ramnit | 4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe
Size

124KB
MD5

c6ce21c4c9389a23d6deac23d9d43190
SHA1

36036d346993df07681926111f73891dd8f19846
SHA256

4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2
SHA512

fa90bc5a6d1753ae08ee384c6e7d333da416f166edc4b72b605029a01d636773e728743c86d547413e4a9bcd8ea40ddf3d89588c3aca747d20dd9575f2d2110f

Score

10^/10

ramnit aspackv2 banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ByNC.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\ByNC.exe	aspack_v212_v242
C:\Windows\Temp\ByNC.exe	aspack_v212_v242
C:\Windows\TEMP\ByNC.exe	aspack_v212_v242

Executes dropped EXE 8 IoCs

Processes:

ByNC.exe4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exeEugoqy.exeDesktopLayer.exeByNC.exeEugoqySrv.exeDesktopLayer.exeEugoqy.exe

pid	process
4088	ByNC.exe
5008	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
4368	Eugoqy.exe
4256	DesktopLayer.exe
2296	ByNC.exe
5016	EugoqySrv.exe
3276	DesktopLayer.exe
3340	Eugoqy.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe	upx
behavioral2/memory/4392-135-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/5008-137-0x0000000000400000-0x0000000000435000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe	upx
C:\Program Files (x86)\Eugoqy.exe	upx
C:\Program Files (x86)\Eugoqy.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/5008-144-0x0000000000400000-0x0000000000435000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/4256-149-0x0000000000400000-0x0000000000435000-memory.dmp	upx
C:\Program Files (x86)\EugoqySrv.exe	upx
C:\Program Files (x86)\EugoqySrv.exe	upx
behavioral2/memory/4392-154-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/5016-157-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral2/memory/4368-159-0x0000000000400000-0x000000000042C000-memory.dmp	upx
C:\Program Files (x86)\Eugoqy.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/3340-163-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/3340-201-0x0000000000400000-0x000000000042C000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

ByNC.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation ByNC.exe
Creates a Windows Service
persistence

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	ByNC.exe

Drops file in System32 directory 64 IoCs

Processes:

msedge.exeiexplore.exeEugoqy.exemsedge.exesetup.exemsedge.exeByNC.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe56f84f.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-62CD88CA-108C.pma	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT	msedge.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	Eugoqy.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\d24b9572-545a-463f-b772-e3593f0d6658.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RFe56d093.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\d9bbbf19-fab3-415e-8d04-512345360b19.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\f52bf0c9-755f-4fe7-893c-588bd493b815.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe56f801.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\favicon[2].ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Reporting and NEL	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Cache\index	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOG	msedge.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	Eugoqy.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1DA5A175-01F1-11ED-AD90-7E149D876A3C}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe56c086.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\7cf4bb5c-a644-468b-9759-5aa6e80d3e97.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\lockfile	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\9eff9337-9a15-404c-8976-e81984359174.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL-journal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db-journal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\be6cc789-e8ca-46d6-a14e-91bb4ce9e335.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State	msedge.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k2[1].rar	ByNC.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1	iexplore.exe

Drops file in Program Files directory 64 IoCs

Processes:

ByNC.exeByNC.exe4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	ByNC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	ByNC.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	ByNC.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\java.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	ByNC.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	ByNC.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	ByNC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	ByNC.exe
File created	C:\Program Files (x86)\Eugoqy.exe	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	ByNC.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	ByNC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	ByNC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	ByNC.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	ByNC.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	ByNC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	ByNC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4072830354"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364402037"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4058612073"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30971389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1C129042-01F1-11ED-AD90-7E149D876A3C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4058612073"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30971389"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30971389"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

msedge.exesetup.exeByNC.exeiexplore.exeIEXPLORE.EXEmsedge.exemsedge.exeEugoqy.exeie_to_edge_stub.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\browser.show_home_button = "671B7E5264D12733EE7E8727E8C35F9CDD870321594F725ACD75C5BD917272DC"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithProgids\mhtmlfile = "0"	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ByNC.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Time = e607070002000c000e002c0018006603	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\software_reporter.prompt_version = "771A05E62E9FB8027D2D616366403EE2D97FC9D4C3324D8D00E6577B72F77866"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\homepage = "E58DA92B8F82AAB232C8A6E62AE3BEF8BF71FF6326E94330FE78710FF673CA9F"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\IEMigration\MhtTakenFromIE = "1"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e607070002000c000e002c0018002401	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = a3c96f6a9050d801	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\edge.services.account_id = "476C1A55D4F07D275AEF64CA1C3169D714DEB470522C5DAE9CE60B64868BBF7D"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723_.pdf = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\SmartScreenPuaEnabled\ = "0"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Flags = "1024"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp\OpenWithList	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\settings_reset_prompt.last_triggered_for_homepage = "0E186B0552A50E0D8719BB4934E00FB4058AD5415246E4F8567754E114818C1C"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\state = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e607070002000c000e002c002400ab0300000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Internet Explorer	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\jdiccldimpdaibmpdkjnbmckianbfold = "6D870ACA1EBE0ABB4F1A009885A8C46923DB247E7D63ADECBF1FD91616AD7A0D"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppX90nv6nhay5n6a98fnetv7tpk64pp35es_https = "0"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f27bccc4cc27cc4c8614ac77e94136100000000002000000000010660000000100002000000002142349cd2490edbb49c62b516690c7ae34cfb4824d2875d25009203e183fbe000000000e8000000002000020000000758d95d338ca115277d0d47d8f4cdf62af92125e5d70db7ed908b03fe93cc7c3500000008723af36a64a0107d5222d517a342d555ae314faa65dfcda9ae7a41dba94f0567bb7488131e22de2443523226f373d2062652450e99952a7f771524ab987e7d7644ff648a8f6a6cbc1c6709f0d3412f14000000009d940952e360909415ba7a009936505d828d8c2beb07178be2c02c5b26e8c1faf1f6c5e9b149d86c02fe7f5f67d40a4172168acccd1714f88309486b6824f6a	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364402036"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e607070002000c000e002c002400fc0001000000644ea2ef78b0d01189e400c04fc9e26e	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Eugoqy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice\ProgId = "MSEdgeHTM"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ByNC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice\Hash = "IO/qOmfMb+k="	setup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ie_to_edge_stub.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ie_to_edge_stub.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

DesktopLayer.exeDesktopLayer.exemsedge.exemsedge.exe

pid	process
4256	DesktopLayer.exe
4256	DesktopLayer.exe
4256	DesktopLayer.exe
4256	DesktopLayer.exe
4256	DesktopLayer.exe
4256	DesktopLayer.exe
4256	DesktopLayer.exe
4256	DesktopLayer.exe
3276	DesktopLayer.exe
3276	DesktopLayer.exe
3276	DesktopLayer.exe
3276	DesktopLayer.exe
3276	DesktopLayer.exe
3276	DesktopLayer.exe
3276	DesktopLayer.exe
3276	DesktopLayer.exe
3948	msedge.exe
3948	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

4108 iexplore.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
4236 msedge.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe

pid process

4392 4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe

description pid process

Token: SeDebugPrivilege 4392 4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe

pid	process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

pid	process
4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe

description	pid	process
Token: SeDebugPrivilege	4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exeiexplore.exe

pid	process
4108	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
4108	iexplore.exe
4108	iexplore.exe
4512	iexplore.exe
4512	iexplore.exe
204	IEXPLORE.EXE
204	IEXPLORE.EXE
4732	IEXPLORE.EXE
4732	IEXPLORE.EXE
204	IEXPLORE.EXE
204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exeEugoqy.exeDesktopLayer.exeEugoqySrv.exeDesktopLayer.exeiexplore.exeiexplore.exeIEXPLORE.EXEie_to_edge_stub.exemsedge.exe

description	pid	process	target process
PID 4392 wrote to memory of 4088	4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe	ByNC.exe
PID 4392 wrote to memory of 4088	4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe	ByNC.exe
PID 4392 wrote to memory of 4088	4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe	ByNC.exe
PID 4392 wrote to memory of 5008	4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
PID 4392 wrote to memory of 5008	4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
PID 4392 wrote to memory of 5008	4392	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
PID 5008 wrote to memory of 4256	5008	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe	DesktopLayer.exe
PID 5008 wrote to memory of 4256	5008	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe	DesktopLayer.exe
PID 5008 wrote to memory of 4256	5008	4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe	DesktopLayer.exe
PID 4368 wrote to memory of 2296	4368	Eugoqy.exe	ByNC.exe
PID 4368 wrote to memory of 2296	4368	Eugoqy.exe	ByNC.exe
PID 4368 wrote to memory of 2296	4368	Eugoqy.exe	ByNC.exe
PID 4256 wrote to memory of 4108	4256	DesktopLayer.exe	iexplore.exe
PID 4256 wrote to memory of 4108	4256	DesktopLayer.exe	iexplore.exe
PID 4368 wrote to memory of 5016	4368	Eugoqy.exe	EugoqySrv.exe
PID 4368 wrote to memory of 5016	4368	Eugoqy.exe	EugoqySrv.exe
PID 4368 wrote to memory of 5016	4368	Eugoqy.exe	EugoqySrv.exe
PID 5016 wrote to memory of 3276	5016	EugoqySrv.exe	DesktopLayer.exe
PID 5016 wrote to memory of 3276	5016	EugoqySrv.exe	DesktopLayer.exe
PID 5016 wrote to memory of 3276	5016	EugoqySrv.exe	DesktopLayer.exe
PID 4368 wrote to memory of 3340	4368	Eugoqy.exe	Eugoqy.exe
PID 4368 wrote to memory of 3340	4368	Eugoqy.exe	Eugoqy.exe
PID 4368 wrote to memory of 3340	4368	Eugoqy.exe	Eugoqy.exe
PID 3276 wrote to memory of 4512	3276	DesktopLayer.exe	iexplore.exe
PID 3276 wrote to memory of 4512	3276	DesktopLayer.exe	iexplore.exe
PID 4108 wrote to memory of 204	4108	iexplore.exe	IEXPLORE.EXE
PID 4108 wrote to memory of 204	4108	iexplore.exe	IEXPLORE.EXE
PID 4108 wrote to memory of 204	4108	iexplore.exe	IEXPLORE.EXE
PID 4512 wrote to memory of 4732	4512	iexplore.exe	IEXPLORE.EXE
PID 4512 wrote to memory of 4732	4512	iexplore.exe	IEXPLORE.EXE
PID 4512 wrote to memory of 4732	4512	iexplore.exe	IEXPLORE.EXE
PID 4732 wrote to memory of 832	4732	IEXPLORE.EXE	ie_to_edge_stub.exe
PID 4732 wrote to memory of 832	4732	IEXPLORE.EXE	ie_to_edge_stub.exe
PID 832 wrote to memory of 4236	832	ie_to_edge_stub.exe	msedge.exe
PID 832 wrote to memory of 4236	832	ie_to_edge_stub.exe	msedge.exe
PID 4236 wrote to memory of 3520	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 3520	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe
PID 4236 wrote to memory of 1884	4236	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe
"C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392

C:\Users\Admin\AppData\Local\Temp\ByNC.exe
C:\Users\Admin\AppData\Local\Temp\ByNC.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
PID:4088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\05c231e4.bat" "
3⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4108 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:204

C:\Program Files (x86)\Eugoqy.exe
"C:\Program Files (x86)\Eugoqy.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\TEMP\ByNC.exe
C:\Windows\TEMP\ByNC.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:2296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\05c231e4.bat" "
3⤵
PID:924

C:\Program Files (x86)\EugoqySrv.exe
"C:\Program Files (x86)\EugoqySrv.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3276

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4512 CREDAT:17410 /prefetch:2
5⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1004e
6⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1004e
7⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb552946f8,0x7ffb55294708,0x7ffb55294718
8⤵
- Drops file in System32 directory
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
8⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
8⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
8⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
8⤵
- Modifies data under HKEY_USERS
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
8⤵
- Modifies data under HKEY_USERS
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
8⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
8⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
8⤵
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
8⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
8⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,13891084916255831604,15341809889404410398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
8⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
8⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff687d65460,0x7ff687d65470,0x7ff687d65480
9⤵
PID:5352

C:\Program Files (x86)\Eugoqy.exe
"C:\Program Files (x86)\Eugoqy.exe" Win7
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Eugoqy.exe
Filesize
124KB

MD5
c6ce21c4c9389a23d6deac23d9d43190

SHA1
36036d346993df07681926111f73891dd8f19846

SHA256
4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

SHA512
fa90bc5a6d1753ae08ee384c6e7d333da416f166edc4b72b605029a01d636773e728743c86d547413e4a9bcd8ea40ddf3d89588c3aca747d20dd9575f2d2110f

Download Submit
C:\Program Files (x86)\Eugoqy.exe
Filesize
124KB

MD5
c6ce21c4c9389a23d6deac23d9d43190

SHA1
36036d346993df07681926111f73891dd8f19846

SHA256
4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

SHA512
fa90bc5a6d1753ae08ee384c6e7d333da416f166edc4b72b605029a01d636773e728743c86d547413e4a9bcd8ea40ddf3d89588c3aca747d20dd9575f2d2110f

Download Submit
C:\Program Files (x86)\Eugoqy.exe
Filesize
124KB

MD5
c6ce21c4c9389a23d6deac23d9d43190

SHA1
36036d346993df07681926111f73891dd8f19846

SHA256
4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

SHA512
fa90bc5a6d1753ae08ee384c6e7d333da416f166edc4b72b605029a01d636773e728743c86d547413e4a9bcd8ea40ddf3d89588c3aca747d20dd9575f2d2110f

Download Submit
C:\Program Files (x86)\EugoqySrv.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Program Files (x86)\EugoqySrv.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
31KB

MD5
21a38254c8ec22910e4e9a7727ed0965

SHA1
5b3352ec3cd8a68abfcfef82cdca321fdf5fc551

SHA256
cbb790274944d4fff711ddc5a7a46d34a79fc8c2f473e608f8faa972ada8231b

SHA512
d687f67d478bad7a9c6187a13436190e25a85222276fc8ce2953e59f549266571e0e8d54329fa8cbdd4bb9aa3916364cb6ecb779ddb393c9d456d3f2b4a71fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
f926125f68ade028c2d35d69c2ba8f2f

SHA1
c5a34f75d9788131c87708e527849319b857287f

SHA256
17904874e9f80d18373ea20197df2841b140d6fce600720fa7f3b4ec335c68a4

SHA512
bc6a947542759fd913f84ea6bf457f190331fda1f8266233017eaa473782603e0367ae67698b2cff29b3a247bc1a2e82018412ff5158f8528efa5cddd4841c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
48c1f4ade46db14fa5f3506e96c8d3f9

SHA1
fbc92796ed7bd8a067b112c0f962efc9557f992e

SHA256
a4361231d5cf4bab3d6870c4d807825d84101db6d12dcc212097130b208f8327

SHA512
bab297c56497386fb12fc00c79cb1b73f6ff25c3af4b511afd3248e2d1f0e549bf43a7f1aec5e1d4ff4dc6be2f7aa100d8decb458dac52b45ab0660876f9dbf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\05c231e4.bat
Filesize
183B

MD5
858ffceee1e326e4065268b901f698d2

SHA1
2667c3bf485930ecc975c468d8532614f5abaf9a

SHA256
303b2fdfb80a1368ff691c56d8e42c4f189d662481d8d235af535b1c38224782

SHA512
c2c32ee29fdebd2b2a07915e5282727faa7a9721ee17d18ec622b4ad4da9275a6df23a633d3c103f87f97295cd3ea407c412d3ed478f07240bae02e78ac295dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2Srv.exe
Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ByNC.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ByNC.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Windows\TEMP\05c231e4.bat
Filesize
129B

MD5
7135386de4b82cafb162c1e3c3840ff3

SHA1
2b35a866de05b4a9360c4a7f944e69c0b6ba7085

SHA256
ff1050cecb6b7ca6472930556407d9277de723fc22fd42a0120cadcc10fd6af1

SHA512
e0a25c3f2771b39a543387f8de760acac9160b25bc9028c9f623f0789bcbd8885daaeb619df82ff4feba1e62aa36aa2d237715886204b7bc180fd8e2229ddd2f

Download Submit
C:\Windows\TEMP\ByNC.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Windows\Temp\ByNC.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize
1KB

MD5
8c8793779f737bc2399d1408079dd882

SHA1
1841589ca658d6216673c5022210f942c9872b94

SHA256
d8e66cce178979bcc2dad6f6d8e0265e5297b43804ea9644199d4ac580764bd9

SHA512
928d3cc0f439a9cfacc52f8a0956f8218050483e8859fe910a71412bdef4487fdc931d186f4ea2a2e693f2c46da0f11af2ed3611b8d5037911a66bfb16e71afb

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize
404B

MD5
b01fd412cbcfa6ba15a871da6e58044c

SHA1
e0d5dbc045a178ebec3ef21fee172001d59821e2

SHA256
2307335e493bf0e48286643fa0121dc2ff7bf7e888b217cb81076329485a1aca

SHA512
d33f476f3027caaa5acdb958dfc03e91c4f1e3f6b67beba6a3d9a9ba774b915e34df3023795f71b62eb450559a86a9bf23c03657b23530aa771937845cd61e9f

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
35e56bbe83f8b9b2515e934a84b55de1

SHA1
c6d9394c5c0ccb2bb089a868267ed45cda104af1

SHA256
57a48fb5c3d3f2ef3740ee5786a2d6f161964e21029e3e2412e5b95519169937

SHA512
e0d53237ae3203cd43d6ea5b3e8d4d981fa68d77bf34249743fa49c4968cb25f40e48fe7ba831b3597087445ebe6f9622f5efb1bc6990188decf3b5243fa16ac

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
\??\pipe\LOCAL\crashpad_4236_MOYVYHGMBAOSSEQX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/832-165-0x0000000000000000-mapping.dmp

Download
memory/924-178-0x0000000000000000-mapping.dmp

Download
memory/1100-185-0x0000000000000000-mapping.dmp

Download
memory/1300-192-0x0000000000000000-mapping.dmp

Download
memory/1884-171-0x0000000000000000-mapping.dmp

Download
memory/2296-179-0x0000000000450000-0x0000000000459000-memory.dmp

Filesize
36KB

Download
memory/2296-145-0x0000000000000000-mapping.dmp

Download
memory/2296-156-0x0000000000450000-0x0000000000459000-memory.dmp

Filesize
36KB

Download
memory/2580-196-0x0000000000000000-mapping.dmp

Download
memory/3256-174-0x0000000000000000-mapping.dmp

Download
memory/3276-153-0x0000000000000000-mapping.dmp

Download
memory/3276-164-0x0000000000440000-0x000000000044F000-memory.dmp

Filesize
60KB

Download
memory/3276-186-0x0000000000440000-0x000000000044F000-memory.dmp

Filesize
60KB

Download
memory/3340-163-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3340-201-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3340-155-0x0000000000000000-mapping.dmp

Download
memory/3520-167-0x0000000000000000-mapping.dmp

Download
memory/3948-172-0x0000000000000000-mapping.dmp

Download
memory/4088-176-0x0000000000C10000-0x0000000000C19000-memory.dmp

Filesize
36KB

Download
memory/4088-136-0x0000000000C10000-0x0000000000C19000-memory.dmp

Filesize
36KB

Download
memory/4088-130-0x0000000000000000-mapping.dmp

Download
memory/4148-188-0x0000000000000000-mapping.dmp

Download
memory/4236-166-0x0000000000000000-mapping.dmp

Download
memory/4256-149-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4256-139-0x0000000000000000-mapping.dmp

Download
memory/4360-183-0x0000000000000000-mapping.dmp

Download
memory/4368-159-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4392-190-0x0000000000000000-mapping.dmp

Download
memory/4392-154-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4392-135-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4672-194-0x0000000000000000-mapping.dmp

Download
memory/5008-144-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5008-137-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5008-133-0x0000000000000000-mapping.dmp

Download
memory/5016-157-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5016-150-0x0000000000000000-mapping.dmp

Download
memory/5016-158-0x0000000000480000-0x000000000048F000-memory.dmp

Filesize
60KB

Download
memory/5088-175-0x0000000000000000-mapping.dmp

Download
memory/5300-199-0x0000000000000000-mapping.dmp

Download
memory/5352-200-0x0000000000000000-mapping.dmp

Download