Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2022, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
lovel.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
lovel.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
lovel.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
lovel.exe
Resource
win10v2004-20220901-en
General
-
Target
lovel.exe
-
Size
144KB
-
MD5
2109c150c16eae3edd2b9936fcc6e8b4
-
SHA1
f07fd6f5d8e6c447adf31c52ff99da00ae2a6a00
-
SHA256
edb7525a53ad2a5cdc3551de4844bc40f04bbdf8bccaac72228fa167d6d034c7
-
SHA512
06b9c5f3d89c4167b8187fd7d8b96f9c6d277d6ee1de6f03729613396fd894b9bea7b134377ab30b9ba1920d2dbb9fb032f1d97e9a96472eee81e2d6fa83e5a4
-
SSDEEP
3072:wxyjMffJq5h4uMXTfSP89fA0J9W7cluztx:w8l4uMXTf0MU7cAzt
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\87b4a2f5-2cba-4264-bde4-1b7e33bfabd4.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221008165315.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1700 msedge.exe 1700 msedge.exe 2236 msedge.exe 2236 msedge.exe 4944 identity_helper.exe 4944 identity_helper.exe 5916 msedge.exe 5916 msedge.exe 5916 msedge.exe 5916 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3068 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3068 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2236 2452 lovel.exe 87 PID 2452 wrote to memory of 2236 2452 lovel.exe 87 PID 2236 wrote to memory of 4232 2236 msedge.exe 88 PID 2236 wrote to memory of 4232 2236 msedge.exe 88 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 2852 2236 msedge.exe 90 PID 2236 wrote to memory of 1700 2236 msedge.exe 91 PID 2236 wrote to memory of 1700 2236 msedge.exe 91 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93 PID 2236 wrote to memory of 2112 2236 msedge.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\lovel.exe"C:\Users\Admin\AppData\Local\Temp\lovel.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.7&gui=true2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffdb7d646f8,0x7ffdb7d64708,0x7ffdb7d647183⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:23⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:83⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:13⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:13⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 /prefetch:83⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:13⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3732 /prefetch:83⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:83⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:3972 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff691dd5460,0x7ff691dd5470,0x7ff691dd54804⤵PID:3100
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:13⤵PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:13⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6208 /prefetch:83⤵PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:13⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:13⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:13⤵PID:5148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:13⤵PID:5212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:13⤵PID:5340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:13⤵PID:5460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7084 /prefetch:83⤵PID:5676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5312 /prefetch:83⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7088 /prefetch:83⤵PID:5804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:83⤵PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,18234903509295226158,16518773000672374144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:83⤵PID:6028
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5112
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x14c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5476