c739be0419a32f30a7fc81c15c32ef5c4b2d1b26cb096155efe1ef194bfdc503

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Executes dropped EXE 4 IoCs

pid	Process
1832	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
2560	CleanupConsole.exe
4880	OneSystemCare.exe

Loads dropped DLL 4 IoCs

pid	Process
1832	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
1832	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4160_587582720\protocols.json	msedge.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-VG1R8.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-8BD9E.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4160_587582720\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4160_1802412494\manifest.json	msedge.exe
File created	C:\Program Files (x86)\OneSystemCare\is-AC4LC.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-HJ669.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4160_2056395496\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4160_1802412494\nav_config.json	msedge.exe
File opened for modification	C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-MGB28.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\ydwqk.dll	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-J8JGD.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini	OneSystemCare.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\One System CarePeriod.job	OneSystemCare.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CleanupConsole.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2032-39-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2360-51-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2032-57-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral1/memory/2032-132-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneSystemCare.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{180B805B-27ED-4B6A-83AC-3E908B008049}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2616	schtasks.exe
2848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4880	OneSystemCare.exe
Token: SeCreatePagefilePrivilege	4880	OneSystemCare.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
4880	OneSystemCare.exe
2560	CleanupConsole.exe
2560	CleanupConsole.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4880	OneSystemCare.exe
2560	CleanupConsole.exe
2560	CleanupConsole.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2560	CleanupConsole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1832	2360	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	87
PID 1832 wrote to memory of 2032	1832	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	96
PID 2032 wrote to memory of 4196	2032	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	97
PID 4196 wrote to memory of 2848	4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	100
PID 4196 wrote to memory of 2616	4196	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	105
PID 2560 wrote to memory of 4160	2560	CleanupConsole.exe	111
PID 4160 wrote to memory of 2616	4160	msedge.exe	112
PID 4160 wrote to memory of 4996	4160	msedge.exe	113
PID 4160 wrote to memory of 2040	4160	msedge.exe	114
PID 4160 wrote to memory of 2040	4160	msedge.exe	114
PID 4160 wrote to memory of 1864	4160	msedge.exe	115
PID 4160 wrote to memory of 1864	4160	msedge.exe	115
PID 4160 wrote to memory of 1864	4160	msedge.exe	115
PID 4160 wrote to memory of 1920	4160	msedge.exe	116
PID 4160 wrote to memory of 1920	4160	msedge.exe	116
PID 4160 wrote to memory of 1920	4160	msedge.exe	116
PID 4160 wrote to memory of 1992	4160	msedge.exe	117
PID 4160 wrote to memory of 1992	4160	msedge.exe	117
PID 4160 wrote to memory of 1992	4160	msedge.exe	117
PID 4160 wrote to memory of 4168	4160	msedge.exe	119
PID 4160 wrote to memory of 3668	4160	msedge.exe	120
PID 4160 wrote to memory of 4168	4160	msedge.exe	119
PID 4160 wrote to memory of 4168	4160	msedge.exe	119
PID 4160 wrote to memory of 3668	4160	msedge.exe	120
PID 4160 wrote to memory of 3668	4160	msedge.exe	120
PID 4160 wrote to memory of 2260	4160	msedge.exe	122
PID 4160 wrote to memory of 2260	4160	msedge.exe	122
PID 4160 wrote to memory of 3836	4160	msedge.exe	123
PID 4160 wrote to memory of 3836	4160	msedge.exe	123
PID 4160 wrote to memory of 4488	4160	msedge.exe	125
PID 4160 wrote to memory of 2628	4160	msedge.exe	126
PID 4160 wrote to memory of 4488	4160	msedge.exe	125
PID 4160 wrote to memory of 2628	4160	msedge.exe	126
PID 4160 wrote to memory of 1104	4160	msedge.exe	128
PID 4160 wrote to memory of 5132	4160	msedge.exe	129
PID 4160 wrote to memory of 5132	4160	msedge.exe	129
PID 4160 wrote to memory of 5196	4160	msedge.exe	130
PID 4160 wrote to memory of 5196	4160	msedge.exe	130
PID 4160 wrote to memory of 5336	4160	msedge.exe	131
PID 4160 wrote to memory of 5344	4160	msedge.exe	132
PID 4160 wrote to memory of 5336	4160	msedge.exe	131
PID 4160 wrote to memory of 5344	4160	msedge.exe	132
PID 4160 wrote to memory of 5800	4160	msedge.exe	133
PID 4160 wrote to memory of 5800	4160	msedge.exe	133
PID 2560 wrote to memory of 5736	2560	CleanupConsole.exe	134
PID 4160 wrote to memory of 5748	4160	msedge.exe	135
PID 4160 wrote to memory of 5748	4160	msedge.exe	135
PID 4160 wrote to memory of 5748	4160	msedge.exe	135
PID 4160 wrote to memory of 5936	4160	msedge.exe	136
PID 4160 wrote to memory of 5936	4160	msedge.exe	136
PID 4160 wrote to memory of 5936	4160	msedge.exe	136
PID 2560 wrote to memory of 6000	2560	CleanupConsole.exe	137
PID 4160 wrote to memory of 6020	4160	msedge.exe	138
PID 4160 wrote to memory of 6020	4160	msedge.exe	138
PID 4160 wrote to memory of 6020	4160	msedge.exe	138
PID 4160 wrote to memory of 5116	4160	msedge.exe	139
PID 4160 wrote to memory of 5124	4160	msedge.exe	140
PID 4160 wrote to memory of 5128	4160	msedge.exe	141
PID 2560 wrote to memory of 5388	2560	CleanupConsole.exe	142
PID 4160 wrote to memory of 5348	4160	msedge.exe	143
PID 4160 wrote to memory of 5348	4160	msedge.exe	143
PID 4160 wrote to memory of 5348	4160	msedge.exe	143
PID 4160 wrote to memory of 5832	4160	msedge.exe	144
PID 4160 wrote to memory of 5832	4160	msedge.exe	144

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\is-FCQN7.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FCQN7.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$70170,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe /LANG=en /SL5="$70170,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\is-ECTV6.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ECTV6.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$90290,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe" /LANG=en /SL5="$70170,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe\" -Notify" /sc onlogon /TN "One System Care Monitor" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "'C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe' --scan" /sc ONCE /st 05:38 /sd 10/14/2026 /TN "One System Care Delayed" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2616

C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e0,0x7ffb7445c188,0x7ffb7445c194,0x7ffb7445c1a0
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,13529723178269787860,6526280866042460180,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,17808649751094166312,13843524029101447218,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,5814298975919154807,16763595558795310303,262144 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:2
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,4329649723186681969,3494273577377248134,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,9412443607364698932,7925037912734370150,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,15890582518369054369,2305937762825734865,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,3900299442419164721,7151864166294586193,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:2
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,8969673834184005314,9788531108814563267,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,1660345844554953628,14329086258158374122,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,13876162963693884528,1782822065338797464,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,7227627865947804612,12567256155980888025,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,5137135743496621965,5025503836639184704,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,5137135743496621965,5025503836639184704,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6231944352826886819,6085550783466129655,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7848651508659575959,946153662361294871,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,7285567941005853501,13432122610988745784,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,340152636092583960,16375487828524410150,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,3055833158258449455,436267087043496874,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6540,i,8721584318411922529,1003189143776408556,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6812,i,499651719756155307,10525904139015465727,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4860,i,17201555720223629510,8527854127729576377,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=700,i,821827318182682719,13489675261780056763,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,10749848559799609605,15239144885676081472,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,1423238941021145373,10268830109322139237,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2716,i,11059646469352776615,5338512710138174463,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3760,i,3694410088779739893,12251918378622596492,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7084,i,8969136064763734442,18110702921085495843,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,10667968914247425789,9594968841299082456,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4808,i,12050337615595475856,5272407707260408277,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,11411184765208765473,1699121336088378535,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4900,i,1853787988850010165,6695143056461345967,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,7600581216846557742,13347130107962441667,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:8
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4888,i,14522636581277850174,8511396183876551175,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,12885469709020542183,9426044912720495782,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7412,i,6283085876445104901,7723666871575273106,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=3744,i,17546332185268125879,8970583957783724792,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7836,i,14898288624154129742,8781459989585587218,524288 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7844,i,14922973808460940204,5242578846667713228,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6972,i,7678779687390923524,5908173839326704995,2097152 --field-trial-handle=2988,i,1644455436549775647,6753612075461169804,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_67ADC01A-99AF-436F-92ED-F8E36A6AE296&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4488

C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
"C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery