
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10612 /prefetch:1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:6056
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,4552959404320090500,10763480477842569859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=10664 /prefetch:8
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:984
                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:4208

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            • memory/2500-150-0x000001B125A50000-0x000001B125A51000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-149-0x000001B125A70000-0x000001B125A74000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-134-0x000001B122560000-0x000001B122570000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-135-0x000001B123120000-0x000001B123130000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-151-0x000001B125510000-0x000001B125514000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-152-0x000001B125500000-0x000001B125501000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-153-0x000001B125500000-0x000001B125504000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-154-0x000001B125400000-0x000001B125401000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2500-136-0x000001B1254E0000-0x000001B1254E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4208-227-0x000001CB59350000-0x000001CB59354000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4208-228-0x000001CB59690000-0x000001CB59694000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4208-233-0x000001CB59270000-0x000001CB59271000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4208-232-0x000001CB59370000-0x000001CB59374000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4208-231-0x000001CB59370000-0x000001CB59371000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4208-230-0x000001CB59380000-0x000001CB59384000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4208-229-0x000001CB59680000-0x000001CB59681000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4252-161-0x000001D431CA0000-0x000001D431CA4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4252-171-0x000001D42F9C0000-0x000001D42F9C1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4252-170-0x000001D431CC0000-0x000001D431CC4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4252-169-0x000001D431CC0000-0x000001D431CC1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4252-167-0x000001D432250000-0x000001D432251000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4252-166-0x000001D432260000-0x000001D432264000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4252-168-0x000001D431CD0000-0x000001D431CD4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                              Download