| Source: 3.0.ByteCodeGenerator.exe.400000.3.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.0.ByteCodeGenerator.exe.400000.3.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 3.0.ByteCodeGenerator.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.0.ByteCodeGenerator.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 3.2.ByteCodeGenerator.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.2.ByteCodeGenerator.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 3.2.ByteCodeGenerator.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.2.ByteCodeGenerator.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 3.0.ByteCodeGenerator.exe.400000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.0.ByteCodeGenerator.exe.400000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 3.0.ByteCodeGenerator.exe.400000.2.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.0.ByteCodeGenerator.exe.400000.2.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.SecuriteInfo.com.Variant.Tedy.130342.18814.exe.4bce918.1.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender |
| Source: 0.2.SecuriteInfo.com.Variant.Tedy.130342.18814.exe.4bce918.1.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object |
| Source: 3.0.ByteCodeGenerator.exe.400000.1.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.0.ByteCodeGenerator.exe.400000.1.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 3.0.ByteCodeGenerator.exe.400000.3.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.0.ByteCodeGenerator.exe.400000.3.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 3.0.ByteCodeGenerator.exe.400000.2.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 3.0.ByteCodeGenerator.exe.400000.2.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000000.471199219.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000000.471199219.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000000.470778539.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000000.470778539.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0000000C.00000002.707469060.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0000000C.00000002.707469060.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000004.00000000.533300024.0000000005B9A000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000004.00000000.533300024.0000000005B9A000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000004.00000000.513489612.0000000005B9A000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000004.00000000.513489612.0000000005B9A000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000000.00000002.487374826.0000000004C33000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000000.00000002.487374826.0000000004C33000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0000000C.00000002.707690856.0000000003980000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0000000C.00000002.707690856.0000000003980000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000002.567277416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000002.567277416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000000.470404681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000000.470404681.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000000.00000002.487565258.0000000004C93000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000000.00000002.487565258.0000000004C93000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000002.568261585.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000002.568261585.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 0000000C.00000002.706770545.0000000003340000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 0000000C.00000002.706770545.0000000003340000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000003.00000002.568042051.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000003.00000002.568042051.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000000.00000002.489825108.0000000004F1D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
| Source: 00000000.00000002.489825108.0000000004F1D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342DB40 mov eax, dword ptr fs:[00000030h] | 3_2_0342DB40 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F8B58 mov eax, dword ptr fs:[00000030h] | 3_2_034F8B58 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342F358 mov eax, dword ptr fs:[00000030h] | 3_2_0342F358 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342DB60 mov ecx, dword ptr fs:[00000030h] | 3_2_0342DB60 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03453B7A mov eax, dword ptr fs:[00000030h] | 3_2_03453B7A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03453B7A mov eax, dword ptr fs:[00000030h] | 3_2_03453B7A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E131B mov eax, dword ptr fs:[00000030h] | 3_2_034E131B |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A53CA mov eax, dword ptr fs:[00000030h] | 3_2_034A53CA |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A53CA mov eax, dword ptr fs:[00000030h] | 3_2_034A53CA |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034503E2 mov eax, dword ptr fs:[00000030h] | 3_2_034503E2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034503E2 mov eax, dword ptr fs:[00000030h] | 3_2_034503E2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034503E2 mov eax, dword ptr fs:[00000030h] | 3_2_034503E2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034503E2 mov eax, dword ptr fs:[00000030h] | 3_2_034503E2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034503E2 mov eax, dword ptr fs:[00000030h] | 3_2_034503E2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034503E2 mov eax, dword ptr fs:[00000030h] | 3_2_034503E2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344DBE9 mov eax, dword ptr fs:[00000030h] | 3_2_0344DBE9 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E138A mov eax, dword ptr fs:[00000030h] | 3_2_034E138A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03431B8F mov eax, dword ptr fs:[00000030h] | 3_2_03431B8F |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03431B8F mov eax, dword ptr fs:[00000030h] | 3_2_03431B8F |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034DD380 mov ecx, dword ptr fs:[00000030h] | 3_2_034DD380 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452397 mov eax, dword ptr fs:[00000030h] | 3_2_03452397 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345B390 mov eax, dword ptr fs:[00000030h] | 3_2_0345B390 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03454BAD mov eax, dword ptr fs:[00000030h] | 3_2_03454BAD |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03454BAD mov eax, dword ptr fs:[00000030h] | 3_2_03454BAD |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03454BAD mov eax, dword ptr fs:[00000030h] | 3_2_03454BAD |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F5BA5 mov eax, dword ptr fs:[00000030h] | 3_2_034F5BA5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429240 mov eax, dword ptr fs:[00000030h] | 3_2_03429240 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429240 mov eax, dword ptr fs:[00000030h] | 3_2_03429240 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429240 mov eax, dword ptr fs:[00000030h] | 3_2_03429240 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429240 mov eax, dword ptr fs:[00000030h] | 3_2_03429240 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EEA55 mov eax, dword ptr fs:[00000030h] | 3_2_034EEA55 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034B4257 mov eax, dword ptr fs:[00000030h] | 3_2_034B4257 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034DB260 mov eax, dword ptr fs:[00000030h] | 3_2_034DB260 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034DB260 mov eax, dword ptr fs:[00000030h] | 3_2_034DB260 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F8A62 mov eax, dword ptr fs:[00000030h] | 3_2_034F8A62 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0346927A mov eax, dword ptr fs:[00000030h] | 3_2_0346927A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03438A0A mov eax, dword ptr fs:[00000030h] | 3_2_03438A0A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03425210 mov eax, dword ptr fs:[00000030h] | 3_2_03425210 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03425210 mov ecx, dword ptr fs:[00000030h] | 3_2_03425210 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03425210 mov eax, dword ptr fs:[00000030h] | 3_2_03425210 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03425210 mov eax, dword ptr fs:[00000030h] | 3_2_03425210 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342AA16 mov eax, dword ptr fs:[00000030h] | 3_2_0342AA16 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342AA16 mov eax, dword ptr fs:[00000030h] | 3_2_0342AA16 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03443A1C mov eax, dword ptr fs:[00000030h] | 3_2_03443A1C |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EAA16 mov eax, dword ptr fs:[00000030h] | 3_2_034EAA16 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EAA16 mov eax, dword ptr fs:[00000030h] | 3_2_034EAA16 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03464A2C mov eax, dword ptr fs:[00000030h] | 3_2_03464A2C |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03464A2C mov eax, dword ptr fs:[00000030h] | 3_2_03464A2C |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452ACB mov eax, dword ptr fs:[00000030h] | 3_2_03452ACB |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452AE4 mov eax, dword ptr fs:[00000030h] | 3_2_03452AE4 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345D294 mov eax, dword ptr fs:[00000030h] | 3_2_0345D294 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345D294 mov eax, dword ptr fs:[00000030h] | 3_2_0345D294 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034252A5 mov eax, dword ptr fs:[00000030h] | 3_2_034252A5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034252A5 mov eax, dword ptr fs:[00000030h] | 3_2_034252A5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034252A5 mov eax, dword ptr fs:[00000030h] | 3_2_034252A5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034252A5 mov eax, dword ptr fs:[00000030h] | 3_2_034252A5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034252A5 mov eax, dword ptr fs:[00000030h] | 3_2_034252A5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343AAB0 mov eax, dword ptr fs:[00000030h] | 3_2_0343AAB0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343AAB0 mov eax, dword ptr fs:[00000030h] | 3_2_0343AAB0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345FAB0 mov eax, dword ptr fs:[00000030h] | 3_2_0345FAB0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344B944 mov eax, dword ptr fs:[00000030h] | 3_2_0344B944 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344B944 mov eax, dword ptr fs:[00000030h] | 3_2_0344B944 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342C962 mov eax, dword ptr fs:[00000030h] | 3_2_0342C962 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342B171 mov eax, dword ptr fs:[00000030h] | 3_2_0342B171 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342B171 mov eax, dword ptr fs:[00000030h] | 3_2_0342B171 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429100 mov eax, dword ptr fs:[00000030h] | 3_2_03429100 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429100 mov eax, dword ptr fs:[00000030h] | 3_2_03429100 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429100 mov eax, dword ptr fs:[00000030h] | 3_2_03429100 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03444120 mov eax, dword ptr fs:[00000030h] | 3_2_03444120 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03444120 mov eax, dword ptr fs:[00000030h] | 3_2_03444120 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03444120 mov eax, dword ptr fs:[00000030h] | 3_2_03444120 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03444120 mov eax, dword ptr fs:[00000030h] | 3_2_03444120 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03444120 mov ecx, dword ptr fs:[00000030h] | 3_2_03444120 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345513A mov eax, dword ptr fs:[00000030h] | 3_2_0345513A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345513A mov eax, dword ptr fs:[00000030h] | 3_2_0345513A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342B1E1 mov eax, dword ptr fs:[00000030h] | 3_2_0342B1E1 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342B1E1 mov eax, dword ptr fs:[00000030h] | 3_2_0342B1E1 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342B1E1 mov eax, dword ptr fs:[00000030h] | 3_2_0342B1E1 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034B41E8 mov eax, dword ptr fs:[00000030h] | 3_2_034B41E8 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345A185 mov eax, dword ptr fs:[00000030h] | 3_2_0345A185 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344C182 mov eax, dword ptr fs:[00000030h] | 3_2_0344C182 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452990 mov eax, dword ptr fs:[00000030h] | 3_2_03452990 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034561A0 mov eax, dword ptr fs:[00000030h] | 3_2_034561A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034561A0 mov eax, dword ptr fs:[00000030h] | 3_2_034561A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A69A6 mov eax, dword ptr fs:[00000030h] | 3_2_034A69A6 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A51BE mov eax, dword ptr fs:[00000030h] | 3_2_034A51BE |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A51BE mov eax, dword ptr fs:[00000030h] | 3_2_034A51BE |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A51BE mov eax, dword ptr fs:[00000030h] | 3_2_034A51BE |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A51BE mov eax, dword ptr fs:[00000030h] | 3_2_034A51BE |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03440050 mov eax, dword ptr fs:[00000030h] | 3_2_03440050 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03440050 mov eax, dword ptr fs:[00000030h] | 3_2_03440050 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F1074 mov eax, dword ptr fs:[00000030h] | 3_2_034F1074 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E2073 mov eax, dword ptr fs:[00000030h] | 3_2_034E2073 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F4015 mov eax, dword ptr fs:[00000030h] | 3_2_034F4015 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F4015 mov eax, dword ptr fs:[00000030h] | 3_2_034F4015 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A7016 mov eax, dword ptr fs:[00000030h] | 3_2_034A7016 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A7016 mov eax, dword ptr fs:[00000030h] | 3_2_034A7016 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A7016 mov eax, dword ptr fs:[00000030h] | 3_2_034A7016 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345002D mov eax, dword ptr fs:[00000030h] | 3_2_0345002D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345002D mov eax, dword ptr fs:[00000030h] | 3_2_0345002D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345002D mov eax, dword ptr fs:[00000030h] | 3_2_0345002D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345002D mov eax, dword ptr fs:[00000030h] | 3_2_0345002D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345002D mov eax, dword ptr fs:[00000030h] | 3_2_0345002D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343B02A mov eax, dword ptr fs:[00000030h] | 3_2_0343B02A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343B02A mov eax, dword ptr fs:[00000030h] | 3_2_0343B02A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343B02A mov eax, dword ptr fs:[00000030h] | 3_2_0343B02A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343B02A mov eax, dword ptr fs:[00000030h] | 3_2_0343B02A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BB8D0 mov eax, dword ptr fs:[00000030h] | 3_2_034BB8D0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BB8D0 mov ecx, dword ptr fs:[00000030h] | 3_2_034BB8D0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BB8D0 mov eax, dword ptr fs:[00000030h] | 3_2_034BB8D0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BB8D0 mov eax, dword ptr fs:[00000030h] | 3_2_034BB8D0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BB8D0 mov eax, dword ptr fs:[00000030h] | 3_2_034BB8D0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BB8D0 mov eax, dword ptr fs:[00000030h] | 3_2_034BB8D0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034258EC mov eax, dword ptr fs:[00000030h] | 3_2_034258EC |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03429080 mov eax, dword ptr fs:[00000030h] | 3_2_03429080 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A3884 mov eax, dword ptr fs:[00000030h] | 3_2_034A3884 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A3884 mov eax, dword ptr fs:[00000030h] | 3_2_034A3884 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034520A0 mov eax, dword ptr fs:[00000030h] | 3_2_034520A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034520A0 mov eax, dword ptr fs:[00000030h] | 3_2_034520A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034520A0 mov eax, dword ptr fs:[00000030h] | 3_2_034520A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034520A0 mov eax, dword ptr fs:[00000030h] | 3_2_034520A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034520A0 mov eax, dword ptr fs:[00000030h] | 3_2_034520A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034520A0 mov eax, dword ptr fs:[00000030h] | 3_2_034520A0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034690AF mov eax, dword ptr fs:[00000030h] | 3_2_034690AF |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345F0BF mov ecx, dword ptr fs:[00000030h] | 3_2_0345F0BF |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345F0BF mov eax, dword ptr fs:[00000030h] | 3_2_0345F0BF |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345F0BF mov eax, dword ptr fs:[00000030h] | 3_2_0345F0BF |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343EF40 mov eax, dword ptr fs:[00000030h] | 3_2_0343EF40 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343FF60 mov eax, dword ptr fs:[00000030h] | 3_2_0343FF60 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F8F6A mov eax, dword ptr fs:[00000030h] | 3_2_034F8F6A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F070D mov eax, dword ptr fs:[00000030h] | 3_2_034F070D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F070D mov eax, dword ptr fs:[00000030h] | 3_2_034F070D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345A70E mov eax, dword ptr fs:[00000030h] | 3_2_0345A70E |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345A70E mov eax, dword ptr fs:[00000030h] | 3_2_0345A70E |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344F716 mov eax, dword ptr fs:[00000030h] | 3_2_0344F716 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BFF10 mov eax, dword ptr fs:[00000030h] | 3_2_034BFF10 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BFF10 mov eax, dword ptr fs:[00000030h] | 3_2_034BFF10 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03424F2E mov eax, dword ptr fs:[00000030h] | 3_2_03424F2E |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03424F2E mov eax, dword ptr fs:[00000030h] | 3_2_03424F2E |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345E730 mov eax, dword ptr fs:[00000030h] | 3_2_0345E730 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034637F5 mov eax, dword ptr fs:[00000030h] | 3_2_034637F5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03438794 mov eax, dword ptr fs:[00000030h] | 3_2_03438794 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A7794 mov eax, dword ptr fs:[00000030h] | 3_2_034A7794 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A7794 mov eax, dword ptr fs:[00000030h] | 3_2_034A7794 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A7794 mov eax, dword ptr fs:[00000030h] | 3_2_034A7794 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03437E41 mov eax, dword ptr fs:[00000030h] | 3_2_03437E41 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03437E41 mov eax, dword ptr fs:[00000030h] | 3_2_03437E41 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03437E41 mov eax, dword ptr fs:[00000030h] | 3_2_03437E41 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03437E41 mov eax, dword ptr fs:[00000030h] | 3_2_03437E41 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03437E41 mov eax, dword ptr fs:[00000030h] | 3_2_03437E41 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03437E41 mov eax, dword ptr fs:[00000030h] | 3_2_03437E41 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EAE44 mov eax, dword ptr fs:[00000030h] | 3_2_034EAE44 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EAE44 mov eax, dword ptr fs:[00000030h] | 3_2_034EAE44 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343766D mov eax, dword ptr fs:[00000030h] | 3_2_0343766D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344AE73 mov eax, dword ptr fs:[00000030h] | 3_2_0344AE73 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344AE73 mov eax, dword ptr fs:[00000030h] | 3_2_0344AE73 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344AE73 mov eax, dword ptr fs:[00000030h] | 3_2_0344AE73 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344AE73 mov eax, dword ptr fs:[00000030h] | 3_2_0344AE73 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344AE73 mov eax, dword ptr fs:[00000030h] | 3_2_0344AE73 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342C600 mov eax, dword ptr fs:[00000030h] | 3_2_0342C600 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342C600 mov eax, dword ptr fs:[00000030h] | 3_2_0342C600 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342C600 mov eax, dword ptr fs:[00000030h] | 3_2_0342C600 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03458E00 mov eax, dword ptr fs:[00000030h] | 3_2_03458E00 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1608 mov eax, dword ptr fs:[00000030h] | 3_2_034E1608 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345A61C mov eax, dword ptr fs:[00000030h] | 3_2_0345A61C |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345A61C mov eax, dword ptr fs:[00000030h] | 3_2_0345A61C |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342E620 mov eax, dword ptr fs:[00000030h] | 3_2_0342E620 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034DFE3F mov eax, dword ptr fs:[00000030h] | 3_2_034DFE3F |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03468EC7 mov eax, dword ptr fs:[00000030h] | 3_2_03468EC7 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034536CC mov eax, dword ptr fs:[00000030h] | 3_2_034536CC |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034DFEC0 mov eax, dword ptr fs:[00000030h] | 3_2_034DFEC0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F8ED6 mov eax, dword ptr fs:[00000030h] | 3_2_034F8ED6 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034376E2 mov eax, dword ptr fs:[00000030h] | 3_2_034376E2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034516E0 mov ecx, dword ptr fs:[00000030h] | 3_2_034516E0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BFE87 mov eax, dword ptr fs:[00000030h] | 3_2_034BFE87 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F0EA5 mov eax, dword ptr fs:[00000030h] | 3_2_034F0EA5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F0EA5 mov eax, dword ptr fs:[00000030h] | 3_2_034F0EA5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F0EA5 mov eax, dword ptr fs:[00000030h] | 3_2_034F0EA5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A46A7 mov eax, dword ptr fs:[00000030h] | 3_2_034A46A7 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03463D43 mov eax, dword ptr fs:[00000030h] | 3_2_03463D43 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A3540 mov eax, dword ptr fs:[00000030h] | 3_2_034A3540 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03447D50 mov eax, dword ptr fs:[00000030h] | 3_2_03447D50 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344C577 mov eax, dword ptr fs:[00000030h] | 3_2_0344C577 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344C577 mov eax, dword ptr fs:[00000030h] | 3_2_0344C577 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0342AD30 mov eax, dword ptr fs:[00000030h] | 3_2_0342AD30 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03433D34 mov eax, dword ptr fs:[00000030h] | 3_2_03433D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EE539 mov eax, dword ptr fs:[00000030h] | 3_2_034EE539 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F8D34 mov eax, dword ptr fs:[00000030h] | 3_2_034F8D34 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034AA537 mov eax, dword ptr fs:[00000030h] | 3_2_034AA537 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03454D3B mov eax, dword ptr fs:[00000030h] | 3_2_03454D3B |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03454D3B mov eax, dword ptr fs:[00000030h] | 3_2_03454D3B |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03454D3B mov eax, dword ptr fs:[00000030h] | 3_2_03454D3B |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6DC9 mov eax, dword ptr fs:[00000030h] | 3_2_034A6DC9 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6DC9 mov eax, dword ptr fs:[00000030h] | 3_2_034A6DC9 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6DC9 mov eax, dword ptr fs:[00000030h] | 3_2_034A6DC9 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6DC9 mov ecx, dword ptr fs:[00000030h] | 3_2_034A6DC9 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6DC9 mov eax, dword ptr fs:[00000030h] | 3_2_034A6DC9 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6DC9 mov eax, dword ptr fs:[00000030h] | 3_2_034A6DC9 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343D5E0 mov eax, dword ptr fs:[00000030h] | 3_2_0343D5E0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343D5E0 mov eax, dword ptr fs:[00000030h] | 3_2_0343D5E0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EFDE2 mov eax, dword ptr fs:[00000030h] | 3_2_034EFDE2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EFDE2 mov eax, dword ptr fs:[00000030h] | 3_2_034EFDE2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EFDE2 mov eax, dword ptr fs:[00000030h] | 3_2_034EFDE2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034EFDE2 mov eax, dword ptr fs:[00000030h] | 3_2_034EFDE2 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034D8DF1 mov eax, dword ptr fs:[00000030h] | 3_2_034D8DF1 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452581 mov eax, dword ptr fs:[00000030h] | 3_2_03452581 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452581 mov eax, dword ptr fs:[00000030h] | 3_2_03452581 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452581 mov eax, dword ptr fs:[00000030h] | 3_2_03452581 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03452581 mov eax, dword ptr fs:[00000030h] | 3_2_03452581 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03422D8A mov eax, dword ptr fs:[00000030h] | 3_2_03422D8A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03422D8A mov eax, dword ptr fs:[00000030h] | 3_2_03422D8A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03422D8A mov eax, dword ptr fs:[00000030h] | 3_2_03422D8A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03422D8A mov eax, dword ptr fs:[00000030h] | 3_2_03422D8A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03422D8A mov eax, dword ptr fs:[00000030h] | 3_2_03422D8A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345FD9B mov eax, dword ptr fs:[00000030h] | 3_2_0345FD9B |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345FD9B mov eax, dword ptr fs:[00000030h] | 3_2_0345FD9B |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F05AC mov eax, dword ptr fs:[00000030h] | 3_2_034F05AC |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F05AC mov eax, dword ptr fs:[00000030h] | 3_2_034F05AC |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034535A1 mov eax, dword ptr fs:[00000030h] | 3_2_034535A1 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03451DB5 mov eax, dword ptr fs:[00000030h] | 3_2_03451DB5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03451DB5 mov eax, dword ptr fs:[00000030h] | 3_2_03451DB5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_03451DB5 mov eax, dword ptr fs:[00000030h] | 3_2_03451DB5 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345A44B mov eax, dword ptr fs:[00000030h] | 3_2_0345A44B |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BC450 mov eax, dword ptr fs:[00000030h] | 3_2_034BC450 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034BC450 mov eax, dword ptr fs:[00000030h] | 3_2_034BC450 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0344746D mov eax, dword ptr fs:[00000030h] | 3_2_0344746D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6C0A mov eax, dword ptr fs:[00000030h] | 3_2_034A6C0A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6C0A mov eax, dword ptr fs:[00000030h] | 3_2_034A6C0A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6C0A mov eax, dword ptr fs:[00000030h] | 3_2_034A6C0A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6C0A mov eax, dword ptr fs:[00000030h] | 3_2_034A6C0A |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F740D mov eax, dword ptr fs:[00000030h] | 3_2_034F740D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F740D mov eax, dword ptr fs:[00000030h] | 3_2_034F740D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F740D mov eax, dword ptr fs:[00000030h] | 3_2_034F740D |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E1C06 mov eax, dword ptr fs:[00000030h] | 3_2_034E1C06 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0345BC2C mov eax, dword ptr fs:[00000030h] | 3_2_0345BC2C |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034F8CD6 mov eax, dword ptr fs:[00000030h] | 3_2_034F8CD6 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034E14FB mov eax, dword ptr fs:[00000030h] | 3_2_034E14FB |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6CF0 mov eax, dword ptr fs:[00000030h] | 3_2_034A6CF0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6CF0 mov eax, dword ptr fs:[00000030h] | 3_2_034A6CF0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_034A6CF0 mov eax, dword ptr fs:[00000030h] | 3_2_034A6CF0 |
| Source: C:\Windows\SysWOW64\ByteCodeGenerator.exe | Code function: 3_2_0343849B mov eax, dword ptr fs:[00000030h] | 3_2_0343849B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C7D50 mov eax, dword ptr fs:[00000030h] | 12_2_055C7D50 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CB944 mov eax, dword ptr fs:[00000030h] | 12_2_055CB944 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CB944 mov eax, dword ptr fs:[00000030h] | 12_2_055CB944 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055E3D43 mov eax, dword ptr fs:[00000030h] | 12_2_055E3D43 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05623540 mov eax, dword ptr fs:[00000030h] | 12_2_05623540 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AB171 mov eax, dword ptr fs:[00000030h] | 12_2_055AB171 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AB171 mov eax, dword ptr fs:[00000030h] | 12_2_055AB171 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CC577 mov eax, dword ptr fs:[00000030h] | 12_2_055CC577 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CC577 mov eax, dword ptr fs:[00000030h] | 12_2_055CC577 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AC962 mov eax, dword ptr fs:[00000030h] | 12_2_055AC962 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05678D34 mov eax, dword ptr fs:[00000030h] | 12_2_05678D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0562A537 mov eax, dword ptr fs:[00000030h] | 12_2_0562A537 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9100 mov eax, dword ptr fs:[00000030h] | 12_2_055A9100 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9100 mov eax, dword ptr fs:[00000030h] | 12_2_055A9100 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9100 mov eax, dword ptr fs:[00000030h] | 12_2_055A9100 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566E539 mov eax, dword ptr fs:[00000030h] | 12_2_0566E539 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D4D3B mov eax, dword ptr fs:[00000030h] | 12_2_055D4D3B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D4D3B mov eax, dword ptr fs:[00000030h] | 12_2_055D4D3B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D4D3B mov eax, dword ptr fs:[00000030h] | 12_2_055D4D3B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D513A mov eax, dword ptr fs:[00000030h] | 12_2_055D513A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D513A mov eax, dword ptr fs:[00000030h] | 12_2_055D513A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AAD30 mov eax, dword ptr fs:[00000030h] | 12_2_055AAD30 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B3D34 mov eax, dword ptr fs:[00000030h] | 12_2_055B3D34 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C4120 mov eax, dword ptr fs:[00000030h] | 12_2_055C4120 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C4120 mov eax, dword ptr fs:[00000030h] | 12_2_055C4120 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C4120 mov eax, dword ptr fs:[00000030h] | 12_2_055C4120 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C4120 mov eax, dword ptr fs:[00000030h] | 12_2_055C4120 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C4120 mov ecx, dword ptr fs:[00000030h] | 12_2_055C4120 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566FDE2 mov eax, dword ptr fs:[00000030h] | 12_2_0566FDE2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566FDE2 mov eax, dword ptr fs:[00000030h] | 12_2_0566FDE2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566FDE2 mov eax, dword ptr fs:[00000030h] | 12_2_0566FDE2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566FDE2 mov eax, dword ptr fs:[00000030h] | 12_2_0566FDE2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056341E8 mov eax, dword ptr fs:[00000030h] | 12_2_056341E8 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05658DF1 mov eax, dword ptr fs:[00000030h] | 12_2_05658DF1 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626DC9 mov eax, dword ptr fs:[00000030h] | 12_2_05626DC9 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626DC9 mov eax, dword ptr fs:[00000030h] | 12_2_05626DC9 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626DC9 mov eax, dword ptr fs:[00000030h] | 12_2_05626DC9 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626DC9 mov ecx, dword ptr fs:[00000030h] | 12_2_05626DC9 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626DC9 mov eax, dword ptr fs:[00000030h] | 12_2_05626DC9 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626DC9 mov eax, dword ptr fs:[00000030h] | 12_2_05626DC9 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AB1E1 mov eax, dword ptr fs:[00000030h] | 12_2_055AB1E1 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AB1E1 mov eax, dword ptr fs:[00000030h] | 12_2_055AB1E1 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AB1E1 mov eax, dword ptr fs:[00000030h] | 12_2_055AB1E1 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BD5E0 mov eax, dword ptr fs:[00000030h] | 12_2_055BD5E0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BD5E0 mov eax, dword ptr fs:[00000030h] | 12_2_055BD5E0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056269A6 mov eax, dword ptr fs:[00000030h] | 12_2_056269A6 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DFD9B mov eax, dword ptr fs:[00000030h] | 12_2_055DFD9B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DFD9B mov eax, dword ptr fs:[00000030h] | 12_2_055DFD9B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056705AC mov eax, dword ptr fs:[00000030h] | 12_2_056705AC |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056705AC mov eax, dword ptr fs:[00000030h] | 12_2_056705AC |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D2990 mov eax, dword ptr fs:[00000030h] | 12_2_055D2990 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A2D8A mov eax, dword ptr fs:[00000030h] | 12_2_055A2D8A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A2D8A mov eax, dword ptr fs:[00000030h] | 12_2_055A2D8A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A2D8A mov eax, dword ptr fs:[00000030h] | 12_2_055A2D8A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A2D8A mov eax, dword ptr fs:[00000030h] | 12_2_055A2D8A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A2D8A mov eax, dword ptr fs:[00000030h] | 12_2_055A2D8A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DA185 mov eax, dword ptr fs:[00000030h] | 12_2_055DA185 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056251BE mov eax, dword ptr fs:[00000030h] | 12_2_056251BE |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056251BE mov eax, dword ptr fs:[00000030h] | 12_2_056251BE |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056251BE mov eax, dword ptr fs:[00000030h] | 12_2_056251BE |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056251BE mov eax, dword ptr fs:[00000030h] | 12_2_056251BE |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D2581 mov eax, dword ptr fs:[00000030h] | 12_2_055D2581 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D2581 mov eax, dword ptr fs:[00000030h] | 12_2_055D2581 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D2581 mov eax, dword ptr fs:[00000030h] | 12_2_055D2581 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D2581 mov eax, dword ptr fs:[00000030h] | 12_2_055D2581 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CC182 mov eax, dword ptr fs:[00000030h] | 12_2_055CC182 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D1DB5 mov eax, dword ptr fs:[00000030h] | 12_2_055D1DB5 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D1DB5 mov eax, dword ptr fs:[00000030h] | 12_2_055D1DB5 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D1DB5 mov eax, dword ptr fs:[00000030h] | 12_2_055D1DB5 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D35A1 mov eax, dword ptr fs:[00000030h] | 12_2_055D35A1 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D61A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D61A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D61A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D61A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C0050 mov eax, dword ptr fs:[00000030h] | 12_2_055C0050 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C0050 mov eax, dword ptr fs:[00000030h] | 12_2_055C0050 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05671074 mov eax, dword ptr fs:[00000030h] | 12_2_05671074 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05662073 mov eax, dword ptr fs:[00000030h] | 12_2_05662073 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DA44B mov eax, dword ptr fs:[00000030h] | 12_2_055DA44B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C746D mov eax, dword ptr fs:[00000030h] | 12_2_055C746D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563C450 mov eax, dword ptr fs:[00000030h] | 12_2_0563C450 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563C450 mov eax, dword ptr fs:[00000030h] | 12_2_0563C450 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05661C06 mov eax, dword ptr fs:[00000030h] | 12_2_05661C06 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626C0A mov eax, dword ptr fs:[00000030h] | 12_2_05626C0A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626C0A mov eax, dword ptr fs:[00000030h] | 12_2_05626C0A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626C0A mov eax, dword ptr fs:[00000030h] | 12_2_05626C0A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626C0A mov eax, dword ptr fs:[00000030h] | 12_2_05626C0A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0567740D mov eax, dword ptr fs:[00000030h] | 12_2_0567740D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0567740D mov eax, dword ptr fs:[00000030h] | 12_2_0567740D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0567740D mov eax, dword ptr fs:[00000030h] | 12_2_0567740D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D002D mov eax, dword ptr fs:[00000030h] | 12_2_055D002D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D002D mov eax, dword ptr fs:[00000030h] | 12_2_055D002D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D002D mov eax, dword ptr fs:[00000030h] | 12_2_055D002D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D002D mov eax, dword ptr fs:[00000030h] | 12_2_055D002D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D002D mov eax, dword ptr fs:[00000030h] | 12_2_055D002D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BB02A mov eax, dword ptr fs:[00000030h] | 12_2_055BB02A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BB02A mov eax, dword ptr fs:[00000030h] | 12_2_055BB02A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BB02A mov eax, dword ptr fs:[00000030h] | 12_2_055BB02A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BB02A mov eax, dword ptr fs:[00000030h] | 12_2_055BB02A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DBC2C mov eax, dword ptr fs:[00000030h] | 12_2_055DBC2C |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05674015 mov eax, dword ptr fs:[00000030h] | 12_2_05674015 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05674015 mov eax, dword ptr fs:[00000030h] | 12_2_05674015 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05627016 mov eax, dword ptr fs:[00000030h] | 12_2_05627016 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05627016 mov eax, dword ptr fs:[00000030h] | 12_2_05627016 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05627016 mov eax, dword ptr fs:[00000030h] | 12_2_05627016 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626CF0 mov eax, dword ptr fs:[00000030h] | 12_2_05626CF0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626CF0 mov eax, dword ptr fs:[00000030h] | 12_2_05626CF0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05626CF0 mov eax, dword ptr fs:[00000030h] | 12_2_05626CF0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056614FB mov eax, dword ptr fs:[00000030h] | 12_2_056614FB |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05678CD6 mov eax, dword ptr fs:[00000030h] | 12_2_05678CD6 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563B8D0 mov eax, dword ptr fs:[00000030h] | 12_2_0563B8D0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563B8D0 mov ecx, dword ptr fs:[00000030h] | 12_2_0563B8D0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563B8D0 mov eax, dword ptr fs:[00000030h] | 12_2_0563B8D0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563B8D0 mov eax, dword ptr fs:[00000030h] | 12_2_0563B8D0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563B8D0 mov eax, dword ptr fs:[00000030h] | 12_2_0563B8D0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563B8D0 mov eax, dword ptr fs:[00000030h] | 12_2_0563B8D0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A58EC mov eax, dword ptr fs:[00000030h] | 12_2_055A58EC |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B849B mov eax, dword ptr fs:[00000030h] | 12_2_055B849B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9080 mov eax, dword ptr fs:[00000030h] | 12_2_055A9080 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DF0BF mov ecx, dword ptr fs:[00000030h] | 12_2_055DF0BF |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DF0BF mov eax, dword ptr fs:[00000030h] | 12_2_055DF0BF |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DF0BF mov eax, dword ptr fs:[00000030h] | 12_2_055DF0BF |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05623884 mov eax, dword ptr fs:[00000030h] | 12_2_05623884 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05623884 mov eax, dword ptr fs:[00000030h] | 12_2_05623884 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055E90AF mov eax, dword ptr fs:[00000030h] | 12_2_055E90AF |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D20A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D20A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D20A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D20A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D20A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D20A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D20A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D20A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D20A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D20A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D20A0 mov eax, dword ptr fs:[00000030h] | 12_2_055D20A0 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AF358 mov eax, dword ptr fs:[00000030h] | 12_2_055AF358 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05678F6A mov eax, dword ptr fs:[00000030h] | 12_2_05678F6A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055ADB40 mov eax, dword ptr fs:[00000030h] | 12_2_055ADB40 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BEF40 mov eax, dword ptr fs:[00000030h] | 12_2_055BEF40 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D3B7A mov eax, dword ptr fs:[00000030h] | 12_2_055D3B7A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D3B7A mov eax, dword ptr fs:[00000030h] | 12_2_055D3B7A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055ADB60 mov ecx, dword ptr fs:[00000030h] | 12_2_055ADB60 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055BFF60 mov eax, dword ptr fs:[00000030h] | 12_2_055BFF60 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05678B58 mov eax, dword ptr fs:[00000030h] | 12_2_05678B58 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CF716 mov eax, dword ptr fs:[00000030h] | 12_2_055CF716 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DA70E mov eax, dword ptr fs:[00000030h] | 12_2_055DA70E |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DA70E mov eax, dword ptr fs:[00000030h] | 12_2_055DA70E |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0567070D mov eax, dword ptr fs:[00000030h] | 12_2_0567070D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0567070D mov eax, dword ptr fs:[00000030h] | 12_2_0567070D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DE730 mov eax, dword ptr fs:[00000030h] | 12_2_055DE730 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563FF10 mov eax, dword ptr fs:[00000030h] | 12_2_0563FF10 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0563FF10 mov eax, dword ptr fs:[00000030h] | 12_2_0563FF10 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A4F2E mov eax, dword ptr fs:[00000030h] | 12_2_055A4F2E |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A4F2E mov eax, dword ptr fs:[00000030h] | 12_2_055A4F2E |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566131B mov eax, dword ptr fs:[00000030h] | 12_2_0566131B |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056253CA mov eax, dword ptr fs:[00000030h] | 12_2_056253CA |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_056253CA mov eax, dword ptr fs:[00000030h] | 12_2_056253CA |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055E37F5 mov eax, dword ptr fs:[00000030h] | 12_2_055E37F5 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CDBE9 mov eax, dword ptr fs:[00000030h] | 12_2_055CDBE9 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D03E2 mov eax, dword ptr fs:[00000030h] | 12_2_055D03E2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D03E2 mov eax, dword ptr fs:[00000030h] | 12_2_055D03E2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D03E2 mov eax, dword ptr fs:[00000030h] | 12_2_055D03E2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D03E2 mov eax, dword ptr fs:[00000030h] | 12_2_055D03E2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D03E2 mov eax, dword ptr fs:[00000030h] | 12_2_055D03E2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D03E2 mov eax, dword ptr fs:[00000030h] | 12_2_055D03E2 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05675BA5 mov eax, dword ptr fs:[00000030h] | 12_2_05675BA5 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D2397 mov eax, dword ptr fs:[00000030h] | 12_2_055D2397 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DB390 mov eax, dword ptr fs:[00000030h] | 12_2_055DB390 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B8794 mov eax, dword ptr fs:[00000030h] | 12_2_055B8794 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B1B8F mov eax, dword ptr fs:[00000030h] | 12_2_055B1B8F |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B1B8F mov eax, dword ptr fs:[00000030h] | 12_2_055B1B8F |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0565D380 mov ecx, dword ptr fs:[00000030h] | 12_2_0565D380 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566138A mov eax, dword ptr fs:[00000030h] | 12_2_0566138A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D4BAD mov eax, dword ptr fs:[00000030h] | 12_2_055D4BAD |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D4BAD mov eax, dword ptr fs:[00000030h] | 12_2_055D4BAD |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055D4BAD mov eax, dword ptr fs:[00000030h] | 12_2_055D4BAD |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05627794 mov eax, dword ptr fs:[00000030h] | 12_2_05627794 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05627794 mov eax, dword ptr fs:[00000030h] | 12_2_05627794 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05627794 mov eax, dword ptr fs:[00000030h] | 12_2_05627794 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0565B260 mov eax, dword ptr fs:[00000030h] | 12_2_0565B260 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0565B260 mov eax, dword ptr fs:[00000030h] | 12_2_0565B260 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05678A62 mov eax, dword ptr fs:[00000030h] | 12_2_05678A62 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9240 mov eax, dword ptr fs:[00000030h] | 12_2_055A9240 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9240 mov eax, dword ptr fs:[00000030h] | 12_2_055A9240 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9240 mov eax, dword ptr fs:[00000030h] | 12_2_055A9240 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A9240 mov eax, dword ptr fs:[00000030h] | 12_2_055A9240 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B7E41 mov eax, dword ptr fs:[00000030h] | 12_2_055B7E41 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B7E41 mov eax, dword ptr fs:[00000030h] | 12_2_055B7E41 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B7E41 mov eax, dword ptr fs:[00000030h] | 12_2_055B7E41 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B7E41 mov eax, dword ptr fs:[00000030h] | 12_2_055B7E41 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B7E41 mov eax, dword ptr fs:[00000030h] | 12_2_055B7E41 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B7E41 mov eax, dword ptr fs:[00000030h] | 12_2_055B7E41 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566AE44 mov eax, dword ptr fs:[00000030h] | 12_2_0566AE44 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566AE44 mov eax, dword ptr fs:[00000030h] | 12_2_0566AE44 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055E927A mov eax, dword ptr fs:[00000030h] | 12_2_055E927A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CAE73 mov eax, dword ptr fs:[00000030h] | 12_2_055CAE73 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CAE73 mov eax, dword ptr fs:[00000030h] | 12_2_055CAE73 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CAE73 mov eax, dword ptr fs:[00000030h] | 12_2_055CAE73 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CAE73 mov eax, dword ptr fs:[00000030h] | 12_2_055CAE73 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055CAE73 mov eax, dword ptr fs:[00000030h] | 12_2_055CAE73 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0566EA55 mov eax, dword ptr fs:[00000030h] | 12_2_0566EA55 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_05634257 mov eax, dword ptr fs:[00000030h] | 12_2_05634257 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B766D mov eax, dword ptr fs:[00000030h] | 12_2_055B766D |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055C3A1C mov eax, dword ptr fs:[00000030h] | 12_2_055C3A1C |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DA61C mov eax, dword ptr fs:[00000030h] | 12_2_055DA61C |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055DA61C mov eax, dword ptr fs:[00000030h] | 12_2_055DA61C |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A5210 mov eax, dword ptr fs:[00000030h] | 12_2_055A5210 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A5210 mov ecx, dword ptr fs:[00000030h] | 12_2_055A5210 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A5210 mov eax, dword ptr fs:[00000030h] | 12_2_055A5210 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055A5210 mov eax, dword ptr fs:[00000030h] | 12_2_055A5210 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AAA16 mov eax, dword ptr fs:[00000030h] | 12_2_055AAA16 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AAA16 mov eax, dword ptr fs:[00000030h] | 12_2_055AAA16 |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055B8A0A mov eax, dword ptr fs:[00000030h] | 12_2_055B8A0A |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_0565FE3F mov eax, dword ptr fs:[00000030h] | 12_2_0565FE3F |
| Source: C:\Windows\SysWOW64\explorer.exe | Code function: 12_2_055AC600 mov eax, dword ptr fs:[00000030h] | 12_2_055AC600 |
Edit tour
SecuriteInfo.com.Variant.Tedy.130342.18814.exe (PID: 7000 cmdline: 
ByteCodeGenerator.exe (PID: 7140 cmdline: 
explorer.exe (PID: 5708 cmdline: 
cmd.exe (PID: 3220 cmdline: 
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node