asyncrat | 689f31dd7ded0ab5ab7197f89106d346a52b5e156929fa344b51b70a316e7005

Analysis

max time kernel
4s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOG TO ULP.exe
Size 27.4MB
Sample261006-2cparsysbs
SHA256 689f31dd7ded0ab5ab7197f89106d346a52b5e156929fa344b51b70a316e7005
MD5 3f7a89323455842ab32e31684e2a78c9
SHA1 c201e8e8be72d8b4aed2662153141b0e29dea147
SHA512 96bbf50a97c3af11adf9ed41c7699870279c7c7fa206b0e4820ddd4254ca54c2560b1d6d6365f7694dcf7bded02a2ff4ca5ef77a2ad891de6841b1995327f518
SSDEEP 786432:2i5STfW8n0gCdLLsKMMo5ovsVuxFQJZPCD3r4:2iAWvgCKoeqKE3r
TLSH
T128573310325591B6F937A378E2D9D824CB39B04A5B25C2DA77E850200ED37F9BE3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat stormkitty rat stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

https://api.telegram.org/bot7113911764:AAGoKYhX6bCB7LLL_OI5sznHjndPK37X0Zo/sendMessage?chat_id=7571391032

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000c00000001c699-8.dat	family_asyncrat

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c699-8.dat	family_stormkitty
behavioral2/memory/4188-46-0x0000000000C70000-0x0000000000CAE000-memory.dmp	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
4188	ICON.EXE
4928	ICON.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LOG TO ULP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LOG TO ULP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LOG TO ULP.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2088	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	ICON.EXE
Token: SeDebugPrivilege	4928	ICON.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4008	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4008	1236	LOG TO ULP.exe	89
PID 4008 wrote to memory of 3344	4008	msedge.exe	90
PID 1236 wrote to memory of 4188	1236	LOG TO ULP.exe	91
PID 1236 wrote to memory of 5052	1236	LOG TO ULP.exe	92
PID 4008 wrote to memory of 988	4008	msedge.exe	93
PID 4008 wrote to memory of 2088	4008	msedge.exe	95
PID 4008 wrote to memory of 988	4008	msedge.exe	93
PID 4008 wrote to memory of 988	4008	msedge.exe	93
PID 4008 wrote to memory of 4808	4008	msedge.exe	96
PID 4008 wrote to memory of 4432	4008	msedge.exe	97
PID 4008 wrote to memory of 4808	4008	msedge.exe	96
PID 4008 wrote to memory of 4736	4008	msedge.exe	168
PID 4008 wrote to memory of 4432	4008	msedge.exe	97
PID 4008 wrote to memory of 4432	4008	msedge.exe	97
PID 4008 wrote to memory of 4736	4008	msedge.exe	168
PID 4008 wrote to memory of 4736	4008	msedge.exe	168
PID 4008 wrote to memory of 4436	4008	msedge.exe	99
PID 4008 wrote to memory of 4540	4008	msedge.exe	100
PID 4008 wrote to memory of 4436	4008	msedge.exe	99
PID 4008 wrote to memory of 4436	4008	msedge.exe	99
PID 4008 wrote to memory of 4540	4008	msedge.exe	100
PID 4008 wrote to memory of 4540	4008	msedge.exe	100
PID 4008 wrote to memory of 4384	4008	msedge.exe	101
PID 4008 wrote to memory of 4384	4008	msedge.exe	101
PID 4008 wrote to memory of 4384	4008	msedge.exe	101
PID 4008 wrote to memory of 1912	4008	msedge.exe	102
PID 4008 wrote to memory of 1912	4008	msedge.exe	102
PID 5052 wrote to memory of 4288	5052	LOG TO ULP.EXE	118
PID 5052 wrote to memory of 4928	5052	LOG TO ULP.EXE	104
PID 4008 wrote to memory of 5804	4008	msedge.exe	105
PID 4008 wrote to memory of 5804	4008	msedge.exe	105
PID 4008 wrote to memory of 5804	4008	msedge.exe	105
PID 4008 wrote to memory of 1988	4008	msedge.exe	106
PID 4008 wrote to memory of 1988	4008	msedge.exe	106
PID 4008 wrote to memory of 1988	4008	msedge.exe	106
PID 5052 wrote to memory of 1148	5052	LOG TO ULP.EXE	108

C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.exe
"C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x398,0x7ffec671c188,0x7ffec671c194,0x7ffec671c1a0
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,8762702303598797640,13860065871831012087,262144 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,16096783473161468898,10094803115306622388,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,11417162879914374186,2050459471259283949,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:13
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3272,i,8607104102248424120,7890903644032453562,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3276,i,11283675900584292795,8822165542466999648,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,16527793555626011419,15398888292064760500,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,11859070612811234238,13232533477039130145,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:9
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,405485001878713955,12070072167110810074,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,17878784152617841407,474395904302892718,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5364,i,11443822114067888615,10858020762276111794,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5764,i,14561031475448781277,3314454410907489133,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5960,i,109228193175208763,5789332526243544726,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6020,i,17967978072064169649,17602570542927803141,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6080,i,8412021979318760789,11596335910680167033,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6100,i,3302069224164321060,10571556741979290885,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3552,i,144289842601031377,10409223972783897788,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3612,i,7351408945968309199,12732342532486316340,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6108,i,6570243459447259374,6234821010872238990,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6132,i,14198671309519994612,12124533915472041012,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5520,i,168491615272996963,11759310927736317324,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5452,i,15469693210332098900,10496629670513515210,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5536,i,7420783075047810558,4142585873406997027,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5496,i,16085393669366916103,7347914941686622910,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6192,i,5682317348366140085,11632396765118298588,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6164,i,18439980317315959477,4849357580357289278,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6228,i,5040804302367196989,1907856437523562878,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6260,i,7641852286363208811,14787184047463916113,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6272,i,6987845694755302727,5943917672961024546,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:1
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5068,i,8801077676518264263,16352200611839454436,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6292,i,6342865882293703250,17806940039189760875,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6148,i,13368337815112138357,1863573213100386034,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8064807040895193854,8985785929459464668,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:14
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14257887078475126764,8061583152457905156,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6384,i,6107695015543616226,7583851999559617292,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6424,i,16579541497845602565,9632940033364108638,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6456,i,513053255898953025,13107477925752623208,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5220,i,8117662550476323223,13008380158204997801,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6480,i,16655509187848840850,2618633265732850027,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6660,i,4830335622899751367,6268538030899900212,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6652,i,7773374648539818819,3140935013993713664,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6720,i,3033086183344962283,5289530759596843559,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=3840,i,3419942995358872338,10430490817983218015,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:1
    3⤵
    PID:6156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=3568,i,3531882742609534018,2264814009662718801,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6516,i,3589555348855875985,3085503553522269695,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6692,i,4408417745770398260,9349541573142093424,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:1
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=2224,i,3396313565721793238,16747205008923076408,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=3808,i,152766194305398914,836619971815334421,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6832,i,16202561215875412510,14241557783373959031,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:1
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6800,i,16860833726600987484,9418494577408452817,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
    3⤵
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8720,i,1267178865271459971,10780176992518129861,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:14
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8720,i,1267178865271459971,10780176992518129861,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:14
    3⤵
    PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5356,i,7615753771529795291,16702191203256898497,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7116,i,7199421090552112127,3782997627751455647,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7176,i,3407070499743088631,11269184399067884580,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7156,i,9439601995927530076,6959286133833310346,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8516,i,16517644990870893892,8681184918268021604,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12432 /prefetch:1
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8520,i,6476112409357899653,12087005062086631100,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12436 /prefetch:1
    3⤵
    PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8596,i,5188608515545904522,1857698562227350271,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12424 /prefetch:1
    3⤵
    PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8604,i,7710829620107357814,12936148364171362498,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12448 /prefetch:1
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8828,i,10087167497695968141,3004265116714360010,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12568 /prefetch:1
    3⤵
    PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8860,i,9213965460424613154,3431101684288780796,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12564 /prefetch:1
    3⤵
    PID:6764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8928,i,6011855886845270407,557801888442227635,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12532 /prefetch:1
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8884,i,12365076447122628121,1964349873476040920,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12560 /prefetch:1
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8984,i,11413798274702764447,8511426800578824578,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12596 /prefetch:1
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=4664,i,2918495980955420418,5912752047728548015,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12576 /prefetch:1
    3⤵
    PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10968,i,6677831452369181631,4754655062765383961,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17336 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14468,i,7115569632855029344,1592260381792946649,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12068 /prefetch:14
    3⤵
    PID:8944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14472,i,17854051351301146155,10835198775940355252,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12120 /prefetch:14
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=6832,i,3088472179960764212,7222254648158482227,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=12552 /prefetch:1
    3⤵
    PID:8996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=3392,i,11023331522938120559,5437020523516640925,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:1
    3⤵
    PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=6416,i,5479267437958997905,16883684605361621588,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=6192,i,16683917810478720,18127917005032037269,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17492 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=14172,i,13155993188714495759,13012232757956904761,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17516 /prefetch:1
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10348,i,7188347590880853874,90538464319833094,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17468 /prefetch:1
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=2748,i,13168635871789243685,3685084241873668019,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17548 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=6124,i,14942561867981708434,12864775496098701374,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17552 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6476,i,11499342932534175522,5224999828229125356,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17580 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=14208,i,5193092435245148050,305349114036321748,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17616 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=6688,i,4618510437616273851,12191980707202260660,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17696 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=7100,i,17329096987973666905,16519743002795793693,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17700 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=14656,i,1418071952507777331,3315948526470054782,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17808 /prefetch:1
    3⤵
    PID:8820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=14692,i,2448149866427380160,10972597305897710608,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17804 /prefetch:1
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=14968,i,15371247799782652686,2167358793297005003,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17840 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=15392,i,18228954904611451810,6201867121855407157,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17868 /prefetch:1
    3⤵
    PID:9056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=15436,i,11561723275396646150,15308600350765233946,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17904 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=15484,i,17971803701518511624,7253607267950246173,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=17940 /prefetch:1
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=15536,i,13465133109556415113,8725117815131080183,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18000 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=15584,i,4366897825261201206,11403764598002920893,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18020 /prefetch:1
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=15616,i,9041599422177349615,5399748863823940672,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18024 /prefetch:1
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=15832,i,17463282665551447288,467571265270922003,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18036 /prefetch:1
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=16428,i,4464688376970655820,2707265796128221178,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18096 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=15776,i,15513328706274776874,2338393886962949786,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18076 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=16460,i,12189317527945280815,2777577694042022499,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18160 /prefetch:1
    3⤵
    PID:8596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16992,i,18194327807568547103,7541471308094159707,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18196 /prefetch:14
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=16996,i,9627738128360108437,2200674784764697102,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18288 /prefetch:1
    3⤵
    PID:9188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=17080,i,8558609812584590034,2243861430775416352,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18348 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=17164,i,16408188605130275227,16407606937153691953,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18296 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=17128,i,17576490709723345562,15053839257571321012,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18368 /prefetch:1
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=17144,i,11587482928739167534,9038236882389584479,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18372 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=17060,i,16312816774349214911,13275495598521623254,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18396 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=17276,i,14140955403079480815,15641915838250635116,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18408 /prefetch:1
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=17312,i,14736851284808323760,12902908405099979626,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18528 /prefetch:1
    3⤵
    PID:7936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=17324,i,3148530028077925821,11614597277468142248,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18548 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=17212,i,8933750728757639377,13215326739052593257,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18576 /prefetch:1
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=7800,i,1101126404887093314,13644487208559504799,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18660 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=12124,i,5784696196665012592,14330806951323432865,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18656 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=12052,i,11181468748013727083,9604643013414423687,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18680 /prefetch:1
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=14552,i,9788051053016997582,12952079788935670808,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18684 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=17376,i,16281039449279559933,3872436003255675538,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18708 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=17396,i,14249729728056195222,5801197438802531869,2097152 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=18744 /prefetch:1
    3⤵
    PID:8316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=22952,i,13797352102147790769,3335686526025132586,524288 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=22980 /prefetch:14
    3⤵
    PID:9228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=23224,i,13774862626752367834,9598277655025115177,262144 --field-trial-handle=2436,i,7127437239919168851,7170229914195409666,262144 --variations-seed-version --mojo-platform-channel-handle=23220 /prefetch:10
    3⤵
    PID:9800
- C:\Users\Admin\AppData\Local\Temp\ICON.EXE
  "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
  "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\ICON.EXE
    "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
    "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
      4⤵
      PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\ICON.EXE
      "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
      "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
      4⤵
      PID:2912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        5⤵
        
        PID:2924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        6⤵
        
        PID:5624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        7⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        7⤵
        
        PID:5568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        8⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        8⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        8⤵
        
        PID:5348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        9⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        9⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        9⤵
        
        PID:5868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        10⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        10⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        10⤵
        
        PID:2608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        11⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        11⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        11⤵
        
        PID:812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        12⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        12⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        12⤵
        
        PID:1408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        13⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        13⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        13⤵
        
        PID:3320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        14⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        14⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        14⤵
        
        PID:6036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        15⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        15⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        15⤵
        
        PID:4200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        16⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        16⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        16⤵
        
        PID:2528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        17⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        17⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        17⤵
        
        PID:3568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        18⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        18⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        18⤵
        
        PID:2972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        19⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        19⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        19⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        20⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        20⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        20⤵
        
        PID:872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        21⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        21⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        21⤵
        
        PID:3480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        22⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        22⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        22⤵
        
        PID:1736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        23⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        23⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        23⤵
        
        PID:4736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        24⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        24⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        24⤵
        
        PID:6432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        25⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        25⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        25⤵
        
        PID:6640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        26⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        26⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        26⤵
        
        PID:6964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        27⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        27⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        27⤵
        
        PID:6348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        28⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        28⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        28⤵
        
        PID:6600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        29⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        29⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        29⤵
        
        PID:2604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        30⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        30⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        30⤵
        
        PID:8236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        31⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        31⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        31⤵
        
        PID:8432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        32⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        32⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        32⤵
        
        PID:8700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        33⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        33⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        33⤵
        
        PID:8916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        34⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        34⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        34⤵
        
        PID:9052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        35⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        35⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        35⤵
        
        PID:8300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        36⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        36⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        36⤵
        
        PID:8824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        37⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        37⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        37⤵
        
        PID:9076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        38⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        38⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        38⤵
        
        PID:8716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        39⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        39⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        39⤵
        
        PID:9032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        40⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        40⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        40⤵
        
        PID:8200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        41⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        41⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        41⤵
        
        PID:6680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        42⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        42⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        42⤵
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        43⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        43⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        43⤵
        
        PID:3852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        44⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        44⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        44⤵
        
        PID:8328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        45⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        45⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        45⤵
        
        PID:5392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        46⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        46⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        46⤵
        
        PID:3588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        47⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        47⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        47⤵
        
        PID:5968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        48⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        48⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        48⤵
        
        PID:5580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
        49⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\ICON.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\ICON.EXE"
        49⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\LOG TO ULP.EXE"
        49⤵
        
        PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

History.txt

Path C:\Users\Admin\AppData\Local\10ecdbf4283c6c6cf62e4c22b1edcfbb\Admin@QPRWHZMA_en-US\Browsers\Edge\History.txt
Size 181B
SHA256 de1e9332a7b9c23b722fed92373ef273f6396df49eb9dafde9a8897b819b8181
MD5 7e7491dee7cb6cde6b412fcf2d72953f
SHA1 fff1ba6fe0bacaaac6f24fe340ffe901a6dc5c2b
SHA512 d8529b1eb662698529f26372928add21e216f86de72d50bdb4ecb89f1b8bb8e10724e888c51b9da81edb62c40bea8f7892f1e01a4e514331d65c2ef36ccd64ab
TLSH
T177C0224ACA5462530A2C4821328A112818A0103E0AC32391A8C3E84C781041A23A4B7B
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\Desktop.txt
Size 523B
SHA256 1cc6a40fa91e6bf6cb64e6254305dcc1b7495d15e587a887ca63c4855d6c435b
MD5 023d5a5fe4d13f67501f5aa9ca49e67f
SHA1 9cc6e734bffcad8c09f45668c7495b4e171f7ff6
SHA512 310797816330305a74400e88c4dc5504801fade418bf98451826fa47a95574604017a8ee555ccf266554542214561cd7f72e61f36c538e2525978d2f9e8543bc
TLSH
T138F0290E033138CB0182B9FAD7BE8820B28018080A29083AE82AF048516AF30A02DBF1
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\Documents.txt
Size 614B
SHA256 12568e0359f5b16f7fc32441c1819068e70e4d89faf74b5ef628fe588f8068c1
MD5 387c583c5e892988bc1f01e60f17fe0e
SHA1 1c5bab28d4e0d7fb37ba0ce1f1125b7c77f2bfdf
SHA512 d4abb3e499f210b37fe525b093118a8a2a73ca7f7a42f3434c566f9f8eb0c1af4b428e7bc479c83b45293101731d0586b9e00d4a1f30c7983f5d76390137ccae
TLSH
T1DFF0E1BEB21D78C3519D7174A3B17161BB46CD4C0A1B06B32AEDAB58386A57448413F5
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\Downloads.txt
Size 742B
SHA256 eaee6bcae78dee2779df13a8b23448761babe86fd61095933d42861b8126100e
MD5 034b83795b16c0b34318b700c9605759
SHA1 a4df0772b4a777794fcba150ff1493a4144e66f0
SHA512 ad16d75aab5a1b40081ee8b95de8e936d2440806ab96c864e5c3979195107d087bc0fe2872300525720483a014a5d11326761989b1cc2348f6762542084ca7b7
TLSH
T1C60115DDD020FCC39294367CE6724880399A3C8D1C4D1A37B4DAA17A43EEC616DA7543
MD5 SHA1 SHA512 TLSH

Submit Download

OneDrive.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\OneDrive.txt
Size 25B
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
MD5 SHA1 SHA512

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\Pictures.txt
Size 570B
SHA256 e44513a8008a967cfbe7d68e0ec960052d63b6bae9c8e80635e11b05420f620b
MD5 9be2d56f161b1b7bc591e504901f884c
SHA1 cfde9ccbc69f85b2d4ff7e2619076e851d6e4d90
SHA512 b1f117219f261e2783411bd4a831f0cfafbbfb5b559ba7e9f64788d482de8b6af39aee7b556df6370ffa51f1958828c24574c80356c8988fd501176b5c006f69
TLSH
T143F0E13FD008BC87575A3D3C5C7855F07B9628C591055323389BD49CDE5D5012429AD2
MD5 SHA1 SHA512 TLSH

Submit Download

Startup.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\Startup.txt
Size 24B
SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
MD5 68c93da4981d591704cea7b71cebfb97
SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
MD5 SHA1 SHA512

Submit Download

Temp.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\Temp.txt
Size 5KB
SHA256 d2e412fb7f8bf39ab8a57333d90a2ee83a69a35d3a5d02f60f5f32db4caa82fd
MD5 ad9b5e8bf75dc31ab2c151ce6f1fa922
SHA1 a03ec3616cebfa47474047d35821afa90b613ae0
SHA512 f22558e603fe03f3fed4b2e70f9b703d54fdd2e1b91f5fe99af516b1131b7addef89836685c10716dbc6cce72085df35f353ecc985bcdb474d77ee0e3b2a6725
SSDEEP 96:DWgKfjG7TsOj/5pAjS7boJorfsmHKrYStbtNtYt9/tOmtEt/tqtJtFntftJgtqgU:i3fjG7Y0pb8arfsCKxJLM9VOKQV2PFtV
TLSH
T10FB1A7CF0B6EE28E317535BF62F776F9B2168F8F8009C655E64A461EDC62311E1C2904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\Directories\Videos.txt
Size 23B
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\70226ce738826bff804eef30a2711352\Admin@QPRWHZMA_en-US\System\Process.txt
Size 92B
SHA256 445856e03ca72f75dae7a8dd58e72681aa46e4b411370fc690e4286315ce9554
MD5 9dd22331d563e6f08293e79868b099f4
SHA1 eaf1ba5cfeaf7c08078ade6958b7f08683df64fb
SHA512 bdbec08c0dbf64c7af2a0124e721713c416acd8d7338f8eb55d3dba2992eb068ac8f607375f570d988c7cfa92ffa4c09cf74c6ecbc63dde802425ee3d9e44a38
TLSH
T134B01250CFC1C1D366627CD3631048408132040AED540D0921264F8190C155942865C2
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\9c7b60221e5e9d1758836b5e6b60c6ca\Admin@QPRWHZMA_en-US\Browsers\Firefox\Bookmarks.txt
Size 81B
SHA256 e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995
MD5 ea511fc534efd031f852fcf490b76104
SHA1 573e5fa397bc953df5422abbeb1a52bf94f7cf00
SHA512 f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae
TLSH
T1FDA0222022B0B0E80F03C0000008B832208EA3308FFF0BCF020C83A030A23200020280
MD5 SHA1 SHA512 TLSH

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\9c7b60221e5e9d1758836b5e6b60c6ca\Admin@QPRWHZMA_en-US\System\Process.txt
Size 333B
SHA256 b17d6fbd94effcdc0e17389d65faeefff2aefdfe630252f9cd9756a115d20ce7
MD5 eb7a2d2349634f82ca21d73f2a94ec6f
SHA1 c22f85641dbdc54c8ad4d9e22bdaa53720980b7e
SHA512 162a2ddc105e733a1e58888f187a7f170b805cc400cdc13683875a334d24a548e39853b30c2ee999ae1f6a4bc0e1c6cc4734bdb4341c9c6a1d24ffcf0f9bbdde
TLSH
T179E026009FC2D9938B5398D305A28607A3311C087F5D3E0D23B2C788BCC293DD686661
MD5 SHA1 SHA512 TLSH

Submit Download

031bbb1d-6c74-4d0b-9bbb-3cd70bf4067f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\031bbb1d-6c74-4d0b-9bbb-3cd70bf4067f.tmp
Size 37KB
SHA256 4d493ad11c6024eb24d581407324ea729776b3a80260f04414a72ae3a83e590f
MD5 e68dd5a2fbae25d2cf4d8deeb6e4d338
SHA1 be1496c04a118507902528ec579e870a6c499487
SHA512 ee3ee261f1d7ee9450f48c80dc62dc6af3c78250e62eea9c54d42fbf9ade98db91d50d5ea8d3d85e9b5e93bc4521efee237140dad11fb95f3523862d7c1289ea
SSDEEP 768:p/UxvxjgC+k3ACf9cE0IyEMbxyJugQVTJ7vvmev5SHtBk:cZj3+k333nyEmxyJJq17vLSbk
TLSH
T12003CF35ACA59C7388F792843249E787EFF501A384C62BA485DD6F0E168B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e628559-209c-4ab9-95f5-c7712718dc4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e628559-209c-4ab9-95f5-c7712718dc4c.tmp
Size 39KB
SHA256 e5b52da6f6006ad1cd566482d9044adfa30a9159df59e92ae3fe89303f8dafe2
MD5 7ace0e7830ecc467419dd65067d6e00e
SHA1 16722cffcf3b92f3d6a2c9238594b81eb46db40b
SHA512 375b02082df681a0682e218466c9cfb104d7541f7adb3e65223291eb70a8daa8e080215bda360111bf3cc4661bef5151e6e62f86a2015301e6b48f3fccae6f18
SSDEEP 768:e/UxvxjgC+k32o3f9cE0qzGyEMbxyJugQVTJ7vvmeXDMMVgP:TZj3+k3n3pGyEmxyJJq17v1mP
TLSH
T13203BF3198759C3389FBD2807259A7C3EFF505B398C61EA8D8D95E0E06873AD170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32854703-b4f4-4819-9df9-1d64751f4188.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32854703-b4f4-4819-9df9-1d64751f4188.tmp
Size 38KB
SHA256 f942bf31b5d76c0a5c4ff586b24bb59780af4b1933b83bf6406351ef03f81222
MD5 6a2172ffa90bb00cbcc1da241c60e2ae
SHA1 03a32cb62f8958ea7b662589faa259ec3d091552
SHA512 d361f9ec57d9da1c369481afaf71bc5bf0a42a39b5b2eaa20da5e69e825b309ad4e914557c994b99c0de5cf46cf4ea3e083d5e8fa38e84553808ce40fe7f4393
SSDEEP 768:o/UxvxjgC+k3iMFf9cE0qzwyEMbxyJugQVTJ7vvmeXDMMVWP:1Zj3+k3J3pwyEmxyJJq17v1wP
TLSH
T17F03BF3598759C7389FB92807259A7C3EFF501B398C61EA8D8D95E0D06873AD170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45d64423-b0ff-4e54-b5e7-d70b65f104fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45d64423-b0ff-4e54-b5e7-d70b65f104fa.tmp
Size 38KB
SHA256 e6a7e5c4689d5f7716570d79dcaad650b7c5d1ec3dbad2c51e569549bdb63b51
MD5 c88e810f093ba99c6b1501a0f4a96a22
SHA1 891fde79c567a475ee5c06f1f41a5a0bf0c7bc67
SHA512 2e46ac56623191b929947f4e0766c761be2dd86d5ee3eb797c9b623cb9792eeffbb1959077a4fcc7c8137f4e30f016c274070baaa9fe019dd7c2ac9154e2d7d3
SSDEEP 768:K/UxvxjgC+k32qDf9cE0qzNyEMbxyJugQVTJ7vvmeXDMMVgP:PZj3+k3h3pNyEmxyJJq17v1mP
TLSH
T1A403BF3198759C7389FBE2807259A7C3EFF505B394C61EA8D8D95E0D06873AD170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63f32ea6-b35b-4e44-9aa8-971fb96b45a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63f32ea6-b35b-4e44-9aa8-971fb96b45a2.tmp
Size 39KB
SHA256 8f16a0c1cb5bfbc9ba9325da49a40e72d8e1a56f7c727c9551536b5d772fd921
MD5 1eb67903931ef0f565644442d853f993
SHA1 75100c6c2d265b25eb73ba34f52665b3c0589c36
SHA512 ec4f834b7d850ed2df7f21133f95c7dda283d1c9df0fcbfcf343b02ae0b06969591ade1402c86c8aa7800a09acfbf005a352c6f246414ebb5216b86df295236d
SSDEEP 768:y/UxvxjgC+k3VHhf9cE0qzGyEMbxyJugQVTJ7vvmeXDMMVgP:3Zj3+k3R3pGyEmxyJJq17v1mP
TLSH
T12103BF3198759C3389FBA2807259A7C3EFF505B394C61EA8D8D95E0D06873AD170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

05d42656-f02b-4d9b-8c4e-34bb93245f15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05d42656-f02b-4d9b-8c4e-34bb93245f15.tmp
Size 11KB
SHA256 55a7a70b04a0f8732ed8d5b0417539ca9b9b634d9adb71430db6d5be39426854
MD5 0979bbd3d6b4dcca059d67d69817ae82
SHA1 ca34efb838f1e7e63410bcdc84c52ad1f6dbe17d
SHA512 ba6d7f77b2e44259b8e3666ed908321e4689c3ce2c0e67f7f345931ee0a8c8d421bd6814920e8ad30c3b9c86a56a84d3a871330b83c6b9f08d4dd398bce3115e
SSDEEP 192:sxRNReMCo/fWsMk442zoA8p4y/g6+WNIYFDtGuIgDpJJ:sxRN2o/fWsMP4rz/5I8Z
TLSH
T1A232C755AE28A97B9CCBD20DBB55BF53D3F91032A1D51E48E6FC8A1C00E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e54222f-ee86-4b1a-9d4f-155d14ff7e6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e54222f-ee86-4b1a-9d4f-155d14ff7e6c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85b77eaf-9827-49ee-8c59-7c776cb09f0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85b77eaf-9827-49ee-8c59-7c776cb09f0c.tmp
Size 11KB
SHA256 d428a215299a57c1739ee16e15e69cfc39a04395f54678e335f6127671d6d2d2
MD5 d24f78e8c5839fe6cacbded577f79c89
SHA1 582bacbab497633811649c27c1d6ef9444fb3e88
SHA512 236f2b3930d9c4f52d52c423f93a512b9267084d16d2b20eb5bd3d9d8504bc706def13050d656230d028cf62d7aef70fa9205a9d4b5f056aea149fbd369707c3
SSDEEP 192:sxRNReMCo/fWsMk44DzoA8pee/g6+WNIYFDtGuIgDphJ:sxRN2o/fWsMP4yB/5I8l
TLSH
T17832C755AE38A97B9CCBD20DBB55BF53D3F91032A1D51E48A6FC8A1C00E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f14a68ad78f66c7777324b9a35dfb6f71cee3e3d0152d26931cf9d40702fca80
MD5 cb3a18116e3a29c3f3bf4c9f03011808
SHA1 dcd51d362bccb696605e90a2f695be0c8b30eb32
SHA512 f2360982f68d8901da0228e3794cb6b8f25d06b5d706fab6fadb589f0efde72a3a46236dfc8648be534edb4dab8acdd150cf333437edc4e1cee708016e5124ea
TLSH
T16A61A68E2AA04012FF7830FE89D1BEE37E34A6C746873E1236D7DAB5986736C1C54108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ed0df013b29949fa6269e041b497fb512bfc84116af3c465d3d6b8c169076130
MD5 0a3abd616a905d32e9371e5e2ac16675
SHA1 edb358be44bcbd3cf6da91ae7ffabbcfc20a4125
SHA512 82e8dcf44e13f2e4386b73031e279707843819b1e2821e8c41d56803faecf6f72c643b65b2055b90b09ff15d0d2bb35aa0d99ba914dcb6d21b06e10117ee6d79
TLSH
T18861858E6AA04052FF7830FE89D0BEE77E34A5C755873E1236D7DAB5986736C1C54108
MD5 SHA1 SHA512 TLSH

Submit Download

cee8f6db-d2ad-4bdf-a124-d580b8e99a42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cee8f6db-d2ad-4bdf-a124-d580b8e99a42.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

485585f8-277b-4056-9fac-839ccd3e56f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\485585f8-277b-4056-9fac-839ccd3e56f7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6e1ecd42-f8d0-479e-9659-44bcbe4d3926.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e1ecd42-f8d0-479e-9659-44bcbe4d3926.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d33fc342-b476-4b9a-bc3a-b06bdb4f9230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d33fc342-b476-4b9a-bc3a-b06bdb4f9230.tmp
Size 2KB
SHA256 fdad0de2128f886bc6fe2c99ba3cafe21a0f5755cac553343959b18365e894a9
MD5 24a35c4babffac9b4ac29521b0f36332
SHA1 d5f605291780dd1707e5f5e9980f620afd40131a
SHA512 973acd40b384e0434fed9ab2cb2cda90a699811afc0f5073dfa240e426b5fe8668fb0f3cd5fb12560bf70d3e66bb89913dae6b41eb1018a15b9d45cd04636123
TLSH
T166419CF3C3E8866D890156F0AB147E1BCE2D0915832C3D5AC9E4EF2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 64ed47746d731459df376f0fb2248e359b26379e79a5ee2984beb14eb02a48c7
MD5 8c60c03e8a6722f1b9200b92eafa4f57
SHA1 36d7e2647b87cc4ddcc4c9b03bf6722ef67cf727
SHA512 f25b1ef0bf78a250d40b38866a981b24af72bee8fcd63c91cba9683826ee75e7e64ff411568bb017ba27b6feeaf91aa18579e84b06c16d2cde2813a3efd7a8b7
TLSH
T154517138317F4302393D2A48959D956A8A9171F334A5F6BE37A944E18E2FE04DDBCCC9
MD5 SHA1 SHA512 TLSH

Submit Download

c085498f-e548-437d-8701-a9a9f38c4b86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c085498f-e548-437d-8701-a9a9f38c4b86.tmp
Size 27KB
SHA256 5994a0339d2a680f1b698ecb975a8d16bcd937df3a8f37801c7cacb598b1c470
MD5 e9120fb94c507a42536475c32418b1ba
SHA1 2745134717103a523804e7ee698ff28c89cae5ec
SHA512 a9c1fd6ac3fc6c078b599d7f0e19cbb80c007476238e8468a3567acf55f1b2908e1abe13c72bae0ab2dd252104c732fc59aabfa55e32acf02896de61ce9ec025
SSDEEP 768:+l2P/q7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo0a0Cro+PI:+l2P/CEbDKWgwef4eu1jaXh0Z+I
TLSH
T1B3C2DA6F640C8B7F4F904ADDA8197E9B6D6C02CB9698C98047FE941C03C77EA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3c6288b-34e7-4f43-86cf-e7fdb9e72425.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3c6288b-34e7-4f43-86cf-e7fdb9e72425.tmp
Size 11KB
SHA256 7e1ad3b34b11b60a2a4450c328f39f5f0c8f08f992be0c594264a179a530291b
MD5 07f6363ce36a5459727fec7e4bd8b1ea
SHA1 a55fc646a101a0d019cc26e6d59046ee30c349d0
SHA512 8bfdc779e11c7bc589ed9e46a916e8c9dae0fe3b9445db679567fadd885adb118330a26f2c735f2f4d740369a50fd17bda1f4ba74a144d1b4149a11023ea5ef3
SSDEEP 192:sxRNReMCo/fWsfk442zoA8p4A/g6+WNIYFItGuIgDpJJ:sxRN2o/fWsfP4rp/5IpZ
TLSH
T13C32B655AE28A97B8CCBD20DBB55BF53D3F91032A1D51E48E6FC8A1C04EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb22a262-9065-4189-b851-8693f882c403.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb22a262-9065-4189-b851-8693f882c403.tmp
Size 11KB
SHA256 3c84011834fbc2db90b72bb1bd76cd099d6f8b3217655d96e131ae6c7ec38ab5
MD5 96c27caeba2eb1b1e00fce6b9d36f452
SHA1 c780db56d7e85ebe7891e9a627887d1e76f6d791
SHA512 c9781a57eb8a25c747f47e7285392775487fb494d1a6916be79b61d76dea706e31fa18ff3582c22e8edff0a31f35487c68d4e0930341bbe035b80ec136f285a5
SSDEEP 192:sxR6ReMCo/fWswk442zoA8p4A/g6+WNIYFItGuIgVJJ:sxR62o/fWswP4rp/5IpJ
TLSH
T1D632B755AE28A93B9CCBD21DBB55BF53D2F91032A1D51E48E6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

fad6cb61-2676-4727-a1c7-cf7f4e8b61e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fad6cb61-2676-4727-a1c7-cf7f4e8b61e0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dab604c9-ba21-4c45-84e1-bc20a487cf09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dab604c9-ba21-4c45-84e1-bc20a487cf09.tmp
Size 42KB
SHA256 5f2bede01674c6cb6fbf161a85fbaddeb88b9b5d586a50ec02d35981b18f4686
MD5 b646a1e0890043d0b5b3b8002121ad50
SHA1 bfb1bb7e267f62087b50a6bb15c8f2d2cb9a49af
SHA512 1dce038cb66fb59642371c7daba75f9a99feec400b0b2c857cbdf1ab275623e981f253d25c3e8ca7ef1c61ec4a403063ea5d969848137e915c47f11c16529856
SSDEEP 768:dFg/UxvxjgC+k33wg5JQAi9cE0qzSyEMbxyJugQVTJ7vvmeXDMMVgP:xZj3+k3g3pSyEmxyJJq17v1mP
TLSH
T1EF139C36D865CD77A9F79781B349B787EFE001A388C999E8D9C94E0D01872ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7419f101-3e38-4241-942c-17972e75a7e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7419f101-3e38-4241-942c-17972e75a7e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

AMRTECH-VIP _ PROFILABLE.MHTML

Path C:\Users\Admin\AppData\Local\Temp\AMRTECH-VIP _ PROFILABLE.MHTML
Size 817KB
SHA256 3633e26f2c0368db5e72a62e169972dcd6b1f857194cc001694737a213cd3836
MD5 4db3b2654067409b396dd5ec184b3b80
SHA1 4b480b815609c59beb86b5864fa44dcf7aa7c40e
SHA512 290321b6afa2386db2428ddf95bfb40b03013c9d6459f6c5c2ef08e13355f655f080a2c23f0c93b2b3c043e887d7d4576074cee8030620113f411c637154bb44
SSDEEP 24576:nkr/5JTM/KvMf21+3HAAgXBlObpRHRjrHkkmCDpVraW5Vq:erMjtALXBlObpRHRjrHkkmCDpVraW5Vq
TLSH
T14D05BF22B01592777D3377BCE3CFE54CAB3A3488D80142ECB5ADA0104BCA6F96566F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ICON.EXE

Path C:\Users\Admin\AppData\Local\Temp\ICON.EXE
Size 226KB
SHA256 54f30f6ff9740e1b67f0f79cc1790ba6eb4b987b3eae8cd665e57d6a1355cd6d
MD5 b8363d9d6b9741055cafbfd7e09914b1
SHA1 646bb8296370902b4171cc33424f1229d58419d7
SHA512 359ba9677ed7d1fcb0bf177a399873e72fc2f7dec6c90ae47d09b1e2af5ec59ffb42a8940cffee0a9a7790b86db21ec57c1893c5d6a62d0c17b836f778dcc52a
SSDEEP 3072:++STW8djpN6izj8mZwOimlcOZeVa6UbBQ+GY6QHpzKGIUpFj6+Wpj:j8XN6W8mmO/9eM6Ubz2QHcwp
TLSH
T1C2348E1037DAA62AE3BFDB78F46001159372E003762AC77F2ED498E91C93315D990BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\c0557894119fd364fe22db99a352f3d2\Admin@QPRWHZMA_en-US\Browsers\Firefox\Bookmarks.txt
Size 162B
SHA256 ff9b231ec4d32420337db47764c66eeab38d07fa42e65637b8f8ac165d5e8eb5
MD5 9b9de086b372da84e4bd01979b2d501e
SHA1 14bb853a2e1360a92a43564cbbf2b1e654bfd745
SHA512 5db7723390582ccd93ede00c90036a6276cd98be1bd0bce7c059302bcea2fdb2829ae37cf00f2cfffb481857b21a4ffe2332c1919161a2b5ff05b87f4233e78b
TLSH
T18EC0222022B0B0E80F03C0000008B832208EA3308FFF0BCF020C83A030A23200020280
MD5 SHA1 SHA512 TLSH

Submit Download

Temp.txt

Path C:\Users\Admin\AppData\Local\c0557894119fd364fe22db99a352f3d2\Admin@QPRWHZMA_en-US\Directories\Temp.txt
Size 7KB
SHA256 b9e693a257ba0722aee5a213675bf7b014213de04434c16a26bc613f0dd202f0
MD5 ca4f230ea9b71e7a831eef52bd3a12a9
SHA1 2e716d684fb53f44d71a011ef1937b9237be30c6
SHA512 65af6f453b2532a39259a0a9083833d019612f690ea11e136b7a26bd8259298886038579813b609fc88ee205a0e71eea6d951bb9a76d5dad0ca74d9204c04b0f
SSDEEP 192:i3fjG7Y0pe8arfsCKxJLM9VOKQV2PFt1JkqklkCg6JMndYjb95:i37x0peprfsdJLMXOKQV2PFt1mJaCSdo
TLSH
T122F1B7CF1A6BE2AE3579B5BF56F77AE5F2164F8F8009C111E64B060EDC72312D581802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4188-46-0x0000000000C70000-0x0000000000CAE000-memory.dmp

Download

memory/4188-402-0x0000000005750000-0x00000000057B6000-memory.dmp

Download

memory/5220-1089-0x0000000004E80000-0x0000000004F12000-memory.dmp

Download

memory/5220-1112-0x0000000005BF0000-0x00000000061AA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads