Resubmissions
29/04/2026, 00:18
260429-alq26saz4q1029/04/2026, 00:05
260429-adfapsay9k1028/04/2026, 23:57
260428-3zwtssft5110Analysis
- user interaction
yes - max time kernel
524s - max time network
547s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
29/04/2026, 00:05
General
- Target Standard.Desktop.exe
- Size 107.2MB
- Sample260429-adfapsay9k
- SHA256 d284e1b7ac9d8fec4cac3ce0a920170e2541882623fc8cf4f41cc5bb2c1f85c8
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 14 IoCs
- Loads dropped DLL 53 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 27 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 25 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Standard.Desktop.exe"C:\Users\Admin\AppData\Local\Temp\Standard.Desktop.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.AspNetCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x318,0x7ffbff27c188,0x7ffbff27c194,0x7ffbff27c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,5701882125053248274,1909182379649251635,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,14864892633765899912,1353293366790751467,262144 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,17932837870603333787,17421205161305955688,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5517717606912353751,16425893117230439731,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16646202687739789586,9367888003296628443,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,1391684148821302918,3066573271167369099,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17416942210784979360,6114550736996083972,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6887982538076937666,17692753091814535991,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6887982538076937666,17692753091814535991,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6076,i,13107128620318069835,7946313443705402519,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6404,i,12209649892043160245,9362679597593329940,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,13211551031047483997,3494755562069506699,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,16467020201621082894,16744303404915163568,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:83⤵
-
-
C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe"C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{335BD5C1-6748-473F-BCDA-4ACE2CC86EBD}\.cr\aspnetcore-runtime-8.0.26-win-x64.exe"C:\Windows\Temp\{335BD5C1-6748-473F-BCDA-4ACE2CC86EBD}\.cr\aspnetcore-runtime-8.0.26-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe" -burn.filehandle.attached=716 -burn.filehandle.self=7204⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{ED33960C-F804-40D2-B43B-5B0CC3247B4B}\.be\AspNetCoreSharedFrameworkBundle-x64.exe"C:\Windows\Temp\{ED33960C-F804-40D2-B43B-5B0CC3247B4B}\.be\AspNetCoreSharedFrameworkBundle-x64.exe" -q -burn.elevated BurnPipe.{385C6D39-A08F-4D6E-B5C3-E8DA078C2AB3} {B50B7396-50B9-49D6-8658-A1FB9BFBF4A2} 50605⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,1472257614277008061,9361118049970464451,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,15446429830308328144,15555658104300912740,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,7215459949038211903,10844321211870354150,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,5935357392932327660,14125966290219330178,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,1224242719910659875,13485422700959230273,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15041874160077018188,15646200529985935296,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,5928198907950065880,463645779444639850,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,10754633008133465967,9221200918773335858,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,360823019411397267,9637848226157601897,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5080,i,1963180536972712589,12116288956528177979,262144 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,10034009419652313198,15530848645655021084,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,17735997474752287610,5527464138112432670,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,18149145143535054226,1270341449349397358,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6336,i,11414356421842528069,11530436795534624453,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,13878984333881800751,15237705426678311871,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,14208145573603016378,8098620593749249053,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2724,i,66970647580315143,7877818341556794711,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,872408358870047220,1887601785444094877,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,18127044046137464458,12527700228791800369,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,11492020347102777317,5839486732822035349,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,999839893022001780,1755585420166689589,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5096,i,11731793679471192292,5131575919443234888,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,5400893094161497015,17877991316133700064,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5632,i,9621616080790200390,6298942992957758032,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7060,i,7587086591722389084,596243989219296031,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,7915590762360904290,10073558908634751480,524288 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5060,i,17433875272099818423,13333784841216351923,2097152 --field-trial-handle=2332,i,13742305690530372855,4069901706019945622,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:13⤵
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{363ED945-350D-4C9D-9318-3379AA38E6F7}\.cr\windowsdesktop-runtime-8.0.26-win-x64.exe"C:\Windows\Temp\{363ED945-350D-4C9D-9318-3379AA38E6F7}\.cr\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=7204⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{5CDF5513-D3D2-43F6-8B54-0066BCFC8D48}\.be\windowsdesktop-runtime-8.0.26-win-x64.exe"C:\Windows\Temp\{5CDF5513-D3D2-43F6-8B54-0066BCFC8D48}\.be\windowsdesktop-runtime-8.0.26-win-x64.exe" -q -burn.elevated BurnPipe.{0A5715A4-DDFF-49CF-9B3A-28FB2640CC8C} {73AE35F7-68D3-4C01-9BDF-C362AAA1DB87} 20045⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=1152 -burn.embedded BurnPipe.{F4E81B30-864A-4F5D-A45D-BC0B058D5830} {32F90305-711B-4666-B345-3230EC80413D} 46686⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=568 -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=1152 -burn.embedded BurnPipe.{F4E81B30-864A-4F5D-A45D-BC0B058D5830} {32F90305-711B-4666-B345-3230EC80413D} 46687⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{82448009-A123-4CD0-9024-20F2437C14CC} {70680326-F1E6-464B-B18B-D8EA8C4BFFD3} 47768⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffbff27c188,0x7ffbff27c194,0x7ffbff27c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,4582081241984680195,8463250169365867267,524288 --field-trial-handle=3208,i,613704591391083927,14329021232753170984,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8766951821290353281,16106200875482463409,262144 --field-trial-handle=3208,i,613704591391083927,14329021232753170984,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,5343191542652306874,5150647468457942913,524288 --field-trial-handle=3208,i,613704591391083927,14329021232753170984,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:84⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 84501364F07420432BC520DB0A7B28292⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3390BCAADB7F6CEBD7B3D5A726F572DC2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe"C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe"C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260429010802.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe"C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260429010802.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe"C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" -q -burn.elevated BurnPipe.{F09FC060-36D1-4E9A-8CA9-8E11399C4BAF} {42C0B36A-A97E-48C2-A7AE-ACCC8A34B243} 30844⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Standard.Desktop.exe"C:\Users\Admin\AppData\Local\Temp\Standard.Desktop.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Standard.Desktop.exe"C:\Users\Admin\Desktop\Standard.Desktop.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=8.0.26&arch=x64&rid=win-x64&os=win10&gui=true2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=8.0.26&arch=x64&rid=win-x64&os=win10&gui=true3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 58AC05C49135CD083404C7C136E655712⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CA3012C44E531D72F854C60D0EEF4A962⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 00E87F0887BF9E239AAA6CA672F8EF402⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8ABA85158A3DEEB24B56FA2F2F7902402⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 206604E23C20F95FBBAF4A25148BACA72⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 30B5AD2E0BC028A6313C6E02A282A3612⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D224F5A9CA74C37D55FAA385C4D4D19D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B30286DA9A0394EC1DC3E90437BBFAFB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe"C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe"C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.26_(x64)_20260429011459.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe"C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.26_(x64)_20260429011459.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe"C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" -q -burn.elevated BurnPipe.{45BB739D-92DD-41B1-93C3-FFEA2BBCBDB1} {D99B7224-4F3A-4590-9E07-CE1C5DDB57C9} 57764⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=944 -burn.embedded BurnPipe.{00987715-E270-456F-BAB1-4C7088785595} {0C6E7888-5CDD-49A0-823D-6B5C1BE9E318} 32405⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=944 -burn.embedded BurnPipe.{00987715-E270-456F-BAB1-4C7088785595} {0C6E7888-5CDD-49A0-823D-6B5C1BE9E318} 32406⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{5B7233BA-0195-492C-8D96-5F3AA4E66832} {785CA5C4-D788-48BA-BDF7-CEACFF6410C0} 24367⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\Standard.Desktop.exe"C:\Users\Admin\Desktop\Standard.Desktop.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Standard.Desktop.exe"C:\Users\Admin\Desktop\Standard.Desktop.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
e58b0ff.rbs
e58b103.rbs
e5ed1a9.rbs
e5ed1ae.rbs
e5ed1b3.rbs
e5ed1b8.rbs
e5ed1b9.rbf
e5ed1ba.rbf
e5ed1be.rbs
e5ed1c2.rbs
e5ed1c5.rbs
e5ed2e2.rbs
e5ed2e6.rbs
.version
Microsoft.AspNetCore.Antiforgery.dll
Microsoft.AspNetCore.App.deps.json
Microsoft.AspNetCore.App.runtimeconfig.json
Microsoft.AspNetCore.Authentication.Abstractions.dll
Microsoft.AspNetCore.Authentication.BearerToken.dll
Microsoft.AspNetCore.Authentication.Cookies.dll
Microsoft.AspNetCore.Authentication.Core.dll
Microsoft.AspNetCore.Authentication.OAuth.dll
Microsoft.AspNetCore.Authentication.dll
Microsoft.AspNetCore.Authorization.Policy.dll
Microsoft.AspNetCore.Authorization.dll
Microsoft.AspNetCore.Components.Authorization.dll
Microsoft.AspNetCore.Components.Endpoints.dll
Microsoft.AspNetCore.Components.Forms.dll
Microsoft.AspNetCore.Components.Server.dll
Microsoft.AspNetCore.Components.Web.dll
Microsoft.AspNetCore.Components.dll
Microsoft.AspNetCore.Connections.Abstractions.dll
Microsoft.AspNetCore.CookiePolicy.dll
Microsoft.AspNetCore.Cors.dll
Microsoft.AspNetCore.Cryptography.Internal.dll
Microsoft.AspNetCore.Cryptography.KeyDerivation.dll
Microsoft.AspNetCore.DataProtection.Abstractions.dll
Microsoft.AspNetCore.DataProtection.Extensions.dll
Microsoft.AspNetCore.DataProtection.dll
Microsoft.AspNetCore.Diagnostics.Abstractions.dll
Microsoft.AspNetCore.Diagnostics.HealthChecks.dll
Microsoft.AspNetCore.Diagnostics.dll
Microsoft.AspNetCore.HostFiltering.dll
Microsoft.AspNetCore.Hosting.Abstractions.dll
Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
Microsoft.AspNetCore.Hosting.dll
Microsoft.AspNetCore.Html.Abstractions.dll
Microsoft.AspNetCore.Http.Abstractions.dll
Microsoft.AspNetCore.Http.Connections.Common.dll
Microsoft.AspNetCore.Http.Connections.dll
Microsoft.AspNetCore.Http.Extensions.dll
Microsoft.AspNetCore.Http.Features.dll
Microsoft.AspNetCore.Http.Results.dll
Microsoft.AspNetCore.Http.dll
Microsoft.AspNetCore.HttpLogging.dll
Microsoft.AspNetCore.HttpOverrides.dll
Microsoft.AspNetCore.HttpsPolicy.dll
Microsoft.AspNetCore.Identity.dll
Microsoft.AspNetCore.Localization.Routing.dll
Microsoft.AspNetCore.Localization.dll
Microsoft.AspNetCore.Metadata.dll
Microsoft.AspNetCore.Mvc.Abstractions.dll
Microsoft.AspNetCore.Mvc.ApiExplorer.dll
Microsoft.AspNetCore.Mvc.Core.dll
Microsoft.AspNetCore.Mvc.Cors.dll
Microsoft.AspNetCore.Mvc.DataAnnotations.dll
Microsoft.AspNetCore.Mvc.Formatters.Json.dll
Microsoft.AspNetCore.Mvc.Formatters.Xml.dll
Microsoft.AspNetCore.Mvc.Localization.dll
Microsoft.AspNetCore.Mvc.Razor.dll
Microsoft.AspNetCore.Mvc.RazorPages.dll
Microsoft.AspNetCore.Mvc.TagHelpers.dll
Microsoft.AspNetCore.Mvc.ViewFeatures.dll
Microsoft.AspNetCore.Mvc.dll
Microsoft.AspNetCore.OutputCaching.dll
Microsoft.AspNetCore.RateLimiting.dll
Microsoft.AspNetCore.Razor.Runtime.dll
Microsoft.AspNetCore.Razor.dll
Microsoft.AspNetCore.RequestDecompression.dll
Microsoft.AspNetCore.ResponseCaching.Abstractions.dll
Microsoft.AspNetCore.ResponseCaching.dll
Microsoft.AspNetCore.ResponseCompression.dll
Microsoft.AspNetCore.Rewrite.dll
Microsoft.AspNetCore.Routing.Abstractions.dll
Microsoft.AspNetCore.Routing.dll
Microsoft.AspNetCore.Server.HttpSys.dll
Microsoft.AspNetCore.Server.IIS.dll
Microsoft.AspNetCore.Server.IISIntegration.dll
Microsoft.AspNetCore.Server.Kestrel.Core.dll
Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.dll
Microsoft.AspNetCore.Server.Kestrel.Transport.Quic.dll
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll
Microsoft.AspNetCore.Server.Kestrel.dll
Microsoft.AspNetCore.Session.dll
Microsoft.AspNetCore.SignalR.Common.dll
Microsoft.AspNetCore.SignalR.Core.dll
Microsoft.AspNetCore.SignalR.Protocols.Json.dll
Microsoft.AspNetCore.SignalR.dll
Microsoft.AspNetCore.StaticFiles.dll
Microsoft.AspNetCore.WebSockets.dll
Microsoft.AspNetCore.WebUtilities.dll
Microsoft.AspNetCore.dll
Microsoft.Extensions.Caching.Abstractions.dll
Microsoft.Extensions.Caching.Memory.dll
Microsoft.Extensions.Configuration.Abstractions.dll
Microsoft.Extensions.Configuration.Binder.dll
Microsoft.Extensions.Configuration.CommandLine.dll
Microsoft.Extensions.Configuration.EnvironmentVariables.dll
Microsoft.Extensions.Configuration.FileExtensions.dll
Microsoft.Extensions.Configuration.Ini.dll
Microsoft.Extensions.Configuration.Json.dll
Microsoft.Extensions.Configuration.KeyPerFile.dll
Microsoft.Extensions.Configuration.UserSecrets.dll
Microsoft.Extensions.Configuration.Xml.dll
Microsoft.Extensions.Configuration.dll
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Microsoft.Extensions.DependencyInjection.dll
Microsoft.Extensions.Diagnostics.Abstractions.dll
Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions.dll
Microsoft.Extensions.Diagnostics.HealthChecks.dll
Microsoft.Extensions.Diagnostics.dll
Microsoft.Extensions.Features.dll
Microsoft.Extensions.FileProviders.Abstractions.dll
Microsoft.Extensions.FileProviders.Composite.dll
Microsoft.Extensions.FileProviders.Embedded.dll
Microsoft.Extensions.FileProviders.Physical.dll
Microsoft.Extensions.FileSystemGlobbing.dll
Microsoft.Extensions.Hosting.Abstractions.dll
Microsoft.Extensions.Hosting.dll
Microsoft.Extensions.Http.dll
Microsoft.Extensions.Identity.Core.dll
Microsoft.Extensions.Identity.Stores.dll
Microsoft.Extensions.Localization.Abstractions.dll
Microsoft.Extensions.Localization.dll
Microsoft.Extensions.Logging.Abstractions.dll
Microsoft.Extensions.Logging.Configuration.dll
Microsoft.Extensions.Logging.Console.dll
Microsoft.Extensions.Logging.Debug.dll
Microsoft.Extensions.Logging.EventLog.dll
Microsoft.Extensions.Logging.EventSource.dll
Microsoft.Extensions.Logging.TraceSource.dll
Microsoft.Extensions.Logging.dll
Microsoft.Extensions.ObjectPool.dll
Microsoft.Extensions.Options.ConfigurationExtensions.dll
Microsoft.Extensions.Options.DataAnnotations.dll
Microsoft.Extensions.Options.dll
Microsoft.Extensions.Primitives.dll
Microsoft.Extensions.WebEncoders.dll
Microsoft.JSInterop.dll
Microsoft.Net.Http.Headers.dll
System.Diagnostics.EventLog.Messages.dll
System.Diagnostics.EventLog.dll
System.IO.Pipelines.dll
System.Security.Cryptography.Pkcs.dll
System.Security.Cryptography.Xml.dll
System.Threading.RateLimiting.dll
THIRD-PARTY-NOTICES.txt
aspnetcorev2_inprocess.dll
eula.txt
state.rsm
settings.dat
settings.dat
settings.dat
settings.dat
9c60061f-11a6-4e89-a6b4-ee9d2d25706b.tmp
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000080
f_000081
f_000082
f_000083
the-real-index
the-real-index
the-real-index
data_1
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5b0aab.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe5b61b4.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe5b5b6b.TMP
Ruleset Data
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
dd_dd_AspNetCoreSharedFramework___20260429010802.log
dd_dd_AspNetCoreSharedFramework___20260429010802_000_AspNetCoreSharedFramework_x64.log
messages.json
aspnetcore-runtime-8.0.26-win-x64.exe
MSIB38C.tmp
e5ed1aa.msi
e5ed1ab.msi
e5ed1bf.msi
miniwallet.bundle.js.LICENSE.txt
notification.bundle.js.LICENSE.txt
strings.json
edge_checkout_page_validator.js
aspnetcore-runtime-8.0.26-win-x64.exe
windowsdesktop-runtime-8.0.26-win-x64.exe
thm.xml
thm.wxl
bg.png
thm.wxl
logo.png
wixstdba.dll
AspNetCoreSharedFramework_x64
memory/1684-7195-0x00000000008B0000-0x0000000000926000-memory.dmp
memory/2100-7193-0x00000207CC3E0000-0x00000207CC459000-memory.dmp
memory/2100-7001-0x00000207CBBF0000-0x00000207CBBFC000-memory.dmp
memory/2100-7000-0x00000207CC3E0000-0x00000207CC459000-memory.dmp
memory/2436-7197-0x00000000008B0000-0x0000000000926000-memory.dmp
memory/2944-7183-0x00000000008B0000-0x0000000000926000-memory.dmp
memory/3076-7267-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7235-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7266-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7265-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7264-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7263-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7262-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7261-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7260-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7259-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7257-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7256-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7255-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7254-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7253-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7252-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7251-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7250-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7249-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7248-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7247-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7246-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7245-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7244-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7243-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7241-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7240-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7239-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7236-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7242-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7234-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7233-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7232-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7231-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7230-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7229-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7228-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7227-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7226-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7222-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7220-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7258-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7219-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7237-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7225-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7224-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7223-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7221-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7238-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/3076-7216-0x0000021A008B0000-0x0000021A00940000-memory.dmp
memory/4776-7187-0x00000000008B0000-0x0000000000926000-memory.dmp
memory/4964-5506-0x00000204A0920000-0x00000204A0999000-memory.dmp
memory/4964-5507-0x00000204A1380000-0x00000204A138C000-memory.dmp
memory/4964-4261-0x00000204A0920000-0x00000204A0999000-memory.dmp
memory/4964-999-0x00000204A0920000-0x00000204A0999000-memory.dmp
memory/4964-1000-0x00000204A1380000-0x00000204A138C000-memory.dmp
memory/5592-7189-0x00000000008B0000-0x0000000000926000-memory.dmp
memory/6064-7198-0x00000000008B0000-0x0000000000926000-memory.dmp