Analysis

  • max time kernel
    580s
  • max time network
    601s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 19:50

General

  • Target

    Office_2013-2024_C2R_Install/OInstall.exe

  • Size

    7.6MB

  • MD5

    0160ee7f90b074e1260437094298a55b

  • SHA1

    79f83fef9915440925e7f87c7ef4db535299aeec

  • SHA256

    cc389c8aeb7a90d81aba8d18ee5e01a9700b6016d58eeb35706c5ac0d95f0b7a

  • SHA512

    5c652937989d2c8453b453724c6582aca7f84f5f4007e096947b532e0ee60ff496d684b284ae7224de18b751d303ea8b1acf9e5419d183030781943db5423e35

  • SSDEEP

    196608:Ea504j1o2h2JdZhzTQIDHeLr9ex044sA+3VOhXbei29w:zqA17YJdZhzEIDQg6ERVsiTi

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\OInstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\OInstall.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\activate.exe
      "C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\activate.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c2Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Windows\SysWOW64\expand.exe
          expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c2Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"
          4⤵
          • Drops file in Windows directory
          PID:3044
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f
          4⤵
          • Creates scheduled task(s)
          PID:4088
    • C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\OInstall1.exe
      "C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\OInstall1.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4148
      • C:\Windows\system32\cmd.exe
        "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\OInstall1.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2944
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\OInstall1.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2236
      • C:\Windows\system32\reg.exe
        "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
        3⤵
          PID:5072
        • C:\Windows\system32\cmd.exe
          "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\files"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2504
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\files"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3944
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          PID:1340
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2840
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CompareReset.jfif" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3180
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
      1⤵
      • Drops file in System32 directory
      PID:3104
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1140
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\EnterEnable.gif
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2976
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\CompareReset.jfif
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:116
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:116 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4232
    • C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\OptimizeSearch.reg"
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:4696
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ResizeSet.xltm"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3004
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RestartGrant.csv"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1000
    • C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe
      C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe "C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"
      1⤵
      • Executes dropped EXE
      PID:1576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      8f3eb06776d4e1dfe1e742cb70e22357

      SHA1

      5ab03e56d3cfe9951e9598dd72ff258065253672

      SHA256

      bdb9f9d35fdac68cfe4a2f615e01d10dc89baec837fe7515b70a6cfedb27d87b

      SHA512

      450c5dccfbe02ac221b9b05b7f1af43ad9c83701120f8134dca66c03c9e20e38fedd76a0e62a47943044ebb00de338fa001ab662481c12ed61902b9f838c6a27

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

      Filesize

      471B

      MD5

      7c352be9a7e962f88ffc9b58fc679e15

      SHA1

      d3a7c5a48b4258fbd2aaac9d4167cac42d093e36

      SHA256

      4972b3053f77f6694d8fe06ed817a4466826adf0af8e74b6a46e35ddbe4ba43a

      SHA512

      f2efbec292d18e618ca22c39506c358c06b1861f0706103aea1274733d26602e3bb7ca216ef5c9c4c89ccf76ab3a6b61fa84f7a186e64267ef7fea49c5c3e30d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      69fe9b744d7fe59153271b1ba99cd1ee

      SHA1

      bb398a844441c106950228e0a1ec4303d0747eec

      SHA256

      13d98a37ac4690c809d86dc1c6aa344f2a0a1af10491c7cad93350512ff601ad

      SHA512

      8e59f38452bce95bb5272ca3236e79c8eeeea3e215d24a9d57577417fd3cfd7a16e4a7640766319275cc54d3084f3c8021b8442fc8f62155ff9e98682b383bc8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

      Filesize

      412B

      MD5

      7273320b02eccf4cd8a40aec38008d3d

      SHA1

      33276b43512652daa81bdd866beea142c29868a5

      SHA256

      211f94b774f7374fd098449f9c48c25fcc4aebd304464aaba531af7ad7697302

      SHA512

      477bfed1334bdb3b788b756a4d5ef6f28678f698e2c1a00fa403b7a37945aa4b8ace34f7066cc807bf077ed4880e903a25171a8d082c014917c2ee6fc9d17fd9

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{25D7DF3F-F519-11EE-ABF1-CA9969386483}.dat

      Filesize

      3KB

      MD5

      a20988307bed066f66a527eb0cda5a41

      SHA1

      3f3bd3e42b4eee88a894fc980cfc085c1c74cdce

      SHA256

      c9dbf8717cbdec2780ef4f592632acc234f18403ae76798e5660844d76c44264

      SHA512

      db670ac98800f84a8c2a703188b78b31d0483fc8326a3bab5c02f5eeb10562387a4d8fca61a22d2392f253a70bb0af1946a48d9ec9abde42a974cea0927c2648

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{25DCA3EE-F519-11EE-ABF1-CA9969386483}.dat

      Filesize

      5KB

      MD5

      a83a32a56f0ebce81b8b125f27864232

      SHA1

      2dfe8162b924f18f68ffbefc8a4c07e08be7a4bc

      SHA256

      3abcf043787d414dd25e57c3635a113b50d8bf464fa91f7d98bd32a0f13515f6

      SHA512

      978c2204a95ccf77a4dca0f4609fa08176d1b81a41a6899783d0fef021ca57e424f696f6af6bd6dd05811d881a4b4ab4dc8143398c7cc9660a3e273714882e0d

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{C974629B-D4B1-11EE-ABE9-62A9A9A84F8B}.dat

      Filesize

      5KB

      MD5

      9e094b62b44fe1557f6a5040611f7d02

      SHA1

      ad4a8f8a1ceb817ad5f5a25e3283fb8daf4b9cfb

      SHA256

      29d7fd72c20eff21c182211b96505e0be84c7218f61dab2ac3184b7fff877752

      SHA512

      8f14b844c25935a11f7768dfa1e6ba934eb86145ea18f6d0466d1cf8e9b1494293f575dbf80eb9b7271b0dad1f04b7749e2eb6dc9d859c917551b9f4a7369ac1

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{25DCA3F2-F519-11EE-ABF1-CA9969386483}.dat

      Filesize

      4KB

      MD5

      76b4dba778942b63b215eecb25a9e666

      SHA1

      0d758b0cbffa5d329164ba67bd4aaef4768c3d54

      SHA256

      1a4d56ddfc7842984c90286f500b60a58c5ab8c131a8da06288a081f164e1cff

      SHA512

      8eaa7ba006b528d019618af0bf314420c5965ea9e3d526ef944e23e363b293f85246c4df385d95358b7280bd1481a7023d81c6a3375b7e44a1655052bc2f63f2

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver7C46.tmp

      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\70FBCE97-368F-40A2-AEDB-ED21793E74D5

      Filesize

      160KB

      MD5

      68591d26ec8e7d380a5e1433445331f4

      SHA1

      c1ec9d4946041c3b64c3f62d551732505922162b

      SHA256

      2ee722bffa8e0856384dcc52775ff7d7ec82ba1eb20ecf5b65b7dfd8909b99fa

      SHA512

      5e8e8d63f13c58d32b059a72b6f7a3c99e9f33bdc500c17e5689244a862f3539edb7960f1f14776ccdf483b9997de607ad1a313cbcfa3232fdfab0993e150d31

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

      Filesize

      323KB

      MD5

      67f36f3c0ac40b3318b0241f929fe06b

      SHA1

      7b9aee92f248b674b974a8469fd0b0ddddf6243d

      SHA256

      59f39c79c6f4ce39372c39f194fea499d0bf1eef2ecb2f2b7a941898fd7200f2

      SHA512

      d58458e054b4c202a887c57b234cdce0913ed83481237700d70ac51412273289d49dcf79c29f06a1b87749020a66a4b7b3a280886ff8ae0c60e5cbc9debef279

    • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

      Filesize

      24KB

      MD5

      8665de22b67e46648a5a147c1ed296ca

      SHA1

      b289a96fee9fa77dd8e045ae8fd161debd376f48

      SHA256

      b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

      SHA512

      bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

      Filesize

      2KB

      MD5

      d2dd03ac0df602a823e95671112e34eb

      SHA1

      8c5b2141114dcbb8803c5f9190632b87a18e1c36

      SHA256

      6a84bf76df017173e58a7ae30c5385e69a8b35f71737b62c16abe22093253a1d

      SHA512

      5f8437c722120ada5b4585e3fb875260dfabfcf5e3d66220bb0e2683ed7fdade6c959f5916079d00541b54ce504859c3cab1e1fdb6df2a04b1995895d659651a

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

      Filesize

      2KB

      MD5

      b09071827226634b930790d58a65bea0

      SHA1

      09b2596e5b3ac413b9dcd78d4ff3cbf2a2de1056

      SHA256

      ca57a374475c90348233201e5b216243447a7060255fae1e7fdb9647546ee821

      SHA512

      9f4063b8c300b53f141b371a494643fc0b3424072a5c119bbb8fa4184367c9e734074dbb790d6d07030b94d671789c5c62422a5b203ec3ae11a3d506d7d8a32c

    • C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\OInstall1.exe

      Filesize

      15.5MB

      MD5

      79b79c931da142894da7ba535f00f624

      SHA1

      43e1ba4454dc112425eec454d46af409c241ee2a

      SHA256

      e20e04ab7f5c5035d49ba6ca27e99b8f6ba85aa9392464dee3a9ebf3ef0dc4fa

      SHA512

      788c7219ff52c563bfd3b3804f7eab96908f218dff1ecb2763e09adcccfe8eb1c73b744de20bd45cde448e7f4adccb5c1902c2d2348e078ec3b0b8491cf751dc

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ap4j4xfm.g0l.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\ver.txt

      Filesize

      56KB

      MD5

      1c51eec57ec7a2dc011f14ac66ba53fa

      SHA1

      7d48217636faf1616c78221b97a665c689b63120

      SHA256

      38fab2d7300ae4542c2dbe24f45fb7f09ca91e8648b2d1261d687bd84bb06167

      SHA512

      958dc900dadaa79d3206ae96e1fb2d9278eafc82cdea2621e1bfd53536261398bae1716291100f98e2a34bfa217526eb802ed65ba98c8d079fc8d70556ba1dad

    • C:\Users\Admin\AppData\Local\Temp\~DFEB027B40F12E8D82.TMP

      Filesize

      20KB

      MD5

      c2a1946ecb70f2138f6bd88c45aff2eb

      SHA1

      8e349688bb9fca4b92c50eb53348100d4383e54b

      SHA256

      ffbef5cfe81c2a449d7f0b72447a141854c945e807e14194c71f94a963b2eead

      SHA512

      ff94dd70bb8927fa391410e8b727d10818917e5f9c849ce2d0cc37d1f06806d867fd3bcfc61f637150efa912a97f351fcbbf6e083cdee37896916683ee403020

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      261B

      MD5

      e9e8ef6d884c4baf8a365c14b16eccd0

      SHA1

      346ba06e3cffd9953611d9dc20b8dcfc7ef98ce4

      SHA256

      bcdbdb546948b87e1ff78b3929ac5bf0d470bea1d2b9e81a44cf3080a4050a8b

      SHA512

      997e14955568ed1f433a00983d59c1b2a7358ae9e6eccde3489f6c67f3bea83d9571175bf3ec424cb0c5a1e53e8c3ef24112a61a09f3d60b7fa1a32edc096bca

    • C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe

      Filesize

      925KB

      MD5

      0adb9b817f1df7807576c2d7068dd931

      SHA1

      4a1b94a9a5113106f40cd8ea724703734d15f118

      SHA256

      98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

      SHA512

      883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

    • C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg

      Filesize

      495KB

      MD5

      b36280ab2514b1772d2058fe14633850

      SHA1

      57b4b40365eb4e26aa9f9125acc9965210776195

      SHA256

      a3b628be13ef3a1f09ab8e4af4f59203e7e721283bd9414f2a35c03abd0ecf46

      SHA512

      7c13c658c2be4430aa7e6fa4a6b6116a91e5cf5c9ce425eb698236193b96d12656d264ce3f19940a17b8a59f7b7e5dfb1ea0c0c9dc381a788c3acf4f8fdfddfa

    • \??\c:\users\admin\appdata\roaming\servicedata\c2gt4h.tmp

      Filesize

      491KB

      MD5

      9533ba8d9930f60f0b6257bdb79b2384

      SHA1

      b0b9dc920e83343784e818dcf4d9607de51118bb

      SHA256

      6a30579a54855ff5899cd73278d61e6b3d69abadc7ffedc6c0e0c3aa03594131

      SHA512

      e86c782b98b28e8eefc03cb703eb2c640d6b748285b76c93f8a892e2427a20de00c7dd4c141e1c38e69b2f78b54f6705e2ae40071aaba0392193fc1a7071259d

    • memory/1000-107-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/1000-140-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/1000-136-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/1000-138-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/1000-109-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/1000-139-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/1000-111-0x00007FFDD7E20000-0x00007FFDD7E30000-memory.dmp

      Filesize

      64KB

    • memory/1000-105-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/1000-103-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/1000-137-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/1340-219-0x0000000006560000-0x000000000657E000-memory.dmp

      Filesize

      120KB

    • memory/1340-207-0x0000000005E80000-0x0000000005EE6000-memory.dmp

      Filesize

      408KB

    • memory/1340-205-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

      Filesize

      64KB

    • memory/1340-204-0x0000000005760000-0x0000000005D88000-memory.dmp

      Filesize

      6.2MB

    • memory/1340-200-0x0000000072940000-0x00000000730F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1340-201-0x0000000002FC0000-0x0000000002FF6000-memory.dmp

      Filesize

      216KB

    • memory/1340-206-0x00000000055E0000-0x0000000005602000-memory.dmp

      Filesize

      136KB

    • memory/1340-203-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

      Filesize

      64KB

    • memory/1340-208-0x0000000005F20000-0x0000000005F86000-memory.dmp

      Filesize

      408KB

    • memory/1340-218-0x00000000060B0000-0x0000000006404000-memory.dmp

      Filesize

      3.3MB

    • memory/1340-220-0x0000000006620000-0x000000000666C000-memory.dmp

      Filesize

      304KB

    • memory/1340-221-0x0000000007DA0000-0x000000000841A000-memory.dmp

      Filesize

      6.5MB

    • memory/1340-222-0x0000000006A90000-0x0000000006AAA000-memory.dmp

      Filesize

      104KB

    • memory/1340-226-0x0000000072940000-0x00000000730F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2840-17-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-12-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-5-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-6-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-7-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-11-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-14-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-13-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-15-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/2840-16-0x0000016134120000-0x0000016134121000-memory.dmp

      Filesize

      4KB

    • memory/3004-172-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-93-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-150-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-151-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-160-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-110-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-89-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/3004-99-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/3004-171-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-106-0x00007FFDD7E20000-0x00007FFDD7E30000-memory.dmp

      Filesize

      64KB

    • memory/3004-101-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-90-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/3004-100-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-95-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/3004-96-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-149-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3004-92-0x00007FFDDA1B0000-0x00007FFDDA1C0000-memory.dmp

      Filesize

      64KB

    • memory/3004-91-0x00007FFE1A130000-0x00007FFE1A325000-memory.dmp

      Filesize

      2.0MB

    • memory/3104-22-0x00000228435A0000-0x00000228435B0000-memory.dmp

      Filesize

      64KB

    • memory/3104-18-0x0000022843560000-0x0000022843570000-memory.dmp

      Filesize

      64KB

    • memory/3104-29-0x000002284C0C0000-0x000002284C0C1000-memory.dmp

      Filesize

      4KB

    • memory/3104-31-0x000002284C140000-0x000002284C141000-memory.dmp

      Filesize

      4KB

    • memory/3104-33-0x000002284C140000-0x000002284C141000-memory.dmp

      Filesize

      4KB

    • memory/3104-34-0x000002284C1D0000-0x000002284C1D1000-memory.dmp

      Filesize

      4KB

    • memory/3104-35-0x000002284C1D0000-0x000002284C1D1000-memory.dmp

      Filesize

      4KB

    • memory/3104-36-0x000002284C1E0000-0x000002284C1E1000-memory.dmp

      Filesize

      4KB

    • memory/3104-37-0x000002284C1E0000-0x000002284C1E1000-memory.dmp

      Filesize

      4KB

    • memory/4372-0-0x00000000161C0000-0x00000000161C1000-memory.dmp

      Filesize

      4KB

    • memory/4372-2-0x0000000000B80000-0x0000000001B80000-memory.dmp

      Filesize

      16.0MB

    • memory/4372-1-0x00000000161D0000-0x00000000161D1000-memory.dmp

      Filesize

      4KB