Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/12/2022, 22:15
221228-16b2vsbg53 828/12/2022, 22:14
221228-155yjsbg49 628/12/2022, 22:11
221228-14aq1sbg46 8Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2022, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
Xbox Achievement Unlocker 1.4.1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Xbox Achievement Unlocker 1.4.1.exe
Resource
win10v2004-20221111-en
General
-
Target
Xbox Achievement Unlocker 1.4.1.exe
-
Size
2.2MB
-
MD5
b31e4faa516447ada1d619b228bba545
-
SHA1
1ae515c22cf51f10dce259c69456788bd3c64ca7
-
SHA256
e6555cb6c0d1fe378fcbded709d1b4bd063fdb6a5c130b2572c00893a130ebd9
-
SHA512
1ff2921966137b3c9ace78eb1ca2b26d05e22827d9f39ceb9f5b02c38490e9acf5faf91c80a76e7afac65dcaf3bc69dedae66bf240f5c0a29c471b2a8d59104d
-
SSDEEP
24576:KXpb1zoC9C8jG254xWLIxJULeHA62LASkG4ZjPSduVNTpm7PppZy6o3qB7jW5JMc:KjsC9CMU6AA6PvAo3qB7jRtBohaK
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\16053b55-6374-422c-b899-a466ffa95f98.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221228231524.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 735270.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1680 msedge.exe 1680 msedge.exe 2088 msedge.exe 2088 msedge.exe 644 identity_helper.exe 644 identity_helper.exe 2516 msedge.exe 2516 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4056 wrote to memory of 2088 4056 Xbox Achievement Unlocker 1.4.1.exe 84 PID 4056 wrote to memory of 2088 4056 Xbox Achievement Unlocker 1.4.1.exe 84 PID 2088 wrote to memory of 4088 2088 msedge.exe 85 PID 2088 wrote to memory of 4088 2088 msedge.exe 85 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 2824 2088 msedge.exe 89 PID 2088 wrote to memory of 1680 2088 msedge.exe 90 PID 2088 wrote to memory of 1680 2088 msedge.exe 90 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91 PID 2088 wrote to memory of 3660 2088 msedge.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xbox Achievement Unlocker 1.4.1.exe"C:\Users\Admin\AppData\Local\Temp\Xbox Achievement Unlocker 1.4.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.8&gui=true2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab36a46f8,0x7ffab36a4708,0x7ffab36a47183⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:23⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:83⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:13⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:13⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5040 /prefetch:83⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:13⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4204 /prefetch:83⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:13⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5872 /prefetch:83⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6324 /prefetch:83⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:13⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:13⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:83⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4060 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7a4cb5460,0x7ff7a4cb5470,0x7ff7a4cb54804⤵PID:1840
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2780 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:83⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:83⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:83⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:83⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2888 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:83⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,621382906345189007,694808534005277970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1732 /prefetch:83⤵PID:3116
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5036