Windows Analysis Report divpCHa0h7.exe

Overview

General Information

Sample Name: divpCHa0h7.exe
Analysis ID: 502315
MD5: fda0d823b262ac2b1bd76a2053c29692
SHA1: 73f72d7c987d44d1f236c138c5617b527c5ba340
SHA256: 91a166f9a29ad832c9640078210a47e5afa928ab1a79a7b40d3b358e9c8bc5d5
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Self deletion via cmd delete
.NET source code contains potential unpacker
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.esyscoloradosprings.com/fqiq/"], "decoy": ["driventow.com", "ipatchwork.today", "bolder.equipment", "seal-brother.com", "mountlaketerraceapartments.com", "weeden.xyz", "sanlifalan.com", "athafood.com", "isshinn1.com", "creationslazzaroni.com", "eclecticrenaissancewoman.com", "satellitephonstore.com", "cotchildcare.com", "yamacorp.digital", "ff4cuno43.xyz", "quicksticks.community", "govindfinance.com", "farmersfirstseed.com", "megacinema.club", "tablescaperendezvous4two.com", "ecarehomes.com", "floaterslaser.com", "benisano.com", "saint444.com", "thedusi.com", "avafxtrade.online", "hanenosuke.com", "suntioil4u.com", "healthyweekendtips.com", "24000words.com", "ofbchina.net", "begukiu0.info", "wolmoda.com", "mask60.com", "4bellemaison.com", "mambacustomboats.com", "sedsn.com", "doggycc.com", "kangrungao.com", "pharmacistcharisma.com", "passiverewardssystems.com", "qywyfeo8.xyz", "shenjiclass.com", "rdoi.top", "lavishbynovell.com", "fleetton.com", "hillcresthomegroup.com", "hartfulcleaning.com", "srofkansas.com", "applebroog.industries", "phillytrainers.com", "dmc--llc.com", "sosoon.store", "daysyou.com", "controldatasa.com", "markarge.com", "hirayaawards.com", "clinicscluster.com", "sophiagunterman.art", "kirtansangeet.com", "residential.insure", "ribbonofficial.com", "qianhaijcc.com", "fytvankin.quest"]}
Multi AV Scanner detection for submitted file
Source: divpCHa0h7.exe Virustotal: Detection: 16% Perma Link
Source: divpCHa0h7.exe ReversingLabs: Detection: 17%
Yara detected FormBook
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.divpCHa0h7.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.1.divpCHa0h7.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: divpCHa0h7.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: divpCHa0h7.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: msdt.pdbGCTL source: divpCHa0h7.exe, 00000005.00000002.364340178.0000000002E40000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: divpCHa0h7.exe, 00000005.00000002.362382961.0000000000EF0000.00000040.00000001.sdmp, msdt.exe, 0000000F.00000002.521663389.0000000004BBF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: divpCHa0h7.exe, msdt.exe
Source: Binary string: msdt.pdb source: divpCHa0h7.exe, 00000005.00000002.364340178.0000000002E40000.00000040.00020000.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 4x nop then pop ebx 5_2_00406AB9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 4x nop then pop ebx 15_2_02766AB9

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49768 -> 104.165.34.6:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49768 -> 104.165.34.6:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49768 -> 104.165.34.6:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49789 -> 108.167.135.122:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49789 -> 108.167.135.122:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49789 -> 108.167.135.122:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49812 -> 8.212.24.67:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49812 -> 8.212.24.67:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49812 -> 8.212.24.67:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 81.169.145.161 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mambacustomboats.com
Source: C:\Windows\explorer.exe Domain query: www.sanlifalan.com
Source: C:\Windows\explorer.exe Domain query: www.esyscoloradosprings.com
Source: C:\Windows\explorer.exe Network Connect: 104.165.34.6 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 108.167.135.122 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 64.190.62.111 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.ribbonofficial.com
Source: C:\Windows\explorer.exe Domain query: www.floaterslaser.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.esyscoloradosprings.com/fqiq/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /fqiq/?z0DH=f0Dtar1PYnAdDzS&ZvEd=MhZqZeIh1bEx9EPhBOs++VNt6zdxCxYLlsX+VD+R30361cyojbkVOC5VQe1OoxOfJLYr HTTP/1.1Host: www.ribbonofficial.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?ZvEd=prTEVkQtidVRbelnknUsCYHPcHrUQSHWronmvObfBYwGPcpLSCQwPhh2tosJT24FW2ZT&z0DH=f0Dtar1PYnAdDzS HTTP/1.1Host: www.sanlifalan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?z0DH=f0Dtar1PYnAdDzS&ZvEd=cd5R1bQkGt60ucaw3I3E0k/wUnqrUWXrQueIKe7m3jIZGD6slZfTAntz2qvR4Gb0BO+l HTTP/1.1Host: www.floaterslaser.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?ZvEd=oM7C4s4K9Ux9NUwG97tedYlymorHgm5Kv3Umj1Gnv/i5ubiDMWU/+XDfdu3U3Pyuil7R&z0DH=f0Dtar1PYnAdDzS HTTP/1.1Host: www.mambacustomboats.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?ZvEd=KZhYdxsAX/C25xiOpksKfhNe7DL7yKRLCy2J/73TfqSfqYhWOiYMofna8My9QnEOoaqj&z0DH=f0Dtar1PYnAdDzS HTTP/1.1Host: www.esyscoloradosprings.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 13 Oct 2021 17:47:34 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: 216X-Sorting-Hat-ShopId: 59389116584X-Dc: gcp-europe-west1X-Request-ID: cecbddb8-e852-4c90-927e-af3e5555f963X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 69da64d2c8f74303-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css">
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Oct 2021 17:47:45 GMTServer: Apache/2.4.51 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 884Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 56 69 72 75 73 2f 53 70 79 77 61 72 65 20 44 6f 77 6e 6c 6f 61 64 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 50 52 41 47 4d 41 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 2d 43 41 43 48 45 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 23 63 6f 6e 74 65 6e 74 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 23 61 61 61 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 31 2e 35 65 6d 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 31 2e 35 65 6d 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 0d 0a 20 20 7d 0d 0a 20 20 68 31 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 65 6d 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 31 39 36 33 39 30 3b 0d 0a 20 20 7d 0d 0a 20 20 62 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 31 39 36 33 39 30 3b 0d 0a 20 20 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 3c 68 31 3e 56 69 72 75 73 2f 53 70 79 77 61 72 65 20 44 6f 77 6e 6c 6f 61 64 20 42 6c 6f 63 6b 65 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 6f 77 6e 6c 6f 61 64 20 6f 66 20 74 68 65 20 76 69 72 75 73 2f 73 70 79 77 61 72 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 63 6f 6d 70 61 6e 79 20 70 6f 6c 69 63 79 2e 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 69 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 69 6e 20 65 72 72 6f 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 3c 62 3e 46 69 6c 65 20 6e 61 6d 65 3a 3c 2f 62 3e 20 20 3c 2f 70 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Virus/Spyware Download Bloc
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: divpCHa0h7.exe, 00000001.00000003.266066263.00000000059E0000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comasno
Source: divpCHa0h7.exe, 00000001.00000003.246781947.00000000059FB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: divpCHa0h7.exe, 00000001.00000003.246654381.00000000059FB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comX
Source: divpCHa0h7.exe, 00000001.00000003.246591944.00000000059FB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comn
Source: divpCHa0h7.exe, 00000001.00000003.248765539.0000000005A1D000.00000004.00000001.sdmp, divpCHa0h7.exe, 00000001.00000003.249127036.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: divpCHa0h7.exe, 00000001.00000003.249127036.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/c
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: divpCHa0h7.exe, 00000001.00000003.248765539.0000000005A1D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn_
Source: divpCHa0h7.exe, 00000001.00000003.248765539.0000000005A1D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cna-d
Source: divpCHa0h7.exe, 00000001.00000003.248804655.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnl
Source: divpCHa0h7.exe, 00000001.00000003.248765539.0000000005A1D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnr-f
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/.
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/CursJ
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Gras
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0zS
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/a-e7
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/o
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ri
Source: divpCHa0h7.exe, 00000001.00000003.250361250.00000000059E4000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: divpCHa0h7.exe, 00000001.00000003.246488006.00000000059FB000.00000004.00000001.sdmp, divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: divpCHa0h7.exe, 00000001.00000003.246488006.00000000059FB000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.coma-d
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: divpCHa0h7.exe, 00000001.00000003.247974313.00000000059E6000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: divpCHa0h7.exe, 00000001.00000002.270330222.0000000006C82000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: unknown DNS traffic detected: queries for: www.ribbonofficial.com
Source: global traffic HTTP traffic detected: GET /fqiq/?z0DH=f0Dtar1PYnAdDzS&ZvEd=MhZqZeIh1bEx9EPhBOs++VNt6zdxCxYLlsX+VD+R30361cyojbkVOC5VQe1OoxOfJLYr HTTP/1.1Host: www.ribbonofficial.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?ZvEd=prTEVkQtidVRbelnknUsCYHPcHrUQSHWronmvObfBYwGPcpLSCQwPhh2tosJT24FW2ZT&z0DH=f0Dtar1PYnAdDzS HTTP/1.1Host: www.sanlifalan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?z0DH=f0Dtar1PYnAdDzS&ZvEd=cd5R1bQkGt60ucaw3I3E0k/wUnqrUWXrQueIKe7m3jIZGD6slZfTAntz2qvR4Gb0BO+l HTTP/1.1Host: www.floaterslaser.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?ZvEd=oM7C4s4K9Ux9NUwG97tedYlymorHgm5Kv3Umj1Gnv/i5ubiDMWU/+XDfdu3U3Pyuil7R&z0DH=f0Dtar1PYnAdDzS HTTP/1.1Host: www.mambacustomboats.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fqiq/?ZvEd=KZhYdxsAX/C25xiOpksKfhNe7DL7yKRLCy2J/73TfqSfqYhWOiYMofna8My9QnEOoaqj&z0DH=f0Dtar1PYnAdDzS HTTP/1.1Host: www.esyscoloradosprings.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: divpCHa0h7.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 1_2_0106D064 1_2_0106D064
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 1_2_0106F296 1_2_0106F296
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 1_2_0106F298 1_2_0106F298
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 1_2_04F90D51 1_2_04F90D51
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 1_2_04F95A10 1_2_04F95A10
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0040102D 5_2_0040102D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041B8D3 5_2_0041B8D3
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041B8D6 5_2_0041B8D6
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041C98B 5_2_0041C98B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041C343 5_2_0041C343
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00408C8B 5_2_00408C8B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00408C90 5_2_00408C90
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00402D8C 5_2_00402D8C
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2B090 5_2_00F2B090
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1002 5_2_00FD1002
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F34120 5_2_00F34120
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1F900 5_2_00F1F900
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4EBB0 5_2_00F4EBB0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2841F 5_2_00F2841F
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2D5E0 5_2_00F2D5E0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE1D55 5_2_00FE1D55
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F10D20 5_2_00F10D20
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF20A0 15_2_04AF20A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADB090 15_2_04ADB090
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD841F 15_2_04AD841F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81002 15_2_04B81002
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2581 15_2_04AF2581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADD5E0 15_2_04ADD5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC0D20 15_2_04AC0D20
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE4120 15_2_04AE4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACF900 15_2_04ACF900
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B91D55 15_2_04B91D55
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE6E30 15_2_04AE6E30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFEBB0 15_2_04AFEBB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277C343 15_2_0277C343
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277B8D6 15_2_0277B8D6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277B8D3 15_2_0277B8D3
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277C98B 15_2_0277C98B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_02762FB0 15_2_02762FB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_02768C90 15_2_02768C90
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_02768C8B 15_2_02768C8B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_02762D90 15_2_02762D90
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_02762D8C 15_2_02762D8C
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\msdt.exe Code function: String function: 04ACB150 appears 35 times
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: String function: 00F1B150 appears 31 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_004185F0 NtCreateFile, 5_2_004185F0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_004186A0 NtReadFile, 5_2_004186A0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00418720 NtClose, 5_2_00418720
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_004187D0 NtAllocateVirtualMemory, 5_2_004187D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_004185EB NtCreateFile, 5_2_004185EB
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041871A NtClose, 5_2_0041871A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_004187CA NtAllocateVirtualMemory, 5_2_004187CA
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F598F0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_00F598F0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59860 NtQuerySystemInformation,LdrInitializeThunk, 5_2_00F59860
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59840 NtDelayExecution,LdrInitializeThunk, 5_2_00F59840
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F599A0 NtCreateSection,LdrInitializeThunk, 5_2_00F599A0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59910 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_00F59910
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59A50 NtCreateFile,LdrInitializeThunk, 5_2_00F59A50
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59A20 NtResumeThread,LdrInitializeThunk, 5_2_00F59A20
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59A00 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_00F59A00
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F595D0 NtClose,LdrInitializeThunk, 5_2_00F595D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59540 NtReadFile,LdrInitializeThunk, 5_2_00F59540
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F596E0 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_00F596E0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59660 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_00F59660
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59FE0 NtCreateMutant,LdrInitializeThunk, 5_2_00F59FE0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F597A0 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_00F597A0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59780 NtMapViewOfSection,LdrInitializeThunk, 5_2_00F59780
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59710 NtQueryInformationToken,LdrInitializeThunk, 5_2_00F59710
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F598A0 NtWriteVirtualMemory, 5_2_00F598A0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F5B040 NtSuspendThread, 5_2_00F5B040
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59820 NtEnumerateKey, 5_2_00F59820
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F599D0 NtCreateProcessEx, 5_2_00F599D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59950 NtQueueApcThread, 5_2_00F59950
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59A80 NtOpenDirectoryObject, 5_2_00F59A80
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59A10 NtQuerySection, 5_2_00F59A10
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F5A3B0 NtGetContextThread, 5_2_00F5A3B0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59B00 NtSetValueKey, 5_2_00F59B00
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F595F0 NtQueryInformationFile, 5_2_00F595F0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59560 NtWriteFile, 5_2_00F59560
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F5AD30 NtSetContextThread, 5_2_00F5AD30
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F59520 NtWaitForSingleObject, 5_2_00F59520
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F596D0 NtCreateKey, 5_2_00F596D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09860 NtQuerySystemInformation,LdrInitializeThunk, 15_2_04B09860
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09840 NtDelayExecution,LdrInitializeThunk, 15_2_04B09840
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B099A0 NtCreateSection,LdrInitializeThunk, 15_2_04B099A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B095D0 NtClose,LdrInitializeThunk, 15_2_04B095D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09910 NtAdjustPrivilegesToken,LdrInitializeThunk, 15_2_04B09910
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09540 NtReadFile,LdrInitializeThunk, 15_2_04B09540
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B096E0 NtFreeVirtualMemory,LdrInitializeThunk, 15_2_04B096E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B096D0 NtCreateKey,LdrInitializeThunk, 15_2_04B096D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09660 NtAllocateVirtualMemory,LdrInitializeThunk, 15_2_04B09660
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09650 NtQueryValueKey,LdrInitializeThunk, 15_2_04B09650
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09A50 NtCreateFile,LdrInitializeThunk, 15_2_04B09A50
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09780 NtMapViewOfSection,LdrInitializeThunk, 15_2_04B09780
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09FE0 NtCreateMutant,LdrInitializeThunk, 15_2_04B09FE0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09710 NtQueryInformationToken,LdrInitializeThunk, 15_2_04B09710
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B098A0 NtWriteVirtualMemory, 15_2_04B098A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B098F0 NtReadVirtualMemory, 15_2_04B098F0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09820 NtEnumerateKey, 15_2_04B09820
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B0B040 NtSuspendThread, 15_2_04B0B040
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B095F0 NtQueryInformationFile, 15_2_04B095F0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B099D0 NtCreateProcessEx, 15_2_04B099D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B0AD30 NtSetContextThread, 15_2_04B0AD30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09520 NtWaitForSingleObject, 15_2_04B09520
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09560 NtWriteFile, 15_2_04B09560
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09950 NtQueueApcThread, 15_2_04B09950
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09A80 NtOpenDirectoryObject, 15_2_04B09A80
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09A20 NtResumeThread, 15_2_04B09A20
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09610 NtEnumerateValueKey, 15_2_04B09610
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09A10 NtQuerySection, 15_2_04B09A10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09A00 NtProtectVirtualMemory, 15_2_04B09A00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09670 NtQueryInformationProcess, 15_2_04B09670
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B0A3B0 NtGetContextThread, 15_2_04B0A3B0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B097A0 NtUnmapViewOfSection, 15_2_04B097A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09730 NtQueryVirtualMemory, 15_2_04B09730
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B0A710 NtOpenProcessToken, 15_2_04B0A710
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09B00 NtSetValueKey, 15_2_04B09B00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09770 NtSetInformationFile, 15_2_04B09770
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B0A770 NtOpenThread, 15_2_04B0A770
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B09760 NtOpenProcess, 15_2_04B09760
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_027786A0 NtReadFile, 15_2_027786A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_02778720 NtClose, 15_2_02778720
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_027787D0 NtAllocateVirtualMemory, 15_2_027787D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_027785F0 NtCreateFile, 15_2_027785F0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277871A NtClose, 15_2_0277871A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_027787CA NtAllocateVirtualMemory, 15_2_027787CA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_027785EB NtCreateFile, 15_2_027785EB
Sample file is different than original file name gathered from version info
Source: divpCHa0h7.exe Binary or memory string: OriginalFilename vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000001.00000000.243614905.0000000000692000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDateTimeFormatFla.exe6 vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000001.00000002.271111819.00000000071F0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dll< vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp Binary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs divpCHa0h7.exe
Source: divpCHa0h7.exe Binary or memory string: OriginalFilename vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000003.00000000.261988052.0000000000142000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDateTimeFormatFla.exe6 vs divpCHa0h7.exe
Source: divpCHa0h7.exe Binary or memory string: OriginalFilename vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000004.00000000.263958502.00000000003A2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDateTimeFormatFla.exe6 vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000005.00000002.364340178.0000000002E40000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamemsdt.exej% vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000005.00000000.264881846.0000000000402000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDateTimeFormatFla.exe6 vs divpCHa0h7.exe
Source: divpCHa0h7.exe, 00000005.00000002.363189581.000000000100F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs divpCHa0h7.exe
Source: divpCHa0h7.exe Binary or memory string: OriginalFilenameDateTimeFormatFla.exe6 vs divpCHa0h7.exe
PE file contains strange resources
Source: divpCHa0h7.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: divpCHa0h7.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: divpCHa0h7.exe Virustotal: Detection: 16%
Source: divpCHa0h7.exe ReversingLabs: Detection: 17%
Source: divpCHa0h7.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\divpCHa0h7.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\divpCHa0h7.exe 'C:\Users\user\Desktop\divpCHa0h7.exe'
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\divpCHa0h7.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\divpCHa0h7.exe' Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe File created: C:\Users\user\AppData\Local\Gottschalks Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@12/1@8/5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: divpCHa0h7.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: divpCHa0h7.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: msdt.pdbGCTL source: divpCHa0h7.exe, 00000005.00000002.364340178.0000000002E40000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: divpCHa0h7.exe, 00000005.00000002.362382961.0000000000EF0000.00000040.00000001.sdmp, msdt.exe, 0000000F.00000002.521663389.0000000004BBF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: divpCHa0h7.exe, msdt.exe
Source: Binary string: msdt.pdb source: divpCHa0h7.exe, 00000005.00000002.364340178.0000000002E40000.00000040.00020000.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Unpacked PE file: 5.2.divpCHa0h7.exe.400000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs .text:ER;
.NET source code contains potential unpacker
Source: divpCHa0h7.exe, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.0.divpCHa0h7.exe.690000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.2.divpCHa0h7.exe.690000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 3.0.divpCHa0h7.exe.140000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 3.2.divpCHa0h7.exe.140000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.divpCHa0h7.exe.3a0000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.2.divpCHa0h7.exe.3a0000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 5.0.divpCHa0h7.exe.400000.0.unpack, MapEditor1/CreateMapDialog.cs .Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 1_2_006971C7 push 00000014h; iretd 1_2_006973C0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 1_2_0106203B push ebx; retf 1_2_0106207A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 3_2_001471C7 push 00000014h; iretd 3_2_001473C0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 4_2_003A71C7 push 00000014h; iretd 4_2_003A73C0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041B832 push eax; ret 5_2_0041B838
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041B83B push eax; ret 5_2_0041B8A2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041B89C push eax; ret 5_2_0041B8A2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_0041B7E5 push eax; ret 5_2_0041B838
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F6D0D1 push ecx; ret 5_2_00F6D0E4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B1D0D1 push ecx; ret 15_2_04B1D0E4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277B832 push eax; ret 15_2_0277B838
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277B83B push eax; ret 15_2_0277B8A2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277B89C push eax; ret 15_2_0277B8A2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_0277B7E5 push eax; ret 15_2_0277B838
Source: initial sample Static PE information: section name: .text entropy: 7.77424395601

Hooking and other Techniques for Hiding and Protection:

barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\msdt.exe Process created: /c del 'C:\Users\user\Desktop\divpCHa0h7.exe'
Source: C:\Windows\SysWOW64\msdt.exe Process created: /c del 'C:\Users\user\Desktop\divpCHa0h7.exe' Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 1.2.divpCHa0h7.exe.2b01658.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: divpCHa0h7.exe PID: 3240, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\divpCHa0h7.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\divpCHa0h7.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000002768614 second address: 000000000276861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 00000000027689AE second address: 00000000027689B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\divpCHa0h7.exe TID: 2540 Thread sleep time: -30091s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe TID: 2840 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 5240 Thread sleep time: -35000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\msdt.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_004088E0 rdtsc 5_2_004088E0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Thread delayed: delay time: 30091 Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000006.00000000.294005311.000000000891C000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.294005311.000000000891C000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.304751449.0000000003767000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000006.00000000.301545484.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000006.00000000.294080069.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000006.00000000.305488010.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000006.00000000.294080069.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: divpCHa0h7.exe, 00000001.00000002.267439269.0000000002AB1000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_004088E0 rdtsc 5_2_004088E0
Enables debug privileges
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAB8D0 mov eax, dword ptr fs:[00000030h] 5_2_00FAB8D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAB8D0 mov ecx, dword ptr fs:[00000030h] 5_2_00FAB8D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAB8D0 mov eax, dword ptr fs:[00000030h] 5_2_00FAB8D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAB8D0 mov eax, dword ptr fs:[00000030h] 5_2_00FAB8D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAB8D0 mov eax, dword ptr fs:[00000030h] 5_2_00FAB8D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAB8D0 mov eax, dword ptr fs:[00000030h] 5_2_00FAB8D0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4F0BF mov ecx, dword ptr fs:[00000030h] 5_2_00F4F0BF
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4F0BF mov eax, dword ptr fs:[00000030h] 5_2_00F4F0BF
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4F0BF mov eax, dword ptr fs:[00000030h] 5_2_00F4F0BF
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F590AF mov eax, dword ptr fs:[00000030h] 5_2_00F590AF
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19080 mov eax, dword ptr fs:[00000030h] 5_2_00F19080
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F93884 mov eax, dword ptr fs:[00000030h] 5_2_00F93884
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F93884 mov eax, dword ptr fs:[00000030h] 5_2_00F93884
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE1074 mov eax, dword ptr fs:[00000030h] 5_2_00FE1074
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD2073 mov eax, dword ptr fs:[00000030h] 5_2_00FD2073
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F30050 mov eax, dword ptr fs:[00000030h] 5_2_00F30050
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F30050 mov eax, dword ptr fs:[00000030h] 5_2_00F30050
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2B02A mov eax, dword ptr fs:[00000030h] 5_2_00F2B02A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2B02A mov eax, dword ptr fs:[00000030h] 5_2_00F2B02A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2B02A mov eax, dword ptr fs:[00000030h] 5_2_00F2B02A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2B02A mov eax, dword ptr fs:[00000030h] 5_2_00F2B02A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4002D mov eax, dword ptr fs:[00000030h] 5_2_00F4002D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4002D mov eax, dword ptr fs:[00000030h] 5_2_00F4002D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4002D mov eax, dword ptr fs:[00000030h] 5_2_00F4002D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4002D mov eax, dword ptr fs:[00000030h] 5_2_00F4002D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4002D mov eax, dword ptr fs:[00000030h] 5_2_00F4002D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE4015 mov eax, dword ptr fs:[00000030h] 5_2_00FE4015
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE4015 mov eax, dword ptr fs:[00000030h] 5_2_00FE4015
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F97016 mov eax, dword ptr fs:[00000030h] 5_2_00F97016
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F97016 mov eax, dword ptr fs:[00000030h] 5_2_00F97016
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F97016 mov eax, dword ptr fs:[00000030h] 5_2_00F97016
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1B1E1 mov eax, dword ptr fs:[00000030h] 5_2_00F1B1E1
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1B1E1 mov eax, dword ptr fs:[00000030h] 5_2_00F1B1E1
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1B1E1 mov eax, dword ptr fs:[00000030h] 5_2_00F1B1E1
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FA41E8 mov eax, dword ptr fs:[00000030h] 5_2_00FA41E8
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F461A0 mov eax, dword ptr fs:[00000030h] 5_2_00F461A0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F461A0 mov eax, dword ptr fs:[00000030h] 5_2_00F461A0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F969A6 mov eax, dword ptr fs:[00000030h] 5_2_00F969A6
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4A185 mov eax, dword ptr fs:[00000030h] 5_2_00F4A185
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F3C182 mov eax, dword ptr fs:[00000030h] 5_2_00F3C182
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1B171 mov eax, dword ptr fs:[00000030h] 5_2_00F1B171
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1B171 mov eax, dword ptr fs:[00000030h] 5_2_00F1B171
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1C962 mov eax, dword ptr fs:[00000030h] 5_2_00F1C962
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F3B944 mov eax, dword ptr fs:[00000030h] 5_2_00F3B944
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F3B944 mov eax, dword ptr fs:[00000030h] 5_2_00F3B944
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4513A mov eax, dword ptr fs:[00000030h] 5_2_00F4513A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4513A mov eax, dword ptr fs:[00000030h] 5_2_00F4513A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F34120 mov eax, dword ptr fs:[00000030h] 5_2_00F34120
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F34120 mov eax, dword ptr fs:[00000030h] 5_2_00F34120
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F34120 mov eax, dword ptr fs:[00000030h] 5_2_00F34120
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F34120 mov eax, dword ptr fs:[00000030h] 5_2_00F34120
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F34120 mov ecx, dword ptr fs:[00000030h] 5_2_00F34120
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19100 mov eax, dword ptr fs:[00000030h] 5_2_00F19100
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19100 mov eax, dword ptr fs:[00000030h] 5_2_00F19100
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19100 mov eax, dword ptr fs:[00000030h] 5_2_00F19100
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F42AE4 mov eax, dword ptr fs:[00000030h] 5_2_00F42AE4
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F42ACB mov eax, dword ptr fs:[00000030h] 5_2_00F42ACB
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2AAB0 mov eax, dword ptr fs:[00000030h] 5_2_00F2AAB0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2AAB0 mov eax, dword ptr fs:[00000030h] 5_2_00F2AAB0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4FAB0 mov eax, dword ptr fs:[00000030h] 5_2_00F4FAB0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F152A5 mov eax, dword ptr fs:[00000030h] 5_2_00F152A5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F152A5 mov eax, dword ptr fs:[00000030h] 5_2_00F152A5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F152A5 mov eax, dword ptr fs:[00000030h] 5_2_00F152A5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F152A5 mov eax, dword ptr fs:[00000030h] 5_2_00F152A5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F152A5 mov eax, dword ptr fs:[00000030h] 5_2_00F152A5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4D294 mov eax, dword ptr fs:[00000030h] 5_2_00F4D294
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4D294 mov eax, dword ptr fs:[00000030h] 5_2_00F4D294
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F5927A mov eax, dword ptr fs:[00000030h] 5_2_00F5927A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FCB260 mov eax, dword ptr fs:[00000030h] 5_2_00FCB260
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FCB260 mov eax, dword ptr fs:[00000030h] 5_2_00FCB260
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE8A62 mov eax, dword ptr fs:[00000030h] 5_2_00FE8A62
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FA4257 mov eax, dword ptr fs:[00000030h] 5_2_00FA4257
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19240 mov eax, dword ptr fs:[00000030h] 5_2_00F19240
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19240 mov eax, dword ptr fs:[00000030h] 5_2_00F19240
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19240 mov eax, dword ptr fs:[00000030h] 5_2_00F19240
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F19240 mov eax, dword ptr fs:[00000030h] 5_2_00F19240
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1AA16 mov eax, dword ptr fs:[00000030h] 5_2_00F1AA16
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1AA16 mov eax, dword ptr fs:[00000030h] 5_2_00F1AA16
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F33A1C mov eax, dword ptr fs:[00000030h] 5_2_00F33A1C
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F28A0A mov eax, dword ptr fs:[00000030h] 5_2_00F28A0A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F403E2 mov eax, dword ptr fs:[00000030h] 5_2_00F403E2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F403E2 mov eax, dword ptr fs:[00000030h] 5_2_00F403E2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F403E2 mov eax, dword ptr fs:[00000030h] 5_2_00F403E2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F403E2 mov eax, dword ptr fs:[00000030h] 5_2_00F403E2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F403E2 mov eax, dword ptr fs:[00000030h] 5_2_00F403E2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F403E2 mov eax, dword ptr fs:[00000030h] 5_2_00F403E2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F953CA mov eax, dword ptr fs:[00000030h] 5_2_00F953CA
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F953CA mov eax, dword ptr fs:[00000030h] 5_2_00F953CA
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE5BA5 mov eax, dword ptr fs:[00000030h] 5_2_00FE5BA5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4B390 mov eax, dword ptr fs:[00000030h] 5_2_00F4B390
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD138A mov eax, dword ptr fs:[00000030h] 5_2_00FD138A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FCD380 mov ecx, dword ptr fs:[00000030h] 5_2_00FCD380
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F21B8F mov eax, dword ptr fs:[00000030h] 5_2_00F21B8F
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F21B8F mov eax, dword ptr fs:[00000030h] 5_2_00F21B8F
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F43B7A mov eax, dword ptr fs:[00000030h] 5_2_00F43B7A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F43B7A mov eax, dword ptr fs:[00000030h] 5_2_00F43B7A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1DB60 mov ecx, dword ptr fs:[00000030h] 5_2_00F1DB60
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE8B58 mov eax, dword ptr fs:[00000030h] 5_2_00FE8B58
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1F358 mov eax, dword ptr fs:[00000030h] 5_2_00F1F358
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1DB40 mov eax, dword ptr fs:[00000030h] 5_2_00F1DB40
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD131B mov eax, dword ptr fs:[00000030h] 5_2_00FD131B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD14FB mov eax, dword ptr fs:[00000030h] 5_2_00FD14FB
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F96CF0 mov eax, dword ptr fs:[00000030h] 5_2_00F96CF0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F96CF0 mov eax, dword ptr fs:[00000030h] 5_2_00F96CF0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F96CF0 mov eax, dword ptr fs:[00000030h] 5_2_00F96CF0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE8CD6 mov eax, dword ptr fs:[00000030h] 5_2_00FE8CD6
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2849B mov eax, dword ptr fs:[00000030h] 5_2_00F2849B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F3746D mov eax, dword ptr fs:[00000030h] 5_2_00F3746D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAC450 mov eax, dword ptr fs:[00000030h] 5_2_00FAC450
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FAC450 mov eax, dword ptr fs:[00000030h] 5_2_00FAC450
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4A44B mov eax, dword ptr fs:[00000030h] 5_2_00F4A44B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4BC2C mov eax, dword ptr fs:[00000030h] 5_2_00F4BC2C
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE740D mov eax, dword ptr fs:[00000030h] 5_2_00FE740D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE740D mov eax, dword ptr fs:[00000030h] 5_2_00FE740D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE740D mov eax, dword ptr fs:[00000030h] 5_2_00FE740D
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F96C0A mov eax, dword ptr fs:[00000030h] 5_2_00F96C0A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F96C0A mov eax, dword ptr fs:[00000030h] 5_2_00F96C0A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F96C0A mov eax, dword ptr fs:[00000030h] 5_2_00F96C0A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F96C0A mov eax, dword ptr fs:[00000030h] 5_2_00F96C0A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FD1C06 mov eax, dword ptr fs:[00000030h] 5_2_00FD1C06
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FC8DF1 mov eax, dword ptr fs:[00000030h] 5_2_00FC8DF1
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2D5E0 mov eax, dword ptr fs:[00000030h] 5_2_00F2D5E0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F2D5E0 mov eax, dword ptr fs:[00000030h] 5_2_00F2D5E0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F41DB5 mov eax, dword ptr fs:[00000030h] 5_2_00F41DB5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F41DB5 mov eax, dword ptr fs:[00000030h] 5_2_00F41DB5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F41DB5 mov eax, dword ptr fs:[00000030h] 5_2_00F41DB5
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F435A1 mov eax, dword ptr fs:[00000030h] 5_2_00F435A1
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4FD9B mov eax, dword ptr fs:[00000030h] 5_2_00F4FD9B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F4FD9B mov eax, dword ptr fs:[00000030h] 5_2_00F4FD9B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F12D8A mov eax, dword ptr fs:[00000030h] 5_2_00F12D8A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F12D8A mov eax, dword ptr fs:[00000030h] 5_2_00F12D8A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F12D8A mov eax, dword ptr fs:[00000030h] 5_2_00F12D8A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F12D8A mov eax, dword ptr fs:[00000030h] 5_2_00F12D8A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F12D8A mov eax, dword ptr fs:[00000030h] 5_2_00F12D8A
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F3C577 mov eax, dword ptr fs:[00000030h] 5_2_00F3C577
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F3C577 mov eax, dword ptr fs:[00000030h] 5_2_00F3C577
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F37D50 mov eax, dword ptr fs:[00000030h] 5_2_00F37D50
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F53D43 mov eax, dword ptr fs:[00000030h] 5_2_00F53D43
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F93540 mov eax, dword ptr fs:[00000030h] 5_2_00F93540
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F1AD30 mov eax, dword ptr fs:[00000030h] 5_2_00F1AD30
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F23D34 mov eax, dword ptr fs:[00000030h] 5_2_00F23D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE8D34 mov eax, dword ptr fs:[00000030h] 5_2_00FE8D34
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F9A537 mov eax, dword ptr fs:[00000030h] 5_2_00F9A537
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F44D3B mov eax, dword ptr fs:[00000030h] 5_2_00F44D3B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F44D3B mov eax, dword ptr fs:[00000030h] 5_2_00F44D3B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F44D3B mov eax, dword ptr fs:[00000030h] 5_2_00F44D3B
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F276E2 mov eax, dword ptr fs:[00000030h] 5_2_00F276E2
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F416E0 mov ecx, dword ptr fs:[00000030h] 5_2_00F416E0
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FE8ED6 mov eax, dword ptr fs:[00000030h] 5_2_00FE8ED6
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F58EC7 mov eax, dword ptr fs:[00000030h] 5_2_00F58EC7
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00F436CC mov eax, dword ptr fs:[00000030h] 5_2_00F436CC
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00FCFEC0 mov eax, dword ptr fs:[00000030h] 5_2_00FCFEC0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF20A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF20A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF20A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF20A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF20A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF20A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF20A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF20A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF20A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF20A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF20A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF20A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFF0BF mov ecx, dword ptr fs:[00000030h] 15_2_04AFF0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFF0BF mov eax, dword ptr fs:[00000030h] 15_2_04AFF0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFF0BF mov eax, dword ptr fs:[00000030h] 15_2_04AFF0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B090AF mov eax, dword ptr fs:[00000030h] 15_2_04B090AF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9080 mov eax, dword ptr fs:[00000030h] 15_2_04AC9080
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B43884 mov eax, dword ptr fs:[00000030h] 15_2_04B43884
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B43884 mov eax, dword ptr fs:[00000030h] 15_2_04B43884
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD849B mov eax, dword ptr fs:[00000030h] 15_2_04AD849B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC58EC mov eax, dword ptr fs:[00000030h] 15_2_04AC58EC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B814FB mov eax, dword ptr fs:[00000030h] 15_2_04B814FB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46CF0 mov eax, dword ptr fs:[00000030h] 15_2_04B46CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46CF0 mov eax, dword ptr fs:[00000030h] 15_2_04B46CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46CF0 mov eax, dword ptr fs:[00000030h] 15_2_04B46CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04B5B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5B8D0 mov ecx, dword ptr fs:[00000030h] 15_2_04B5B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04B5B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04B5B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04B5B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5B8D0 mov eax, dword ptr fs:[00000030h] 15_2_04B5B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B98CD6 mov eax, dword ptr fs:[00000030h] 15_2_04B98CD6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF002D mov eax, dword ptr fs:[00000030h] 15_2_04AF002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF002D mov eax, dword ptr fs:[00000030h] 15_2_04AF002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF002D mov eax, dword ptr fs:[00000030h] 15_2_04AF002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF002D mov eax, dword ptr fs:[00000030h] 15_2_04AF002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF002D mov eax, dword ptr fs:[00000030h] 15_2_04AF002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFBC2C mov eax, dword ptr fs:[00000030h] 15_2_04AFBC2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADB02A mov eax, dword ptr fs:[00000030h] 15_2_04ADB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADB02A mov eax, dword ptr fs:[00000030h] 15_2_04ADB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADB02A mov eax, dword ptr fs:[00000030h] 15_2_04ADB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADB02A mov eax, dword ptr fs:[00000030h] 15_2_04ADB02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B47016 mov eax, dword ptr fs:[00000030h] 15_2_04B47016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B47016 mov eax, dword ptr fs:[00000030h] 15_2_04B47016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B47016 mov eax, dword ptr fs:[00000030h] 15_2_04B47016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B94015 mov eax, dword ptr fs:[00000030h] 15_2_04B94015
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B94015 mov eax, dword ptr fs:[00000030h] 15_2_04B94015
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B9740D mov eax, dword ptr fs:[00000030h] 15_2_04B9740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B9740D mov eax, dword ptr fs:[00000030h] 15_2_04B9740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B9740D mov eax, dword ptr fs:[00000030h] 15_2_04B9740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B81C06 mov eax, dword ptr fs:[00000030h] 15_2_04B81C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46C0A mov eax, dword ptr fs:[00000030h] 15_2_04B46C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46C0A mov eax, dword ptr fs:[00000030h] 15_2_04B46C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46C0A mov eax, dword ptr fs:[00000030h] 15_2_04B46C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46C0A mov eax, dword ptr fs:[00000030h] 15_2_04B46C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE746D mov eax, dword ptr fs:[00000030h] 15_2_04AE746D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B82073 mov eax, dword ptr fs:[00000030h] 15_2_04B82073
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B91074 mov eax, dword ptr fs:[00000030h] 15_2_04B91074
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFA44B mov eax, dword ptr fs:[00000030h] 15_2_04AFA44B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5C450 mov eax, dword ptr fs:[00000030h] 15_2_04B5C450
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5C450 mov eax, dword ptr fs:[00000030h] 15_2_04B5C450
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE0050 mov eax, dword ptr fs:[00000030h] 15_2_04AE0050
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE0050 mov eax, dword ptr fs:[00000030h] 15_2_04AE0050
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B451BE mov eax, dword ptr fs:[00000030h] 15_2_04B451BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B451BE mov eax, dword ptr fs:[00000030h] 15_2_04B451BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B451BE mov eax, dword ptr fs:[00000030h] 15_2_04B451BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B451BE mov eax, dword ptr fs:[00000030h] 15_2_04B451BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF35A1 mov eax, dword ptr fs:[00000030h] 15_2_04AF35A1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF61A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF61A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF61A0 mov eax, dword ptr fs:[00000030h] 15_2_04AF61A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B469A6 mov eax, dword ptr fs:[00000030h] 15_2_04B469A6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF1DB5 mov eax, dword ptr fs:[00000030h] 15_2_04AF1DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF1DB5 mov eax, dword ptr fs:[00000030h] 15_2_04AF1DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF1DB5 mov eax, dword ptr fs:[00000030h] 15_2_04AF1DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC2D8A mov eax, dword ptr fs:[00000030h] 15_2_04AC2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC2D8A mov eax, dword ptr fs:[00000030h] 15_2_04AC2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC2D8A mov eax, dword ptr fs:[00000030h] 15_2_04AC2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC2D8A mov eax, dword ptr fs:[00000030h] 15_2_04AC2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC2D8A mov eax, dword ptr fs:[00000030h] 15_2_04AC2D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFA185 mov eax, dword ptr fs:[00000030h] 15_2_04AFA185
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEC182 mov eax, dword ptr fs:[00000030h] 15_2_04AEC182
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2581 mov eax, dword ptr fs:[00000030h] 15_2_04AF2581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2581 mov eax, dword ptr fs:[00000030h] 15_2_04AF2581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2581 mov eax, dword ptr fs:[00000030h] 15_2_04AF2581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2581 mov eax, dword ptr fs:[00000030h] 15_2_04AF2581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFFD9B mov eax, dword ptr fs:[00000030h] 15_2_04AFFD9B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFFD9B mov eax, dword ptr fs:[00000030h] 15_2_04AFFD9B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2990 mov eax, dword ptr fs:[00000030h] 15_2_04AF2990
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B78DF1 mov eax, dword ptr fs:[00000030h] 15_2_04B78DF1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACB1E1 mov eax, dword ptr fs:[00000030h] 15_2_04ACB1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACB1E1 mov eax, dword ptr fs:[00000030h] 15_2_04ACB1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACB1E1 mov eax, dword ptr fs:[00000030h] 15_2_04ACB1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADD5E0 mov eax, dword ptr fs:[00000030h] 15_2_04ADD5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADD5E0 mov eax, dword ptr fs:[00000030h] 15_2_04ADD5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B541E8 mov eax, dword ptr fs:[00000030h] 15_2_04B541E8
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46DC9 mov eax, dword ptr fs:[00000030h] 15_2_04B46DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46DC9 mov eax, dword ptr fs:[00000030h] 15_2_04B46DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46DC9 mov eax, dword ptr fs:[00000030h] 15_2_04B46DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46DC9 mov ecx, dword ptr fs:[00000030h] 15_2_04B46DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46DC9 mov eax, dword ptr fs:[00000030h] 15_2_04B46DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B46DC9 mov eax, dword ptr fs:[00000030h] 15_2_04B46DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B4A537 mov eax, dword ptr fs:[00000030h] 15_2_04B4A537
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B98D34 mov eax, dword ptr fs:[00000030h] 15_2_04B98D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE4120 mov eax, dword ptr fs:[00000030h] 15_2_04AE4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE4120 mov eax, dword ptr fs:[00000030h] 15_2_04AE4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE4120 mov eax, dword ptr fs:[00000030h] 15_2_04AE4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE4120 mov eax, dword ptr fs:[00000030h] 15_2_04AE4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE4120 mov ecx, dword ptr fs:[00000030h] 15_2_04AE4120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF4D3B mov eax, dword ptr fs:[00000030h] 15_2_04AF4D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF4D3B mov eax, dword ptr fs:[00000030h] 15_2_04AF4D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF4D3B mov eax, dword ptr fs:[00000030h] 15_2_04AF4D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF513A mov eax, dword ptr fs:[00000030h] 15_2_04AF513A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF513A mov eax, dword ptr fs:[00000030h] 15_2_04AF513A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD3D34 mov eax, dword ptr fs:[00000030h] 15_2_04AD3D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACAD30 mov eax, dword ptr fs:[00000030h] 15_2_04ACAD30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9100 mov eax, dword ptr fs:[00000030h] 15_2_04AC9100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9100 mov eax, dword ptr fs:[00000030h] 15_2_04AC9100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9100 mov eax, dword ptr fs:[00000030h] 15_2_04AC9100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACC962 mov eax, dword ptr fs:[00000030h] 15_2_04ACC962
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEC577 mov eax, dword ptr fs:[00000030h] 15_2_04AEC577
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEC577 mov eax, dword ptr fs:[00000030h] 15_2_04AEC577
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACB171 mov eax, dword ptr fs:[00000030h] 15_2_04ACB171
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACB171 mov eax, dword ptr fs:[00000030h] 15_2_04ACB171
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEB944 mov eax, dword ptr fs:[00000030h] 15_2_04AEB944
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEB944 mov eax, dword ptr fs:[00000030h] 15_2_04AEB944
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B03D43 mov eax, dword ptr fs:[00000030h] 15_2_04B03D43
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B43540 mov eax, dword ptr fs:[00000030h] 15_2_04B43540
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE7D50 mov eax, dword ptr fs:[00000030h] 15_2_04AE7D50
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC52A5 mov eax, dword ptr fs:[00000030h] 15_2_04AC52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC52A5 mov eax, dword ptr fs:[00000030h] 15_2_04AC52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC52A5 mov eax, dword ptr fs:[00000030h] 15_2_04AC52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC52A5 mov eax, dword ptr fs:[00000030h] 15_2_04AC52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC52A5 mov eax, dword ptr fs:[00000030h] 15_2_04AC52A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B446A7 mov eax, dword ptr fs:[00000030h] 15_2_04B446A7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B90EA5 mov eax, dword ptr fs:[00000030h] 15_2_04B90EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B90EA5 mov eax, dword ptr fs:[00000030h] 15_2_04B90EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B90EA5 mov eax, dword ptr fs:[00000030h] 15_2_04B90EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADAAB0 mov eax, dword ptr fs:[00000030h] 15_2_04ADAAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADAAB0 mov eax, dword ptr fs:[00000030h] 15_2_04ADAAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFFAB0 mov eax, dword ptr fs:[00000030h] 15_2_04AFFAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5FE87 mov eax, dword ptr fs:[00000030h] 15_2_04B5FE87
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFD294 mov eax, dword ptr fs:[00000030h] 15_2_04AFD294
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFD294 mov eax, dword ptr fs:[00000030h] 15_2_04AFD294
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2AE4 mov eax, dword ptr fs:[00000030h] 15_2_04AF2AE4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF16E0 mov ecx, dword ptr fs:[00000030h] 15_2_04AF16E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD76E2 mov eax, dword ptr fs:[00000030h] 15_2_04AD76E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF36CC mov eax, dword ptr fs:[00000030h] 15_2_04AF36CC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2ACB mov eax, dword ptr fs:[00000030h] 15_2_04AF2ACB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B98ED6 mov eax, dword ptr fs:[00000030h] 15_2_04B98ED6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B7FEC0 mov eax, dword ptr fs:[00000030h] 15_2_04B7FEC0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B08EC7 mov eax, dword ptr fs:[00000030h] 15_2_04B08EC7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B7FE3F mov eax, dword ptr fs:[00000030h] 15_2_04B7FE3F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACE620 mov eax, dword ptr fs:[00000030h] 15_2_04ACE620
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B04A2C mov eax, dword ptr fs:[00000030h] 15_2_04B04A2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B04A2C mov eax, dword ptr fs:[00000030h] 15_2_04B04A2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD8A0A mov eax, dword ptr fs:[00000030h] 15_2_04AD8A0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACC600 mov eax, dword ptr fs:[00000030h] 15_2_04ACC600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACC600 mov eax, dword ptr fs:[00000030h] 15_2_04ACC600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACC600 mov eax, dword ptr fs:[00000030h] 15_2_04ACC600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF8E00 mov eax, dword ptr fs:[00000030h] 15_2_04AF8E00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AE3A1C mov eax, dword ptr fs:[00000030h] 15_2_04AE3A1C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFA61C mov eax, dword ptr fs:[00000030h] 15_2_04AFA61C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFA61C mov eax, dword ptr fs:[00000030h] 15_2_04AFA61C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACAA16 mov eax, dword ptr fs:[00000030h] 15_2_04ACAA16
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACAA16 mov eax, dword ptr fs:[00000030h] 15_2_04ACAA16
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC5210 mov eax, dword ptr fs:[00000030h] 15_2_04AC5210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC5210 mov ecx, dword ptr fs:[00000030h] 15_2_04AC5210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC5210 mov eax, dword ptr fs:[00000030h] 15_2_04AC5210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC5210 mov eax, dword ptr fs:[00000030h] 15_2_04AC5210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD766D mov eax, dword ptr fs:[00000030h] 15_2_04AD766D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B0927A mov eax, dword ptr fs:[00000030h] 15_2_04B0927A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B7B260 mov eax, dword ptr fs:[00000030h] 15_2_04B7B260
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B7B260 mov eax, dword ptr fs:[00000030h] 15_2_04B7B260
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B98A62 mov eax, dword ptr fs:[00000030h] 15_2_04B98A62
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEAE73 mov eax, dword ptr fs:[00000030h] 15_2_04AEAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEAE73 mov eax, dword ptr fs:[00000030h] 15_2_04AEAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEAE73 mov eax, dword ptr fs:[00000030h] 15_2_04AEAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEAE73 mov eax, dword ptr fs:[00000030h] 15_2_04AEAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEAE73 mov eax, dword ptr fs:[00000030h] 15_2_04AEAE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B54257 mov eax, dword ptr fs:[00000030h] 15_2_04B54257
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9240 mov eax, dword ptr fs:[00000030h] 15_2_04AC9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9240 mov eax, dword ptr fs:[00000030h] 15_2_04AC9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9240 mov eax, dword ptr fs:[00000030h] 15_2_04AC9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC9240 mov eax, dword ptr fs:[00000030h] 15_2_04AC9240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD7E41 mov eax, dword ptr fs:[00000030h] 15_2_04AD7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD7E41 mov eax, dword ptr fs:[00000030h] 15_2_04AD7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD7E41 mov eax, dword ptr fs:[00000030h] 15_2_04AD7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD7E41 mov eax, dword ptr fs:[00000030h] 15_2_04AD7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD7E41 mov eax, dword ptr fs:[00000030h] 15_2_04AD7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD7E41 mov eax, dword ptr fs:[00000030h] 15_2_04AD7E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF4BAD mov eax, dword ptr fs:[00000030h] 15_2_04AF4BAD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF4BAD mov eax, dword ptr fs:[00000030h] 15_2_04AF4BAD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF4BAD mov eax, dword ptr fs:[00000030h] 15_2_04AF4BAD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B95BA5 mov eax, dword ptr fs:[00000030h] 15_2_04B95BA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B47794 mov eax, dword ptr fs:[00000030h] 15_2_04B47794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B47794 mov eax, dword ptr fs:[00000030h] 15_2_04B47794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B47794 mov eax, dword ptr fs:[00000030h] 15_2_04B47794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD1B8F mov eax, dword ptr fs:[00000030h] 15_2_04AD1B8F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD1B8F mov eax, dword ptr fs:[00000030h] 15_2_04AD1B8F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B8138A mov eax, dword ptr fs:[00000030h] 15_2_04B8138A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B7D380 mov ecx, dword ptr fs:[00000030h] 15_2_04B7D380
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF2397 mov eax, dword ptr fs:[00000030h] 15_2_04AF2397
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AD8794 mov eax, dword ptr fs:[00000030h] 15_2_04AD8794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFB390 mov eax, dword ptr fs:[00000030h] 15_2_04AFB390
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B037F5 mov eax, dword ptr fs:[00000030h] 15_2_04B037F5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF03E2 mov eax, dword ptr fs:[00000030h] 15_2_04AF03E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF03E2 mov eax, dword ptr fs:[00000030h] 15_2_04AF03E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF03E2 mov eax, dword ptr fs:[00000030h] 15_2_04AF03E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF03E2 mov eax, dword ptr fs:[00000030h] 15_2_04AF03E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF03E2 mov eax, dword ptr fs:[00000030h] 15_2_04AF03E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF03E2 mov eax, dword ptr fs:[00000030h] 15_2_04AF03E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B453CA mov eax, dword ptr fs:[00000030h] 15_2_04B453CA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B453CA mov eax, dword ptr fs:[00000030h] 15_2_04B453CA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC4F2E mov eax, dword ptr fs:[00000030h] 15_2_04AC4F2E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AC4F2E mov eax, dword ptr fs:[00000030h] 15_2_04AC4F2E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFE730 mov eax, dword ptr fs:[00000030h] 15_2_04AFE730
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFA70E mov eax, dword ptr fs:[00000030h] 15_2_04AFA70E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AFA70E mov eax, dword ptr fs:[00000030h] 15_2_04AFA70E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B8131B mov eax, dword ptr fs:[00000030h] 15_2_04B8131B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5FF10 mov eax, dword ptr fs:[00000030h] 15_2_04B5FF10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B5FF10 mov eax, dword ptr fs:[00000030h] 15_2_04B5FF10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B9070D mov eax, dword ptr fs:[00000030h] 15_2_04B9070D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B9070D mov eax, dword ptr fs:[00000030h] 15_2_04B9070D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AEF716 mov eax, dword ptr fs:[00000030h] 15_2_04AEF716
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACDB60 mov ecx, dword ptr fs:[00000030h] 15_2_04ACDB60
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADFF60 mov eax, dword ptr fs:[00000030h] 15_2_04ADFF60
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B98F6A mov eax, dword ptr fs:[00000030h] 15_2_04B98F6A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF3B7A mov eax, dword ptr fs:[00000030h] 15_2_04AF3B7A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04AF3B7A mov eax, dword ptr fs:[00000030h] 15_2_04AF3B7A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04B98B58 mov eax, dword ptr fs:[00000030h] 15_2_04B98B58
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACDB40 mov eax, dword ptr fs:[00000030h] 15_2_04ACDB40
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ADEF40 mov eax, dword ptr fs:[00000030h] 15_2_04ADEF40
Source: C:\Windows\SysWOW64\msdt.exe Code function: 15_2_04ACF358 mov eax, dword ptr fs:[00000030h] 15_2_04ACF358
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Code function: 5_2_00409B50 LdrLoadDll, 5_2_00409B50
Source: C:\Users\user\Desktop\divpCHa0h7.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 81.169.145.161 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mambacustomboats.com
Source: C:\Windows\explorer.exe Domain query: www.sanlifalan.com
Source: C:\Windows\explorer.exe Domain query: www.esyscoloradosprings.com
Source: C:\Windows\explorer.exe Network Connect: 104.165.34.6 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 108.167.135.122 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 64.190.62.111 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.ribbonofficial.com
Source: C:\Windows\explorer.exe Domain query: www.floaterslaser.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\divpCHa0h7.exe Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: 2F0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\divpCHa0h7.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Thread register set: target process: 3472 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Users\user\Desktop\divpCHa0h7.exe C:\Users\user\Desktop\divpCHa0h7.exe Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\divpCHa0h7.exe' Jump to behavior
Source: explorer.exe, 00000006.00000000.337351200.0000000001640000.00000002.00020000.sdmp, msdt.exe, 0000000F.00000002.520706887.00000000031D0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.337351200.0000000001640000.00000002.00020000.sdmp, msdt.exe, 0000000F.00000002.520706887.00000000031D0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.337351200.0000000001640000.00000002.00020000.sdmp, msdt.exe, 0000000F.00000002.520706887.00000000031D0000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000006.00000000.337048787.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000006.00000000.337351200.0000000001640000.00000002.00020000.sdmp, msdt.exe, 0000000F.00000002.520706887.00000000031D0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000006.00000000.337351200.0000000001640000.00000002.00020000.sdmp, msdt.exe, 0000000F.00000002.520706887.00000000031D0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Users\user\Desktop\divpCHa0h7.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\divpCHa0h7.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3c268a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.divpCHa0h7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.divpCHa0h7.exe.3bdc680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.520122597.0000000002760000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361762124.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.290893406.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.307316377.0000000006D39000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.265367323.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361396861.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.519918692.0000000002660000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.361951579.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.517884800.0000000000610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.267848070.0000000003AB9000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 502315 Sample: divpCHa0h7.exe Startdate: 13/10/2021 Architecture: WINDOWS Score: 100 33 www.kangrungao.com 2->33 35 www.begukiu0.info 2->35 37 a.mb.cn 2->37 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 6 other signatures 2->51 10 divpCHa0h7.exe 6 2->10         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\divpCHa0h7.exe.log, ASCII 10->31 dropped 63 Detected unpacking (changes PE section rights) 10->63 65 Tries to detect virtualization through RDTSC time measurements 10->65 14 divpCHa0h7.exe 10->14         started        17 divpCHa0h7.exe 10->17         started        19 divpCHa0h7.exe 10->19         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 14->67 69 Maps a DLL or memory area into another process 14->69 71 Sample uses process hollowing technique 14->71 73 Queues an APC in another process (thread injection) 14->73 21 msdt.exe 14->21         started        24 explorer.exe 14->24 injected process9 dnsIp10 53 Self deletion via cmd delete 21->53 55 Modifies the context of a thread in another process (thread injection) 21->55 57 Maps a DLL or memory area into another process 21->57 59 Tries to detect virtualization through RDTSC time measurements 21->59 27 cmd.exe 1 21->27         started        39 www.sanlifalan.com 104.165.34.6, 49768, 80 EGIHOSTINGUS United States 24->39 41 websites076.homestead.com 108.167.135.122, 49789, 80 UNIFIEDLAYER-AS-1US United States 24->41 43 6 other IPs or domains 24->43 61 System process connects to network (likely due to code injection or exploit) 24->61 signatures11 process12 process13 29 conhost.exe 27->29         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.165.34.6
 www.sanlifalan.com United States
18779 EGIHOSTINGUS true
108.167.135.122
 websites076.homestead.com United States
46606 UNIFIEDLAYER-AS-1US false
23.227.38.74
 shops.myshopify.com Canada
13335 CLOUDFLARENETUS false
81.169.145.161
 floaterslaser.com Germany
6724 STRATOSTRATOAGDE false
64.190.62.111
 www.mambacustomboats.com United States
11696 NBS11696US false

Contacted Domains

Name IP Active
www.sanlifalan.com 104.165.34.6 true
floaterslaser.com 81.169.145.161 true
www.mambacustomboats.com 64.190.62.111 true
shops.myshopify.com 23.227.38.74 true
websites076.homestead.com 108.167.135.122 true
a.mb.cn 8.212.24.67 true
www.esyscoloradosprings.com unknown unknown
www.kangrungao.com unknown unknown
www.begukiu0.info unknown unknown
www.ribbonofficial.com unknown unknown
www.floaterslaser.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.floaterslaser.com/fqiq/?z0DH=f0Dtar1PYnAdDzS&ZvEd=cd5R1bQkGt60ucaw3I3E0k/wUnqrUWXrQueIKe7m3jIZGD6slZfTAntz2qvR4Gb0BO+l true
  • Avira URL Cloud: safe
 unknown
www.esyscoloradosprings.com/fqiq/ true
  • Avira URL Cloud: safe
 low
http://www.sanlifalan.com/fqiq/?ZvEd=prTEVkQtidVRbelnknUsCYHPcHrUQSHWronmvObfBYwGPcpLSCQwPhh2tosJT24FW2ZT&z0DH=f0Dtar1PYnAdDzS true
  • Avira URL Cloud: safe
 unknown
http://www.esyscoloradosprings.com/fqiq/?ZvEd=KZhYdxsAX/C25xiOpksKfhNe7DL7yKRLCy2J/73TfqSfqYhWOiYMofna8My9QnEOoaqj&z0DH=f0Dtar1PYnAdDzS true
  • Avira URL Cloud: safe
 unknown
http://www.ribbonofficial.com/fqiq/?z0DH=f0Dtar1PYnAdDzS&ZvEd=MhZqZeIh1bEx9EPhBOs++VNt6zdxCxYLlsX+VD+R30361cyojbkVOC5VQe1OoxOfJLYr true
  • Avira URL Cloud: safe
 unknown
http://www.mambacustomboats.com/fqiq/?ZvEd=oM7C4s4K9Ux9NUwG97tedYlymorHgm5Kv3Umj1Gnv/i5ubiDMWU/+XDfdu3U3Pyuil7R&z0DH=f0Dtar1PYnAdDzS true
  • Avira URL Cloud: safe
 unknown