Overview
overview
6Static
static
Princess.Conquest.rar
windows7-x64
3Princess.Conquest.rar
windows10-2004-x64
3Princess.C...OM.url
windows7-x64
6Princess.C...OM.url
windows10-2004-x64
6Princess.C...OM.url
windows7-x64
6Princess.C...OM.url
windows10-2004-x64
6Princess.C...rr.ps1
windows7-x64
1Princess.C...rr.ps1
windows10-2004-x64
1Princess.C...rm.dll
windows7-x64
1Princess.C...rm.dll
windows10-2004-x64
1Princess.C...19.ttf
windows7-x64
1Princess.C...19.ttf
windows10-2004-x64
1Princess.C...ld.otf
windows7-x64
1Princess.C...ld.otf
windows10-2004-x64
1Princess.C...NS.ttf
windows7-x64
1Princess.C...NS.ttf
windows10-2004-x64
1Princess.C...TG.ttf
windows7-x64
1Princess.C...TG.ttf
windows10-2004-x64
1Princess.C...ar.ttf
windows7-x64
1Princess.C...ar.ttf
windows10-2004-x64
1Princess.C...ar.ttf
windows7-x64
1Princess.C...ar.ttf
windows10-2004-x64
1Princess.C...ngelog
windows7-x64
1Princess.C...ngelog
windows10-2004-x64
1Princess.C...ICENSE
windows7-x64
1Princess.C...ICENSE
windows10-2004-x64
1Princess.C...NSE.en
windows7-x64
1Princess.C...NSE.en
windows10-2004-x64
1Princess.C....mplus
windows7-x64
1Princess.C....mplus
windows10-2004-x64
1Princess.C....mplus
windows7-x64
1Princess.C....mplus
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
226s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2022, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
Princess.Conquest.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Princess.Conquest.rar
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Princess.Conquest/IGG-GAMES.COM.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Princess.Conquest/IGG-GAMES.COM.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Princess.Conquest/PCGAMESTORRENTS.COM.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Princess.Conquest/PCGAMESTORRENTS.COM.url
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Audio/BGM/P&C - Pirate Barrr.ps1
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Audio/BGM/P&C - Pirate Barrr.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Princess.Conquest/Princess & Conquest v0.16.14/CoGenDrm.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Princess.Conquest/Princess & Conquest v0.16.14/CoGenDrm.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/04b19.ttf
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/04b19.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/BebasNeueBold.otf
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/BebasNeueBold.otf
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/MODERNESANS.ttf
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/MODERNESANS.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/TG.ttf
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/TG.ttf
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-Gothic-Regular.ttf
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-Gothic-Regular.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-PGothic-Regular.ttf
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VL-PGothic-Regular.ttf
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/Changelog
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/Changelog
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE.en
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE.en
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_E.mplus
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_E.mplus
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_J.mplus
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
Princess.Conquest/Princess & Conquest v0.16.14/Fonts/VLGothic/LICENSE_J.mplus
Resource
win10v2004-20220812-en
General
-
Target
Princess.Conquest/PCGAMESTORRENTS.COM.url
-
Size
202B
-
MD5
420715a04de8367bb8d37d57ce1d6d41
-
SHA1
710369a636391e43be7149416d8e9b390863babb
-
SHA256
c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23
-
SHA512
8737cec4730f412c18e508076d9fb7af2ab10b4b1637c70c2f76c1c6ca7bca27021cbe56dc3305a4ea7704f7ac2c6e005d02c605a4e7f9b0a709bb94cfc7f457
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\37647d6f-a9f4-4220-af04-a8ec4f3eda13.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221228101156.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4900 msedge.exe 4900 msedge.exe 176 msedge.exe 176 msedge.exe 3544 identity_helper.exe 3544 identity_helper.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe 3864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 176 msedge.exe 176 msedge.exe 176 msedge.exe 176 msedge.exe 176 msedge.exe 176 msedge.exe 176 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 176 msedge.exe 176 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 176 4468 rundll32.exe 85 PID 4468 wrote to memory of 176 4468 rundll32.exe 85 PID 176 wrote to memory of 2060 176 msedge.exe 87 PID 176 wrote to memory of 2060 176 msedge.exe 87 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 3664 176 msedge.exe 91 PID 176 wrote to memory of 4900 176 msedge.exe 92 PID 176 wrote to memory of 4900 176 msedge.exe 92 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93 PID 176 wrote to memory of 3524 176 msedge.exe 93
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Princess.Conquest\PCGAMESTORRENTS.COM.url1⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pcgamestorrents.com/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:176 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd777b46f8,0x7ffd777b4708,0x7ffd777b47183⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:83⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:13⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:13⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5464 /prefetch:83⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:13⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:13⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:13⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6788 /prefetch:83⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:13⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:13⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:83⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4652 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff7a6975460,0x7ff7a6975470,0x7ff7a69754804⤵PID:4476
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6000 /prefetch:83⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6688 /prefetch:83⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2888 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2160,7012283535110577286,9310023977452729284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:83⤵PID:2612
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4020