Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1794s -
max time network
1693s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
Screenshot 2024-01-08 083359.png
Resource
win10v2004-20231222-en
windows10-2004-x64
9 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Screenshot 2024-01-08 083359.png
Resource
macos-20231201-en
macos-10.15-amd64
0 signatures
1800 seconds
General
-
Target
Screenshot 2024-01-08 083359.png
-
Size
2KB
-
MD5
9537cd809a802833fbb7a18dd333521c
-
SHA1
1ab10cfa1af3e225394e89ccefbac10c2371c14d
-
SHA256
c07c53ad2e1715e390cac432ac15c5d2e4c209a77c60af24889f572ebbcc242d
-
SHA512
dc266a38525982cd3a27cdf26942cf8569013fb53301271c2ba688d0fa85501744151cb75267c71ab32ed512d098680dc8795c1cdcbec9bc5b454fc0b911f92c
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133491963821378488" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 1688 msedge.exe 1688 msedge.exe 2204 chrome.exe 2204 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3800 5048 chrome.exe 96 PID 5048 wrote to memory of 3800 5048 chrome.exe 96 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 1468 5048 chrome.exe 104 PID 5048 wrote to memory of 5108 5048 chrome.exe 103 PID 5048 wrote to memory of 5108 5048 chrome.exe 103 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102 PID 5048 wrote to memory of 3796 5048 chrome.exe 102
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-01-08 083359.png"1⤵PID:1748
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7fff92d59758,0x7fff92d59768,0x7fff92d597781⤵PID:3800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:12⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:12⤵PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:22⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4612 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:12⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4872 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5092 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2620 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1128 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:12⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3008 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4036 --field-trial-handle=1884,i,2987846534643625422,2128571588451583020,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4008
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe d41d9d52ba0969a3a9d5383e9cfe758c jsqKvWr9W0iKZ6YwbVMbhg.0.1.0.0.01⤵PID:1512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:2288
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulte149dd63h1383h41e9haf25h95734663974f1⤵PID:6036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff909b46f8,0x7fff909b4708,0x7fff909b47182⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,1369612510551123627,3540938711164506990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,1369612510551123627,3540938711164506990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,1369612510551123627,3540938711164506990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵PID:5068
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:5348