Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
Princess.Conquest.rar
windows7-x64
3Princess.Conquest.rar
windows10-2004-x64
3Princess.C...OM.url
windows7-x64
6Princess.C...OM.url
windows10-2004-x64
6Princess.C...OM.url
windows7-x64
6Princess.C...OM.url
windows10-2004-x64
6Princess.C...rr.ps1
windows7-x64
1Princess.C...rr.ps1
windows10-2004-x64
1Princess.C...rm.dll
windows7-x64
1Princess.C...rm.dll
windows10-2004-x64
1Princess.C...19.ttf
windows7-x64
1Princess.C...19.ttf
windows10-2004-x64
1Princess.C...ld.otf
windows7-x64
1Princess.C...ld.otf
windows10-2004-x64
1Princess.C...NS.ttf
windows7-x64
1Princess.C...NS.ttf
windows10-2004-x64
1Princess.C...TG.ttf
windows7-x64
1Princess.C...TG.ttf
windows10-2004-x64
1Princess.C...ar.ttf
windows7-x64
1Princess.C...ar.ttf
windows10-2004-x64
1Princess.C...ar.ttf
windows7-x64
1Princess.C...ar.ttf
windows10-2004-x64
1Princess.C...ngelog
windows7-x64
1Princess.C...ngelog
windows10-2004-x64
1Princess.C...ICENSE
windows7-x64
1Princess.C...ICENSE
windows10-2004-x64
1Princess.C...NSE.en
windows7-x64
1Princess.C...NSE.en
windows10-2004-x64
1Princess.C....mplus
windows7-x64
1Princess.C....mplus
windows10-2004-x64
1Princess.C....mplus
windows7-x64
1Princess.C....mplus
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2022, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
Princess.Conquest.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Princess.Conquest.rar
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Princess.Conquest/IGG-GAMES.COM.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Princess.Conquest/IGG-GAMES.COM.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Princess.Conquest/PCGAMESTORRENTS.COM.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Princess.Conquest/PCGAMESTORRENTS.COM.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Audio/BGM/P&C - Pirate Barrr.ps1
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Audio/BGM/P&C - Pirate Barrr.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Princess.Conquest/Princess & Conquest v0.16.14/CoGenDrm.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Princess.Conquest/Princess & Conquest v0.16.14/CoGenDrm.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/04b19.ttf
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/04b19.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/BebasNeueBold.otf
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/BebasNeueBold.otf
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/MODERNESANS.ttf
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/MODERNESANS.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/TG.ttf
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/TG.ttf
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-Gothic-Regular.ttf
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-Gothic-Regular.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-PGothic-Regular.ttf
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-PGothic-Regular.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/Changelog
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/Changelog
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE.en
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE.en
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_E.mplus
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_E.mplus
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_J.mplus
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_J.mplus
Resource
win10v2004-20220812-en
General
-
Target
Princess.Conquest/IGG-GAMES.COM.url
-
Size
196B
-
MD5
882e17d630d74b64a8176e38e2fadf7f
-
SHA1
d6652d568db451c03b73eede688e0124e2d54ebf
-
SHA256
6d905d76e7d807c5831231d791f2510160dd56018ae423a037e7ac88fd19412f
-
SHA512
2baac743dabdbf133583c4d500699673e0bb2b2ade89f0a660eb17bfb440f1d74814ade3b82eb07d776f6a7c1b1975f25c6c1c500edc589897bc304a9c9fb3b0
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d0786d3a-0256-4797-aa24-21a0971467d3.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221228101327.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2280 msedge.exe 2280 msedge.exe 1128 msedge.exe 1128 msedge.exe 1168 identity_helper.exe 1168 identity_helper.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1128 msedge.exe 1128 msedge.exe 1128 msedge.exe 1128 msedge.exe 1128 msedge.exe 1128 msedge.exe 1128 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1128 msedge.exe 1128 msedge.exe 1128 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1128 1088 rundll32.exe 79 PID 1088 wrote to memory of 1128 1088 rundll32.exe 79 PID 1128 wrote to memory of 764 1128 msedge.exe 81 PID 1128 wrote to memory of 764 1128 msedge.exe 81 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 3624 1128 msedge.exe 84 PID 1128 wrote to memory of 2280 1128 msedge.exe 85 PID 1128 wrote to memory of 2280 1128 msedge.exe 85 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87 PID 1128 wrote to memory of 1344 1128 msedge.exe 87
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Princess.Conquest\IGG-GAMES.COM.url1⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igg-games.com/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9723746f8,0x7ff972374708,0x7ff9723747183⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:23⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:83⤵PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:13⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:13⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4896 /prefetch:83⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:13⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:13⤵PID:2788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:13⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5792 /prefetch:83⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3976 /prefetch:83⤵PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:13⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:13⤵PID:1752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:83⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4340 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff711cb5460,0x7ff711cb5470,0x7ff711cb54804⤵PID:1944
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5884 /prefetch:83⤵PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5536 /prefetch:83⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7156 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,4949574260481725559,14518173813531839252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6060 /prefetch:83⤵PID:4916
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1004
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x418 0x4e41⤵PID:2128