Windows Analysis Report
173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe

Overview

General Information

Sample name: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe
Analysis ID: 1566420
MD5: 031d9c09391de9e9530f989651b1a078
SHA1: 683407bdefafb4fdaffe8e8d176806467e3c094f
SHA256: d3dd75c3a7d6e7107f34aee8090dfe4270b556b03331308c3aab5307a99c7c30
Tags: base64-decodedexeuser-abuse_ch
Infos:

Detection

FormBook
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Machine Learning detection for sample
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
One or more processes crash
PE file does not import any functions
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe ReversingLabs: Detection: 63%
Yara detected FormBook
Source: Yara match File source: 0.2.173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2041198261.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.000000000139E000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1676281033.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.0000000001200000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1678293898.000000000104B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.000000000139E000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1676281033.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.0000000001200000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1678293898.000000000104B000.00000004.00000020.00020000.00000000.sdmp
Source: Amcache.hve.2.dr String found in binary or memory: http://upx.sf.net

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2041198261.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe.420000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2041198261.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00421978 NtProtectVirtualMemory,NtProtectVirtualMemory, 0_2_00421978
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0044C4A3 NtClose, 0_2_0044C4A3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272DF0 NtQuerySystemInformation,LdrInitializeThunk, 0_2_01272DF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01274340 NtSetContextThread, 0_2_01274340
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01274650 NtSuspendThread, 0_2_01274650
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272B60 NtClose, 0_2_01272B60
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272BA0 NtEnumerateValueKey, 0_2_01272BA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272B80 NtQueryInformationFile, 0_2_01272B80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272BE0 NtQueryValueKey, 0_2_01272BE0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272BF0 NtAllocateVirtualMemory, 0_2_01272BF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272AB0 NtWaitForSingleObject, 0_2_01272AB0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272AF0 NtWriteFile, 0_2_01272AF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272AD0 NtReadFile, 0_2_01272AD0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272D30 NtUnmapViewOfSection, 0_2_01272D30
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272D00 NtSetInformationFile, 0_2_01272D00
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272D10 NtMapViewOfSection, 0_2_01272D10
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272DB0 NtEnumerateKey, 0_2_01272DB0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272DD0 NtDelayExecution, 0_2_01272DD0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272C00 NtQueryInformationProcess, 0_2_01272C00
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272C60 NtCreateKey, 0_2_01272C60
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272C70 NtFreeVirtualMemory, 0_2_01272C70
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272CA0 NtQueryInformationToken, 0_2_01272CA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272CF0 NtOpenProcess, 0_2_01272CF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272CC0 NtQueryVirtualMemory, 0_2_01272CC0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272F30 NtCreateSection, 0_2_01272F30
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272F60 NtCreateProcessEx, 0_2_01272F60
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272FA0 NtQuerySection, 0_2_01272FA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272FB0 NtResumeThread, 0_2_01272FB0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272F90 NtProtectVirtualMemory, 0_2_01272F90
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272FE0 NtCreateFile, 0_2_01272FE0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272E30 NtWriteVirtualMemory, 0_2_01272E30
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272EA0 NtAdjustPrivilegesToken, 0_2_01272EA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272E80 NtReadVirtualMemory, 0_2_01272E80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272EE0 NtQueueApcThread, 0_2_01272EE0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01273010 NtOpenDirectoryObject, 0_2_01273010
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01273090 NtSetValueKey, 0_2_01273090
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012735C0 NtCreateMutant, 0_2_012735C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012739B0 NtGetContextThread, 0_2_012739B0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01273D10 NtOpenProcessToken, 0_2_01273D10
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01273D70 NtOpenThread, 0_2_01273D70
Detected potential crypto function
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00421978 0_2_00421978
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00423060 0_2_00423060
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_004211F0 0_2_004211F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0044EAF3 0_2_0044EAF3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0042239E 0_2_0042239E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_004223A0 0_2_004223A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0042FC6A 0_2_0042FC6A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0042FC73 0_2_0042FC73
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00422C11 0_2_00422C11
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00436623 0_2_00436623
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00436622 0_2_00436622
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0042FE93 0_2_0042FE93
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0042DF13 0_2_0042DF13
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_004227C0 0_2_004227C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_004227BC 0_2_004227BC
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230100 0_2_01230100
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DA118 0_2_012DA118
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C8158 0_2_012C8158
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F41A2 0_2_012F41A2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_013001AA 0_2_013001AA
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F81CC 0_2_012F81CC
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FA352 0_2_012FA352
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E3F0 0_2_0124E3F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_013003E6 0_2_013003E6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C02C0 0_2_012C02C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240535 0_2_01240535
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01300591 0_2_01300591
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E4420 0_2_012E4420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F2446 0_2_012F2446
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EE4F6 0_2_012EE4F6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01264750 0_2_01264750
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123C7C0 0_2_0123C7C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125C6E0 0_2_0125C6E0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01256962 0_2_01256962
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0130A9A6 0_2_0130A9A6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124A840 0_2_0124A840
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01242840 0_2_01242840
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012268B8 0_2_012268B8
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E8F0 0_2_0126E8F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FAB40 0_2_012FAB40
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F6BD7 0_2_012F6BD7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124AD00 0_2_0124AD00
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DCD1F 0_2_012DCD1F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01258DBF 0_2_01258DBF
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123ADE0 0_2_0123ADE0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240C00 0_2_01240C00
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0CB5 0_2_012E0CB5
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230CF2 0_2_01230CF2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01282F28 0_2_01282F28
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01260F30 0_2_01260F30
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E2F30 0_2_012E2F30
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B4F40 0_2_012B4F40
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BEFA0 0_2_012BEFA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01232FC8 0_2_01232FC8
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FEE26 0_2_012FEE26
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240E59 0_2_01240E59
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01252E90 0_2_01252E90
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FCE93 0_2_012FCE93
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FEEDB 0_2_012FEEDB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0127516C 0_2_0127516C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122F172 0_2_0122F172
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0130B16B 0_2_0130B16B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124B1B0 0_2_0124B1B0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F70E9 0_2_012F70E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FF0E0 0_2_012FF0E0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EF0CC 0_2_012EF0CC
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012470C0 0_2_012470C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F132D 0_2_012F132D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122D34C 0_2_0122D34C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0128739A 0_2_0128739A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012452A0 0_2_012452A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E12ED 0_2_012E12ED
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125B2C0 0_2_0125B2C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F7571 0_2_012F7571
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DD5B0 0_2_012DD5B0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_013095C3 0_2_013095C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FF43F 0_2_012FF43F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01231460 0_2_01231460
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FF7B0 0_2_012FF7B0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01285630 0_2_01285630
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F16CC 0_2_012F16CC
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D5910 0_2_012D5910
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01249950 0_2_01249950
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125B950 0_2_0125B950
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AD800 0_2_012AD800
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012438E0 0_2_012438E0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FFB76 0_2_012FFB76
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125FB80 0_2_0125FB80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B5BF0 0_2_012B5BF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0127DBF9 0_2_0127DBF9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B3A6C 0_2_012B3A6C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FFA49 0_2_012FFA49
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F7A46 0_2_012F7A46
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DDAAC 0_2_012DDAAC
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01285AA0 0_2_01285AA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E1AA3 0_2_012E1AA3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EDAC6 0_2_012EDAC6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F7D73 0_2_012F7D73
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01243D40 0_2_01243D40
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F1D5A 0_2_012F1D5A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125FDC0 0_2_0125FDC0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B9C32 0_2_012B9C32
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FFCF2 0_2_012FFCF2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FFF09 0_2_012FFF09
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FFFB1 0_2_012FFFB1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01241F92 0_2_01241F92
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01203FD2 0_2_01203FD2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01203FD5 0_2_01203FD5
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01249EB0 0_2_01249EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: String function: 012BF290 appears 105 times
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: String function: 012AEA12 appears 86 times
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: String function: 0122B970 appears 265 times
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: String function: 01275130 appears 58 times
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: String function: 01287E54 appears 108 times
One or more processes crash
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 228
PE file does not import any functions
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.000000000132D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1676281033.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1678293898.0000000001178000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe
Uses 32bit PE files
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe.420000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2041198261.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: Section .text
Source: classification engine Classification label: mal80.troj.winEXE@2/5@0/0
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7320
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\1c7ebd0f-41f3-4238-a3db-afc200940dcd Jump to behavior
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe ReversingLabs: Detection: 63%
Source: unknown Process created: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe "C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe"
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 228
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Section loaded: apphelp.dll Jump to behavior
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.000000000139E000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1676281033.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.0000000001200000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1678293898.000000000104B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.000000000139E000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1676281033.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000002.2041382964.0000000001200000.00000040.00001000.00020000.00000000.sdmp, 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe, 00000000.00000003.1678293898.000000000104B000.00000004.00000020.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0043606E push es; retf 0_2_0043606F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0043E922 push es; retf 0_2_0043E926
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_004232D0 push eax; ret 0_2_004232D2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00421BD8 pushad ; ret 0_2_00421BDC
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_004363F3 push edi; retf 0_2_004364AE
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00436393 push cs; iretd 0_2_004363C4
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00436390 push cs; iretd 0_2_004363C4
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00435B95 push esp; retf 0_2_00435B96
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00424C4C push ebx; retf 0_2_00424CDD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00436453 push edi; retf 0_2_004364AE
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00424C65 push ebx; retf 0_2_00424CDD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00436438 push edi; retf 0_2_004364AE
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00435DE1 push 8F76B6C4h; iretd 0_2_00435DE6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00434616 push ebp; ret 0_2_00434631
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00434623 push ebp; ret 0_2_00434631
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_00438E31 push FFFFFFF1h; ret 0_2_00438E3C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0043E6A0 pushfd ; ret 0_2_0043E6C7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0043EF53 push edi; retf 0_2_0043EF5F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0042CFAF push esp; retf 0_2_0042CFB0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0120225F pushad ; ret 0_2_012027F9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012027FA pushad ; ret 0_2_012027F9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012309AD push ecx; mov dword ptr [esp], ecx 0_2_012309B6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0120283D push eax; iretd 0_2_01202858
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0120135E push eax; iretd 0_2_01201369
Source: 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Static PE information: section name: .text entropy: 7.995097609998807
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0127096E rdtsc 0_2_0127096E
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe API coverage: 0.3 %
Source: Amcache.hve.2.dr Binary or memory string: VMware
Source: Amcache.hve.2.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.2.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.2.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.2.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.2.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.2.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.2.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.2.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.2.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.2.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.2.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.2.dr Binary or memory string: vmci.sys
Source: Amcache.hve.2.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.2.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.2.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.2.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.2.dr Binary or memory string: VMware20,1
Source: Amcache.hve.2.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.2.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.2.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.2.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.2.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.2.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.2.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.2.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.2.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.2.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.2.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0127096E rdtsc 0_2_0127096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272DF0 NtQuerySystemInformation,LdrInitializeThunk, 0_2_01272DF0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01260124 mov eax, dword ptr fs:[00000030h] 0_2_01260124
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov eax, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov ecx, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov eax, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov eax, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov ecx, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov eax, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov eax, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov ecx, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov eax, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE10E mov ecx, dword ptr fs:[00000030h] 0_2_012DE10E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DA118 mov ecx, dword ptr fs:[00000030h] 0_2_012DA118
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DA118 mov eax, dword ptr fs:[00000030h] 0_2_012DA118
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DA118 mov eax, dword ptr fs:[00000030h] 0_2_012DA118
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DA118 mov eax, dword ptr fs:[00000030h] 0_2_012DA118
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F0115 mov eax, dword ptr fs:[00000030h] 0_2_012F0115
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304164 mov eax, dword ptr fs:[00000030h] 0_2_01304164
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304164 mov eax, dword ptr fs:[00000030h] 0_2_01304164
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C4144 mov eax, dword ptr fs:[00000030h] 0_2_012C4144
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C4144 mov eax, dword ptr fs:[00000030h] 0_2_012C4144
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C4144 mov ecx, dword ptr fs:[00000030h] 0_2_012C4144
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C4144 mov eax, dword ptr fs:[00000030h] 0_2_012C4144
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C4144 mov eax, dword ptr fs:[00000030h] 0_2_012C4144
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122C156 mov eax, dword ptr fs:[00000030h] 0_2_0122C156
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C8158 mov eax, dword ptr fs:[00000030h] 0_2_012C8158
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236154 mov eax, dword ptr fs:[00000030h] 0_2_01236154
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236154 mov eax, dword ptr fs:[00000030h] 0_2_01236154
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01270185 mov eax, dword ptr fs:[00000030h] 0_2_01270185
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EC188 mov eax, dword ptr fs:[00000030h] 0_2_012EC188
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EC188 mov eax, dword ptr fs:[00000030h] 0_2_012EC188
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D4180 mov eax, dword ptr fs:[00000030h] 0_2_012D4180
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D4180 mov eax, dword ptr fs:[00000030h] 0_2_012D4180
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B019F mov eax, dword ptr fs:[00000030h] 0_2_012B019F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B019F mov eax, dword ptr fs:[00000030h] 0_2_012B019F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B019F mov eax, dword ptr fs:[00000030h] 0_2_012B019F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B019F mov eax, dword ptr fs:[00000030h] 0_2_012B019F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122A197 mov eax, dword ptr fs:[00000030h] 0_2_0122A197
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122A197 mov eax, dword ptr fs:[00000030h] 0_2_0122A197
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122A197 mov eax, dword ptr fs:[00000030h] 0_2_0122A197
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_013061E5 mov eax, dword ptr fs:[00000030h] 0_2_013061E5
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012601F8 mov eax, dword ptr fs:[00000030h] 0_2_012601F8
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F61C3 mov eax, dword ptr fs:[00000030h] 0_2_012F61C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F61C3 mov eax, dword ptr fs:[00000030h] 0_2_012F61C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE1D0 mov eax, dword ptr fs:[00000030h] 0_2_012AE1D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE1D0 mov eax, dword ptr fs:[00000030h] 0_2_012AE1D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE1D0 mov ecx, dword ptr fs:[00000030h] 0_2_012AE1D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE1D0 mov eax, dword ptr fs:[00000030h] 0_2_012AE1D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE1D0 mov eax, dword ptr fs:[00000030h] 0_2_012AE1D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122A020 mov eax, dword ptr fs:[00000030h] 0_2_0122A020
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122C020 mov eax, dword ptr fs:[00000030h] 0_2_0122C020
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C6030 mov eax, dword ptr fs:[00000030h] 0_2_012C6030
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B4000 mov ecx, dword ptr fs:[00000030h] 0_2_012B4000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D2000 mov eax, dword ptr fs:[00000030h] 0_2_012D2000
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E016 mov eax, dword ptr fs:[00000030h] 0_2_0124E016
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E016 mov eax, dword ptr fs:[00000030h] 0_2_0124E016
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E016 mov eax, dword ptr fs:[00000030h] 0_2_0124E016
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E016 mov eax, dword ptr fs:[00000030h] 0_2_0124E016
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125C073 mov eax, dword ptr fs:[00000030h] 0_2_0125C073
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01232050 mov eax, dword ptr fs:[00000030h] 0_2_01232050
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6050 mov eax, dword ptr fs:[00000030h] 0_2_012B6050
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012280A0 mov eax, dword ptr fs:[00000030h] 0_2_012280A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C80A8 mov eax, dword ptr fs:[00000030h] 0_2_012C80A8
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F60B8 mov eax, dword ptr fs:[00000030h] 0_2_012F60B8
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F60B8 mov ecx, dword ptr fs:[00000030h] 0_2_012F60B8
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123208A mov eax, dword ptr fs:[00000030h] 0_2_0123208A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122A0E3 mov ecx, dword ptr fs:[00000030h] 0_2_0122A0E3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012380E9 mov eax, dword ptr fs:[00000030h] 0_2_012380E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B60E0 mov eax, dword ptr fs:[00000030h] 0_2_012B60E0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122C0F0 mov eax, dword ptr fs:[00000030h] 0_2_0122C0F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012720F0 mov ecx, dword ptr fs:[00000030h] 0_2_012720F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B20DE mov eax, dword ptr fs:[00000030h] 0_2_012B20DE
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01308324 mov eax, dword ptr fs:[00000030h] 0_2_01308324
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01308324 mov ecx, dword ptr fs:[00000030h] 0_2_01308324
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01308324 mov eax, dword ptr fs:[00000030h] 0_2_01308324
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01308324 mov eax, dword ptr fs:[00000030h] 0_2_01308324
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A30B mov eax, dword ptr fs:[00000030h] 0_2_0126A30B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A30B mov eax, dword ptr fs:[00000030h] 0_2_0126A30B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A30B mov eax, dword ptr fs:[00000030h] 0_2_0126A30B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122C310 mov ecx, dword ptr fs:[00000030h] 0_2_0122C310
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01250310 mov ecx, dword ptr fs:[00000030h] 0_2_01250310
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D437C mov eax, dword ptr fs:[00000030h] 0_2_012D437C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B2349 mov eax, dword ptr fs:[00000030h] 0_2_012B2349
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B035C mov eax, dword ptr fs:[00000030h] 0_2_012B035C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B035C mov eax, dword ptr fs:[00000030h] 0_2_012B035C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B035C mov eax, dword ptr fs:[00000030h] 0_2_012B035C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B035C mov ecx, dword ptr fs:[00000030h] 0_2_012B035C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B035C mov eax, dword ptr fs:[00000030h] 0_2_012B035C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B035C mov eax, dword ptr fs:[00000030h] 0_2_012B035C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FA352 mov eax, dword ptr fs:[00000030h] 0_2_012FA352
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D8350 mov ecx, dword ptr fs:[00000030h] 0_2_012D8350
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0130634F mov eax, dword ptr fs:[00000030h] 0_2_0130634F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122E388 mov eax, dword ptr fs:[00000030h] 0_2_0122E388
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122E388 mov eax, dword ptr fs:[00000030h] 0_2_0122E388
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122E388 mov eax, dword ptr fs:[00000030h] 0_2_0122E388
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125438F mov eax, dword ptr fs:[00000030h] 0_2_0125438F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125438F mov eax, dword ptr fs:[00000030h] 0_2_0125438F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01228397 mov eax, dword ptr fs:[00000030h] 0_2_01228397
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01228397 mov eax, dword ptr fs:[00000030h] 0_2_01228397
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01228397 mov eax, dword ptr fs:[00000030h] 0_2_01228397
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012403E9 mov eax, dword ptr fs:[00000030h] 0_2_012403E9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E3F0 mov eax, dword ptr fs:[00000030h] 0_2_0124E3F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E3F0 mov eax, dword ptr fs:[00000030h] 0_2_0124E3F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E3F0 mov eax, dword ptr fs:[00000030h] 0_2_0124E3F0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012663FF mov eax, dword ptr fs:[00000030h] 0_2_012663FF
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EC3CD mov eax, dword ptr fs:[00000030h] 0_2_012EC3CD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0123A3C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0123A3C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0123A3C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0123A3C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0123A3C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A3C0 mov eax, dword ptr fs:[00000030h] 0_2_0123A3C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012383C0 mov eax, dword ptr fs:[00000030h] 0_2_012383C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012383C0 mov eax, dword ptr fs:[00000030h] 0_2_012383C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012383C0 mov eax, dword ptr fs:[00000030h] 0_2_012383C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012383C0 mov eax, dword ptr fs:[00000030h] 0_2_012383C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B63C0 mov eax, dword ptr fs:[00000030h] 0_2_012B63C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE3DB mov eax, dword ptr fs:[00000030h] 0_2_012DE3DB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE3DB mov eax, dword ptr fs:[00000030h] 0_2_012DE3DB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE3DB mov ecx, dword ptr fs:[00000030h] 0_2_012DE3DB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DE3DB mov eax, dword ptr fs:[00000030h] 0_2_012DE3DB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D43D4 mov eax, dword ptr fs:[00000030h] 0_2_012D43D4
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D43D4 mov eax, dword ptr fs:[00000030h] 0_2_012D43D4
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122823B mov eax, dword ptr fs:[00000030h] 0_2_0122823B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01234260 mov eax, dword ptr fs:[00000030h] 0_2_01234260
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01234260 mov eax, dword ptr fs:[00000030h] 0_2_01234260
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01234260 mov eax, dword ptr fs:[00000030h] 0_2_01234260
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122826B mov eax, dword ptr fs:[00000030h] 0_2_0122826B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E0274 mov eax, dword ptr fs:[00000030h] 0_2_012E0274
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B8243 mov eax, dword ptr fs:[00000030h] 0_2_012B8243
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B8243 mov ecx, dword ptr fs:[00000030h] 0_2_012B8243
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0130625D mov eax, dword ptr fs:[00000030h] 0_2_0130625D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122A250 mov eax, dword ptr fs:[00000030h] 0_2_0122A250
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236259 mov eax, dword ptr fs:[00000030h] 0_2_01236259
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EA250 mov eax, dword ptr fs:[00000030h] 0_2_012EA250
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EA250 mov eax, dword ptr fs:[00000030h] 0_2_012EA250
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012402A0 mov eax, dword ptr fs:[00000030h] 0_2_012402A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012402A0 mov eax, dword ptr fs:[00000030h] 0_2_012402A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C62A0 mov eax, dword ptr fs:[00000030h] 0_2_012C62A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C62A0 mov ecx, dword ptr fs:[00000030h] 0_2_012C62A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C62A0 mov eax, dword ptr fs:[00000030h] 0_2_012C62A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C62A0 mov eax, dword ptr fs:[00000030h] 0_2_012C62A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C62A0 mov eax, dword ptr fs:[00000030h] 0_2_012C62A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C62A0 mov eax, dword ptr fs:[00000030h] 0_2_012C62A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E284 mov eax, dword ptr fs:[00000030h] 0_2_0126E284
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E284 mov eax, dword ptr fs:[00000030h] 0_2_0126E284
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B0283 mov eax, dword ptr fs:[00000030h] 0_2_012B0283
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B0283 mov eax, dword ptr fs:[00000030h] 0_2_012B0283
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B0283 mov eax, dword ptr fs:[00000030h] 0_2_012B0283
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012402E1 mov eax, dword ptr fs:[00000030h] 0_2_012402E1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012402E1 mov eax, dword ptr fs:[00000030h] 0_2_012402E1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012402E1 mov eax, dword ptr fs:[00000030h] 0_2_012402E1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0123A2C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0123A2C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0123A2C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0123A2C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A2C3 mov eax, dword ptr fs:[00000030h] 0_2_0123A2C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_013062D6 mov eax, dword ptr fs:[00000030h] 0_2_013062D6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240535 mov eax, dword ptr fs:[00000030h] 0_2_01240535
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240535 mov eax, dword ptr fs:[00000030h] 0_2_01240535
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240535 mov eax, dword ptr fs:[00000030h] 0_2_01240535
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240535 mov eax, dword ptr fs:[00000030h] 0_2_01240535
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240535 mov eax, dword ptr fs:[00000030h] 0_2_01240535
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240535 mov eax, dword ptr fs:[00000030h] 0_2_01240535
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E53E mov eax, dword ptr fs:[00000030h] 0_2_0125E53E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E53E mov eax, dword ptr fs:[00000030h] 0_2_0125E53E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E53E mov eax, dword ptr fs:[00000030h] 0_2_0125E53E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E53E mov eax, dword ptr fs:[00000030h] 0_2_0125E53E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E53E mov eax, dword ptr fs:[00000030h] 0_2_0125E53E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C6500 mov eax, dword ptr fs:[00000030h] 0_2_012C6500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304500 mov eax, dword ptr fs:[00000030h] 0_2_01304500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304500 mov eax, dword ptr fs:[00000030h] 0_2_01304500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304500 mov eax, dword ptr fs:[00000030h] 0_2_01304500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304500 mov eax, dword ptr fs:[00000030h] 0_2_01304500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304500 mov eax, dword ptr fs:[00000030h] 0_2_01304500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304500 mov eax, dword ptr fs:[00000030h] 0_2_01304500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304500 mov eax, dword ptr fs:[00000030h] 0_2_01304500
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126656A mov eax, dword ptr fs:[00000030h] 0_2_0126656A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126656A mov eax, dword ptr fs:[00000030h] 0_2_0126656A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126656A mov eax, dword ptr fs:[00000030h] 0_2_0126656A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238550 mov eax, dword ptr fs:[00000030h] 0_2_01238550
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238550 mov eax, dword ptr fs:[00000030h] 0_2_01238550
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B05A7 mov eax, dword ptr fs:[00000030h] 0_2_012B05A7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B05A7 mov eax, dword ptr fs:[00000030h] 0_2_012B05A7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B05A7 mov eax, dword ptr fs:[00000030h] 0_2_012B05A7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012545B1 mov eax, dword ptr fs:[00000030h] 0_2_012545B1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012545B1 mov eax, dword ptr fs:[00000030h] 0_2_012545B1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01232582 mov eax, dword ptr fs:[00000030h] 0_2_01232582
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01232582 mov ecx, dword ptr fs:[00000030h] 0_2_01232582
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01264588 mov eax, dword ptr fs:[00000030h] 0_2_01264588
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E59C mov eax, dword ptr fs:[00000030h] 0_2_0126E59C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E5E7 mov eax, dword ptr fs:[00000030h] 0_2_0125E5E7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012325E0 mov eax, dword ptr fs:[00000030h] 0_2_012325E0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C5ED mov eax, dword ptr fs:[00000030h] 0_2_0126C5ED
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C5ED mov eax, dword ptr fs:[00000030h] 0_2_0126C5ED
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E5CF mov eax, dword ptr fs:[00000030h] 0_2_0126E5CF
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E5CF mov eax, dword ptr fs:[00000030h] 0_2_0126E5CF
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012365D0 mov eax, dword ptr fs:[00000030h] 0_2_012365D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A5D0 mov eax, dword ptr fs:[00000030h] 0_2_0126A5D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A5D0 mov eax, dword ptr fs:[00000030h] 0_2_0126A5D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122E420 mov eax, dword ptr fs:[00000030h] 0_2_0122E420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122E420 mov eax, dword ptr fs:[00000030h] 0_2_0122E420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122E420 mov eax, dword ptr fs:[00000030h] 0_2_0122E420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122C427 mov eax, dword ptr fs:[00000030h] 0_2_0122C427
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6420 mov eax, dword ptr fs:[00000030h] 0_2_012B6420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6420 mov eax, dword ptr fs:[00000030h] 0_2_012B6420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6420 mov eax, dword ptr fs:[00000030h] 0_2_012B6420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6420 mov eax, dword ptr fs:[00000030h] 0_2_012B6420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6420 mov eax, dword ptr fs:[00000030h] 0_2_012B6420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6420 mov eax, dword ptr fs:[00000030h] 0_2_012B6420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B6420 mov eax, dword ptr fs:[00000030h] 0_2_012B6420
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A430 mov eax, dword ptr fs:[00000030h] 0_2_0126A430
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01268402 mov eax, dword ptr fs:[00000030h] 0_2_01268402
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01268402 mov eax, dword ptr fs:[00000030h] 0_2_01268402
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01268402 mov eax, dword ptr fs:[00000030h] 0_2_01268402
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BC460 mov ecx, dword ptr fs:[00000030h] 0_2_012BC460
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125A470 mov eax, dword ptr fs:[00000030h] 0_2_0125A470
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125A470 mov eax, dword ptr fs:[00000030h] 0_2_0125A470
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125A470 mov eax, dword ptr fs:[00000030h] 0_2_0125A470
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126E443 mov eax, dword ptr fs:[00000030h] 0_2_0126E443
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EA456 mov eax, dword ptr fs:[00000030h] 0_2_012EA456
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122645D mov eax, dword ptr fs:[00000030h] 0_2_0122645D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125245A mov eax, dword ptr fs:[00000030h] 0_2_0125245A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012364AB mov eax, dword ptr fs:[00000030h] 0_2_012364AB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012644B0 mov ecx, dword ptr fs:[00000030h] 0_2_012644B0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BA4B0 mov eax, dword ptr fs:[00000030h] 0_2_012BA4B0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012EA49A mov eax, dword ptr fs:[00000030h] 0_2_012EA49A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012304E5 mov ecx, dword ptr fs:[00000030h] 0_2_012304E5
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C720 mov eax, dword ptr fs:[00000030h] 0_2_0126C720
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C720 mov eax, dword ptr fs:[00000030h] 0_2_0126C720
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126273C mov eax, dword ptr fs:[00000030h] 0_2_0126273C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126273C mov ecx, dword ptr fs:[00000030h] 0_2_0126273C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126273C mov eax, dword ptr fs:[00000030h] 0_2_0126273C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AC730 mov eax, dword ptr fs:[00000030h] 0_2_012AC730
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C700 mov eax, dword ptr fs:[00000030h] 0_2_0126C700
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230710 mov eax, dword ptr fs:[00000030h] 0_2_01230710
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01260710 mov eax, dword ptr fs:[00000030h] 0_2_01260710
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238770 mov eax, dword ptr fs:[00000030h] 0_2_01238770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240770 mov eax, dword ptr fs:[00000030h] 0_2_01240770
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126674D mov esi, dword ptr fs:[00000030h] 0_2_0126674D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126674D mov eax, dword ptr fs:[00000030h] 0_2_0126674D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126674D mov eax, dword ptr fs:[00000030h] 0_2_0126674D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230750 mov eax, dword ptr fs:[00000030h] 0_2_01230750
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BE75D mov eax, dword ptr fs:[00000030h] 0_2_012BE75D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272750 mov eax, dword ptr fs:[00000030h] 0_2_01272750
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272750 mov eax, dword ptr fs:[00000030h] 0_2_01272750
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B4755 mov eax, dword ptr fs:[00000030h] 0_2_012B4755
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012307AF mov eax, dword ptr fs:[00000030h] 0_2_012307AF
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E47A0 mov eax, dword ptr fs:[00000030h] 0_2_012E47A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D678E mov eax, dword ptr fs:[00000030h] 0_2_012D678E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012527ED mov eax, dword ptr fs:[00000030h] 0_2_012527ED
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012527ED mov eax, dword ptr fs:[00000030h] 0_2_012527ED
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012527ED mov eax, dword ptr fs:[00000030h] 0_2_012527ED
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BE7E1 mov eax, dword ptr fs:[00000030h] 0_2_012BE7E1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012347FB mov eax, dword ptr fs:[00000030h] 0_2_012347FB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012347FB mov eax, dword ptr fs:[00000030h] 0_2_012347FB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123C7C0 mov eax, dword ptr fs:[00000030h] 0_2_0123C7C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B07C3 mov eax, dword ptr fs:[00000030h] 0_2_012B07C3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124E627 mov eax, dword ptr fs:[00000030h] 0_2_0124E627
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01266620 mov eax, dword ptr fs:[00000030h] 0_2_01266620
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01268620 mov eax, dword ptr fs:[00000030h] 0_2_01268620
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123262C mov eax, dword ptr fs:[00000030h] 0_2_0123262C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE609 mov eax, dword ptr fs:[00000030h] 0_2_012AE609
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124260B mov eax, dword ptr fs:[00000030h] 0_2_0124260B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124260B mov eax, dword ptr fs:[00000030h] 0_2_0124260B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124260B mov eax, dword ptr fs:[00000030h] 0_2_0124260B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124260B mov eax, dword ptr fs:[00000030h] 0_2_0124260B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124260B mov eax, dword ptr fs:[00000030h] 0_2_0124260B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124260B mov eax, dword ptr fs:[00000030h] 0_2_0124260B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124260B mov eax, dword ptr fs:[00000030h] 0_2_0124260B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01272619 mov eax, dword ptr fs:[00000030h] 0_2_01272619
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F866E mov eax, dword ptr fs:[00000030h] 0_2_012F866E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F866E mov eax, dword ptr fs:[00000030h] 0_2_012F866E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A660 mov eax, dword ptr fs:[00000030h] 0_2_0126A660
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A660 mov eax, dword ptr fs:[00000030h] 0_2_0126A660
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01262674 mov eax, dword ptr fs:[00000030h] 0_2_01262674
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0124C640 mov eax, dword ptr fs:[00000030h] 0_2_0124C640
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C6A6 mov eax, dword ptr fs:[00000030h] 0_2_0126C6A6
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012666B0 mov eax, dword ptr fs:[00000030h] 0_2_012666B0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01234690 mov eax, dword ptr fs:[00000030h] 0_2_01234690
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01234690 mov eax, dword ptr fs:[00000030h] 0_2_01234690
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE6F2 mov eax, dword ptr fs:[00000030h] 0_2_012AE6F2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE6F2 mov eax, dword ptr fs:[00000030h] 0_2_012AE6F2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE6F2 mov eax, dword ptr fs:[00000030h] 0_2_012AE6F2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE6F2 mov eax, dword ptr fs:[00000030h] 0_2_012AE6F2
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B06F1 mov eax, dword ptr fs:[00000030h] 0_2_012B06F1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B06F1 mov eax, dword ptr fs:[00000030h] 0_2_012B06F1
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A6C7 mov ebx, dword ptr fs:[00000030h] 0_2_0126A6C7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A6C7 mov eax, dword ptr fs:[00000030h] 0_2_0126A6C7
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B892A mov eax, dword ptr fs:[00000030h] 0_2_012B892A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C892B mov eax, dword ptr fs:[00000030h] 0_2_012C892B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE908 mov eax, dword ptr fs:[00000030h] 0_2_012AE908
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AE908 mov eax, dword ptr fs:[00000030h] 0_2_012AE908
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BC912 mov eax, dword ptr fs:[00000030h] 0_2_012BC912
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01228918 mov eax, dword ptr fs:[00000030h] 0_2_01228918
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01228918 mov eax, dword ptr fs:[00000030h] 0_2_01228918
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01256962 mov eax, dword ptr fs:[00000030h] 0_2_01256962
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01256962 mov eax, dword ptr fs:[00000030h] 0_2_01256962
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01256962 mov eax, dword ptr fs:[00000030h] 0_2_01256962
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0127096E mov eax, dword ptr fs:[00000030h] 0_2_0127096E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0127096E mov edx, dword ptr fs:[00000030h] 0_2_0127096E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0127096E mov eax, dword ptr fs:[00000030h] 0_2_0127096E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D4978 mov eax, dword ptr fs:[00000030h] 0_2_012D4978
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D4978 mov eax, dword ptr fs:[00000030h] 0_2_012D4978
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BC97C mov eax, dword ptr fs:[00000030h] 0_2_012BC97C
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B0946 mov eax, dword ptr fs:[00000030h] 0_2_012B0946
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304940 mov eax, dword ptr fs:[00000030h] 0_2_01304940
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012429A0 mov eax, dword ptr fs:[00000030h] 0_2_012429A0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012309AD mov eax, dword ptr fs:[00000030h] 0_2_012309AD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012309AD mov eax, dword ptr fs:[00000030h] 0_2_012309AD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B89B3 mov esi, dword ptr fs:[00000030h] 0_2_012B89B3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B89B3 mov eax, dword ptr fs:[00000030h] 0_2_012B89B3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012B89B3 mov eax, dword ptr fs:[00000030h] 0_2_012B89B3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BE9E0 mov eax, dword ptr fs:[00000030h] 0_2_012BE9E0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012629F9 mov eax, dword ptr fs:[00000030h] 0_2_012629F9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012629F9 mov eax, dword ptr fs:[00000030h] 0_2_012629F9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C69C0 mov eax, dword ptr fs:[00000030h] 0_2_012C69C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0123A9D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0123A9D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0123A9D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0123A9D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0123A9D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123A9D0 mov eax, dword ptr fs:[00000030h] 0_2_0123A9D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012649D0 mov eax, dword ptr fs:[00000030h] 0_2_012649D0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FA9D3 mov eax, dword ptr fs:[00000030h] 0_2_012FA9D3
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01252835 mov eax, dword ptr fs:[00000030h] 0_2_01252835
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01252835 mov eax, dword ptr fs:[00000030h] 0_2_01252835
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01252835 mov eax, dword ptr fs:[00000030h] 0_2_01252835
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01252835 mov ecx, dword ptr fs:[00000030h] 0_2_01252835
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01252835 mov eax, dword ptr fs:[00000030h] 0_2_01252835
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01252835 mov eax, dword ptr fs:[00000030h] 0_2_01252835
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126A830 mov eax, dword ptr fs:[00000030h] 0_2_0126A830
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D483A mov eax, dword ptr fs:[00000030h] 0_2_012D483A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D483A mov eax, dword ptr fs:[00000030h] 0_2_012D483A
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BC810 mov eax, dword ptr fs:[00000030h] 0_2_012BC810
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BE872 mov eax, dword ptr fs:[00000030h] 0_2_012BE872
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BE872 mov eax, dword ptr fs:[00000030h] 0_2_012BE872
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C6870 mov eax, dword ptr fs:[00000030h] 0_2_012C6870
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C6870 mov eax, dword ptr fs:[00000030h] 0_2_012C6870
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01242840 mov ecx, dword ptr fs:[00000030h] 0_2_01242840
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01260854 mov eax, dword ptr fs:[00000030h] 0_2_01260854
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01234859 mov eax, dword ptr fs:[00000030h] 0_2_01234859
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01234859 mov eax, dword ptr fs:[00000030h] 0_2_01234859
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230887 mov eax, dword ptr fs:[00000030h] 0_2_01230887
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BC89D mov eax, dword ptr fs:[00000030h] 0_2_012BC89D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FA8E4 mov eax, dword ptr fs:[00000030h] 0_2_012FA8E4
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C8F9 mov eax, dword ptr fs:[00000030h] 0_2_0126C8F9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126C8F9 mov eax, dword ptr fs:[00000030h] 0_2_0126C8F9
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125E8C0 mov eax, dword ptr fs:[00000030h] 0_2_0125E8C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_013008C0 mov eax, dword ptr fs:[00000030h] 0_2_013008C0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125EB20 mov eax, dword ptr fs:[00000030h] 0_2_0125EB20
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125EB20 mov eax, dword ptr fs:[00000030h] 0_2_0125EB20
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F8B28 mov eax, dword ptr fs:[00000030h] 0_2_012F8B28
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012F8B28 mov eax, dword ptr fs:[00000030h] 0_2_012F8B28
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01304B00 mov eax, dword ptr fs:[00000030h] 0_2_01304B00
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012AEB1D mov eax, dword ptr fs:[00000030h] 0_2_012AEB1D
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0122CB7E mov eax, dword ptr fs:[00000030h] 0_2_0122CB7E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E4B4B mov eax, dword ptr fs:[00000030h] 0_2_012E4B4B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E4B4B mov eax, dword ptr fs:[00000030h] 0_2_012E4B4B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01302B57 mov eax, dword ptr fs:[00000030h] 0_2_01302B57
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01302B57 mov eax, dword ptr fs:[00000030h] 0_2_01302B57
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01302B57 mov eax, dword ptr fs:[00000030h] 0_2_01302B57
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01302B57 mov eax, dword ptr fs:[00000030h] 0_2_01302B57
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C6B40 mov eax, dword ptr fs:[00000030h] 0_2_012C6B40
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012C6B40 mov eax, dword ptr fs:[00000030h] 0_2_012C6B40
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012FAB40 mov eax, dword ptr fs:[00000030h] 0_2_012FAB40
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012D8B42 mov eax, dword ptr fs:[00000030h] 0_2_012D8B42
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01228B50 mov eax, dword ptr fs:[00000030h] 0_2_01228B50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DEB50 mov eax, dword ptr fs:[00000030h] 0_2_012DEB50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240BBE mov eax, dword ptr fs:[00000030h] 0_2_01240BBE
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240BBE mov eax, dword ptr fs:[00000030h] 0_2_01240BBE
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E4BB0 mov eax, dword ptr fs:[00000030h] 0_2_012E4BB0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012E4BB0 mov eax, dword ptr fs:[00000030h] 0_2_012E4BB0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238BF0 mov eax, dword ptr fs:[00000030h] 0_2_01238BF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238BF0 mov eax, dword ptr fs:[00000030h] 0_2_01238BF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238BF0 mov eax, dword ptr fs:[00000030h] 0_2_01238BF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125EBFC mov eax, dword ptr fs:[00000030h] 0_2_0125EBFC
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BCBF0 mov eax, dword ptr fs:[00000030h] 0_2_012BCBF0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01250BCB mov eax, dword ptr fs:[00000030h] 0_2_01250BCB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01250BCB mov eax, dword ptr fs:[00000030h] 0_2_01250BCB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01250BCB mov eax, dword ptr fs:[00000030h] 0_2_01250BCB
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230BCD mov eax, dword ptr fs:[00000030h] 0_2_01230BCD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230BCD mov eax, dword ptr fs:[00000030h] 0_2_01230BCD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01230BCD mov eax, dword ptr fs:[00000030h] 0_2_01230BCD
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DEBD0 mov eax, dword ptr fs:[00000030h] 0_2_012DEBD0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126CA24 mov eax, dword ptr fs:[00000030h] 0_2_0126CA24
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0125EA2E mov eax, dword ptr fs:[00000030h] 0_2_0125EA2E
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01254A35 mov eax, dword ptr fs:[00000030h] 0_2_01254A35
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01254A35 mov eax, dword ptr fs:[00000030h] 0_2_01254A35
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126CA38 mov eax, dword ptr fs:[00000030h] 0_2_0126CA38
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012BCA11 mov eax, dword ptr fs:[00000030h] 0_2_012BCA11
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126CA6F mov eax, dword ptr fs:[00000030h] 0_2_0126CA6F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126CA6F mov eax, dword ptr fs:[00000030h] 0_2_0126CA6F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0126CA6F mov eax, dword ptr fs:[00000030h] 0_2_0126CA6F
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012DEA60 mov eax, dword ptr fs:[00000030h] 0_2_012DEA60
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012ACA72 mov eax, dword ptr fs:[00000030h] 0_2_012ACA72
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_012ACA72 mov eax, dword ptr fs:[00000030h] 0_2_012ACA72
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236A50 mov eax, dword ptr fs:[00000030h] 0_2_01236A50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236A50 mov eax, dword ptr fs:[00000030h] 0_2_01236A50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236A50 mov eax, dword ptr fs:[00000030h] 0_2_01236A50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236A50 mov eax, dword ptr fs:[00000030h] 0_2_01236A50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236A50 mov eax, dword ptr fs:[00000030h] 0_2_01236A50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236A50 mov eax, dword ptr fs:[00000030h] 0_2_01236A50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01236A50 mov eax, dword ptr fs:[00000030h] 0_2_01236A50
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240A5B mov eax, dword ptr fs:[00000030h] 0_2_01240A5B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01240A5B mov eax, dword ptr fs:[00000030h] 0_2_01240A5B
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238AA0 mov eax, dword ptr fs:[00000030h] 0_2_01238AA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01238AA0 mov eax, dword ptr fs:[00000030h] 0_2_01238AA0
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_01286AA4 mov eax, dword ptr fs:[00000030h] 0_2_01286AA4
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
Source: C:\Users\user\Desktop\173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe Code function: 0_2_0123EA80 mov eax, dword ptr fs:[00000030h] 0_2_0123EA80
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.2.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.2.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.2.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.2.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2041198261.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2041198261.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1566420 Sample: 173312131497fead2ebdffba48e... Startdate: 02/12/2024 Architecture: WINDOWS Score: 80 10 Malicious sample detected (through community Yara rule) 2->10 12 Antivirus / Scanner detection for submitted sample 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 3 other signatures 2->16 6 173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe 2->6         started        process3 process4 8 WerFault.exe 22 16 6->8         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true