f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp

Executes dropped EXE 4 IoCs

pid	Process
1036	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
4976	HealerConsole.exe
1356	SystemHealer.exe

Loads dropped DLL 4 IoCs

pid	Process
1036	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
1036	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2536_575082568\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\SystemHealer\HealerConsole.exe	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File opened for modification	C:\Program Files (x86)\SystemHealer\mjlu.dll	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File created	C:\Program Files (x86)\SystemHealer\unins000.dat	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File created	C:\Program Files (x86)\SystemHealer\is-4FG6F.tmp	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File created	C:\Program Files (x86)\SystemHealer\is-EMML5.tmp	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2536_1729071781\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2536_575082568\protocols.json	msedge.exe
File opened for modification	C:\Program Files (x86)\SystemHealer\SystemHealer.exe	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File created	C:\Program Files (x86)\SystemHealer\is-VBUB1.tmp	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File created	C:\Program Files (x86)\SystemHealer\is-0MG80.tmp	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File opened for modification	C:\Program Files (x86)\SystemHealer\unins000.dat	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
File opened for modification	C:\Program Files (x86)\SystemHealer\SystemHealer.ini	SystemHealer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\System HealerPeriod.job	SystemHealer.exe
File created	C:\Windows\Tasks\System HealerStartUp.job	SystemHealer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HealerConsole.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemHealer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5060	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/848-0-0x0000000000400000-0x0000000000449000-memory.dmp	innosetup
behavioral1/memory/1856-25-0x0000000000400000-0x0000000000449000-memory.dmp	innosetup
behavioral1/memory/848-27-0x0000000000400000-0x0000000000449000-memory.dmp	innosetup
behavioral1/memory/1856-47-0x0000000000400000-0x0000000000449000-memory.dmp	innosetup
behavioral1/memory/1856-98-0x0000000000400000-0x0000000000449000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SystemHealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SystemHealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326001997158938"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7928F3E0-E487-45A9-8C0C-3685458D4F82}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
628	schtasks.exe
752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1356	SystemHealer.exe
Token: SeCreatePagefilePrivilege	1356	SystemHealer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
1356	SystemHealer.exe
4976	HealerConsole.exe
4976	HealerConsole.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1356	SystemHealer.exe
4976	HealerConsole.exe
4976	HealerConsole.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4976	HealerConsole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1036	848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe	84
PID 1036 wrote to memory of 1856	1036	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp	85
PID 1856 wrote to memory of 2848	1856	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe	86
PID 2848 wrote to memory of 628	2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp	92
PID 2848 wrote to memory of 752	2848	f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp	97
PID 4976 wrote to memory of 2536	4976	HealerConsole.exe	107
PID 2536 wrote to memory of 3768	2536	msedge.exe	108
PID 2536 wrote to memory of 5060	2536	msedge.exe	109
PID 2536 wrote to memory of 2076	2536	msedge.exe	110
PID 2536 wrote to memory of 2076	2536	msedge.exe	110
PID 2536 wrote to memory of 2076	2536	msedge.exe	110
PID 2536 wrote to memory of 100	2536	msedge.exe	111
PID 2536 wrote to memory of 100	2536	msedge.exe	111
PID 2536 wrote to memory of 3980	2536	msedge.exe	112
PID 2536 wrote to memory of 3980	2536	msedge.exe	112
PID 2536 wrote to memory of 3980	2536	msedge.exe	112
PID 2536 wrote to memory of 3808	2536	msedge.exe	113
PID 2536 wrote to memory of 3808	2536	msedge.exe	113
PID 2536 wrote to memory of 3808	2536	msedge.exe	113
PID 2536 wrote to memory of 2220	2536	msedge.exe	115
PID 2536 wrote to memory of 3656	2536	msedge.exe	116
PID 2536 wrote to memory of 2220	2536	msedge.exe	115
PID 2536 wrote to memory of 2220	2536	msedge.exe	115
PID 2536 wrote to memory of 3656	2536	msedge.exe	116
PID 2536 wrote to memory of 3656	2536	msedge.exe	116
PID 2536 wrote to memory of 3760	2536	msedge.exe	119
PID 2536 wrote to memory of 3760	2536	msedge.exe	119
PID 2536 wrote to memory of 1764	2536	msedge.exe	120
PID 2536 wrote to memory of 1764	2536	msedge.exe	120
PID 2536 wrote to memory of 3444	2536	msedge.exe	122
PID 2536 wrote to memory of 4744	2536	msedge.exe	123
PID 2536 wrote to memory of 3444	2536	msedge.exe	122
PID 2536 wrote to memory of 4744	2536	msedge.exe	123
PID 2536 wrote to memory of 3456	2536	msedge.exe	125
PID 2536 wrote to memory of 4656	2536	msedge.exe	126
PID 2536 wrote to memory of 4656	2536	msedge.exe	126
PID 2536 wrote to memory of 3624	2536	msedge.exe	127
PID 2536 wrote to memory of 3624	2536	msedge.exe	127
PID 2536 wrote to memory of 3092	2536	msedge.exe	128
PID 2536 wrote to memory of 4364	2536	msedge.exe	129
PID 2536 wrote to memory of 3092	2536	msedge.exe	128
PID 2536 wrote to memory of 4364	2536	msedge.exe	129
PID 2536 wrote to memory of 5440	2536	msedge.exe	130
PID 2536 wrote to memory of 5440	2536	msedge.exe	130
PID 4976 wrote to memory of 5136	4976	HealerConsole.exe	131
PID 2536 wrote to memory of 568	2536	msedge.exe	132
PID 2536 wrote to memory of 568	2536	msedge.exe	132
PID 2536 wrote to memory of 568	2536	msedge.exe	132
PID 2536 wrote to memory of 5316	2536	msedge.exe	133
PID 2536 wrote to memory of 5316	2536	msedge.exe	133
PID 2536 wrote to memory of 5316	2536	msedge.exe	133
PID 4976 wrote to memory of 5384	4976	HealerConsole.exe	134
PID 2536 wrote to memory of 5400	2536	msedge.exe	135
PID 2536 wrote to memory of 5400	2536	msedge.exe	135
PID 2536 wrote to memory of 5400	2536	msedge.exe	135
PID 2536 wrote to memory of 1316	2536	msedge.exe	136
PID 2536 wrote to memory of 4364	2536	msedge.exe	137
PID 2536 wrote to memory of 5480	2536	msedge.exe	138
PID 4976 wrote to memory of 5732	4976	HealerConsole.exe	139
PID 2536 wrote to memory of 5748	2536	msedge.exe	140
PID 2536 wrote to memory of 5748	2536	msedge.exe	140
PID 2536 wrote to memory of 5748	2536	msedge.exe	140
PID 2536 wrote to memory of 5848	2536	msedge.exe	141
PID 2536 wrote to memory of 5848	2536	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe
"C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\is-DCE1I.tmp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DCE1I.tmp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp" /SL5="$80048,3985321,257024,C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe
    C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe /LANG=en /SL5="$80048,3985321,257024,C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\is-F4SGS.tmp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-F4SGS.tmp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.tmp" /SL5="$90048,3985321,257024,C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe" /LANG=en /SL5="$80048,3985321,257024,C:\Users\Admin\AppData\Local\Temp\f9e2a4414c7e300bc1814fdf8424a62ba0a3df29d375ee5e7f6ae974c532432e.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\SystemHealer\HealerConsole.exe\" -Notify" /sc onlogon /TN "System Healer Monitor" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:628
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "'C:\Program Files (x86)\SystemHealer\SystemHealer.exe' --scan" /sc ONCE /st 22:54 /sd 08/30/2026 /TN "System Healer Delayed" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:752

C:\Program Files (x86)\SystemHealer\HealerConsole.exe
"C:\Program Files (x86)\SystemHealer\HealerConsole.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x35c,0x7ffe5a2dc188,0x7ffe5a2dc194,0x7ffe5a2dc1a0
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,7136996670361371670,1257488798041496008,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2421685575707865114,13778907488611814098,262144 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,15277126257192511840,5002849644569263808,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
    3⤵
    PID:100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16106820805692557784,6482893579380665135,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,6097248639429545624,6710494696886577390,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,8947123828098791634,298959098909786130,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,10731033592434686335,315454053229834818,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,4815203845489479415,15838808465696211625,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,12185617951006045036,11573447543239621942,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,7513173701123624327,14677393747407749692,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,12483370663976251731,9081728803238216988,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12863013493303032656,11642068182196337525,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,12863013493303032656,11642068182196337525,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,11474473883306475200,9825594657209165421,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2405807968613756437,12175726362043465140,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,16209877546086505502,17040361498450395289,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,7148304136918751573,2008535887770843230,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,13076404137071335884,9341036369155753169,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6532,i,5510388804275569712,3708012935790131686,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4252,i,10476260977933271475,6060670115919512512,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3488,i,4669197258135163625,12310224391792356916,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,11651543203696065727,1936964975081553811,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,14468044822898758630,16545285939041017146,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,2394560316328481194,13406089852849037709,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6560,i,13511920327321038075,7028067349012997346,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6812,i,17456838732509487066,3311368124262984110,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4440,i,4995507775082612996,8878796939944291313,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,8851817788255681069,13717459492027527780,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6536,i,5560108978077120270,13263354373871110972,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4288,i,16997302350419549439,8535244579915964459,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,8844965339481551613,10889296673527856371,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7464,i,4283250918319666040,6716428110693819444,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7524,i,4905074346927253185,2510309274653298985,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,8610282622388514899,1096711726440285149,524288 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7612,i,17119505445060769711,3459442946024264029,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7704,i,14232643187201225602,3646706068096160980,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7624,i,8336035398954587697,964669443380587890,2097152 --field-trial-handle=2316,i,7572675718078374352,2452023514567896094,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
    3⤵
    PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?b=35&t=1&tid=351003091-BH-263_A3938981-E519-4F08-A15D-98E562E10089&clb=1&utm_source=351003091&utm_medium=SystemHealer4.5&utm_campaign=popupok
  2⤵
  PID:1588

C:\Program Files (x86)\SystemHealer\SystemHealer.exe
"C:\Program Files (x86)\SystemHealer\SystemHealer.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery