Windows Analysis Report
17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe

Overview

General Information

Sample name: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
Analysis ID: 1528396
MD5: cb002b9fc6455e305288f91ee142f674
SHA1: 3896fb2d9eb35a367faf2f12b11d01e2b97f6990
SHA256: fb4f2f626da581a9165a4c9f8a97bbcfaf2fee33f4710d4cd35f884dbe996439
Tags: base64-decodedexeuser-abuse_ch
Infos:

Detection

FormBook
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Machine Learning detection for sample
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
One or more processes crash
PE file does not import any functions
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe ReversingLabs: Detection: 63%
Yara detected FormBook
Source: Yara match File source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
Source: Amcache.hve.3.dr String found in binary or memory: http://upx.sf.net

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F3B3D3 NtClose, 0_2_00F3B3D3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F11961 NtProtectVirtualMemory, 0_2_00F11961
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2DF0 NtQuerySystemInformation,LdrInitializeThunk, 0_2_01AF2DF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF4340 NtSetContextThread, 0_2_01AF4340
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF4650 NtSuspendThread, 0_2_01AF4650
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2BA0 NtEnumerateValueKey, 0_2_01AF2BA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2B80 NtQueryInformationFile, 0_2_01AF2B80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2BE0 NtQueryValueKey, 0_2_01AF2BE0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2BF0 NtAllocateVirtualMemory, 0_2_01AF2BF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2B60 NtClose, 0_2_01AF2B60
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2AB0 NtWaitForSingleObject, 0_2_01AF2AB0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2AF0 NtWriteFile, 0_2_01AF2AF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2AD0 NtReadFile, 0_2_01AF2AD0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2DB0 NtEnumerateKey, 0_2_01AF2DB0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2DD0 NtDelayExecution, 0_2_01AF2DD0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2D30 NtUnmapViewOfSection, 0_2_01AF2D30
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2D00 NtSetInformationFile, 0_2_01AF2D00
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2D10 NtMapViewOfSection, 0_2_01AF2D10
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2CA0 NtQueryInformationToken, 0_2_01AF2CA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2CF0 NtOpenProcess, 0_2_01AF2CF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2CC0 NtQueryVirtualMemory, 0_2_01AF2CC0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2C00 NtQueryInformationProcess, 0_2_01AF2C00
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2C60 NtCreateKey, 0_2_01AF2C60
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2C70 NtFreeVirtualMemory, 0_2_01AF2C70
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2FA0 NtQuerySection, 0_2_01AF2FA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2FB0 NtResumeThread, 0_2_01AF2FB0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2F90 NtProtectVirtualMemory, 0_2_01AF2F90
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2FE0 NtCreateFile, 0_2_01AF2FE0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2F30 NtCreateSection, 0_2_01AF2F30
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2F60 NtCreateProcessEx, 0_2_01AF2F60
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2EA0 NtAdjustPrivilegesToken, 0_2_01AF2EA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2E80 NtReadVirtualMemory, 0_2_01AF2E80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2EE0 NtQueueApcThread, 0_2_01AF2EE0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2E30 NtWriteVirtualMemory, 0_2_01AF2E30
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF3090 NtSetValueKey, 0_2_01AF3090
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF3010 NtOpenDirectoryObject, 0_2_01AF3010
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF35C0 NtCreateMutant, 0_2_01AF35C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF39B0 NtGetContextThread, 0_2_01AF39B0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF3D10 NtOpenProcessToken, 0_2_01AF3D10
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF3D70 NtOpenThread, 0_2_01AF3D70
Detected potential crypto function
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F200F3 0_2_00F200F3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F13030 0_2_00F13030
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F26823 0_2_00F26823
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F2681E 0_2_00F2681E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F3D803 0_2_00F3D803
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F111C0 0_2_00F111C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F1E173 0_2_00F1E173
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F12380 0_2_00F12380
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F1FED3 0_2_00F1FED3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F1FECB 0_2_00F1FECB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B801AA 0_2_01B801AA
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B741A2 0_2_01B741A2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B781CC 0_2_01B781CC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0100 0_2_01AB0100
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5A118 0_2_01B5A118
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B48158 0_2_01B48158
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE3F0 0_2_01ACE3F0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B803E6 0_2_01B803E6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7A352 0_2_01B7A352
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B402C0 0_2_01B402C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B80591 0_2_01B80591
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0535 0_2_01AC0535
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6E4F6 0_2_01B6E4F6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B64420 0_2_01B64420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B72446 0_2_01B72446
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABC7C0 0_2_01ABC7C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE4750 0_2_01AE4750
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADC6E0 0_2_01ADC6E0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B8A9A6 0_2_01B8A9A6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD6962 0_2_01AD6962
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA68B8 0_2_01AA68B8
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE8F0 0_2_01AEE8F0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACA840 0_2_01ACA840
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC2840 0_2_01AC2840
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B76BD7 0_2_01B76BD7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7AB40 0_2_01B7AB40
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD8DBF 0_2_01AD8DBF
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABADE0 0_2_01ABADE0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5CD1F 0_2_01B5CD1F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACAD00 0_2_01ACAD00
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60CB5 0_2_01B60CB5
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0CF2 0_2_01AB0CF2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0C00 0_2_01AC0C00
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3EFA0 0_2_01B3EFA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB2FC8 0_2_01AB2FC8
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B62F30 0_2_01B62F30
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B02F28 0_2_01B02F28
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE0F30 0_2_01AE0F30
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B34F40 0_2_01B34F40
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7CE93 0_2_01B7CE93
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD2E90 0_2_01AD2E90
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7EEDB 0_2_01B7EEDB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7EE26 0_2_01B7EE26
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0E59 0_2_01AC0E59
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACB1B0 0_2_01ACB1B0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF516C 0_2_01AF516C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B8B16B 0_2_01B8B16B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAF172 0_2_01AAF172
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7F0E0 0_2_01B7F0E0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B770E9 0_2_01B770E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC70C0 0_2_01AC70C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6F0CC 0_2_01B6F0CC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B0739A 0_2_01B0739A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7132D 0_2_01B7132D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAD34C 0_2_01AAD34C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC52A0 0_2_01AC52A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B612ED 0_2_01B612ED
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADB2C0 0_2_01ADB2C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5D5B0 0_2_01B5D5B0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B895C3 0_2_01B895C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B77571 0_2_01B77571
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7F43F 0_2_01B7F43F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB1460 0_2_01AB1460
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7F7B0 0_2_01B7F7B0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B716CC 0_2_01B716CC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B05630 0_2_01B05630
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B55910 0_2_01B55910
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC9950 0_2_01AC9950
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADB950 0_2_01ADB950
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC38E0 0_2_01AC38E0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2D800 0_2_01B2D800
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADFB80 0_2_01ADFB80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B35BF0 0_2_01B35BF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AFDBF9 0_2_01AFDBF9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7FB76 0_2_01B7FB76
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B05AA0 0_2_01B05AA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B61AA3 0_2_01B61AA3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5DAAC 0_2_01B5DAAC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6DAC6 0_2_01B6DAC6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B33A6C 0_2_01B33A6C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B77A46 0_2_01B77A46
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7FA49 0_2_01B7FA49
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADFDC0 0_2_01ADFDC0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B77D73 0_2_01B77D73
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC3D40 0_2_01AC3D40
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B71D5A 0_2_01B71D5A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7FCF2 0_2_01B7FCF2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B39C32 0_2_01B39C32
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7FFB1 0_2_01B7FFB1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC1F92 0_2_01AC1F92
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01A83FD2 0_2_01A83FD2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01A83FD5 0_2_01A83FD5
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7FF09 0_2_01B7FF09
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC9EB0 0_2_01AC9EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: String function: 01B07E54 appears 108 times
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: String function: 01AAB970 appears 265 times
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: String function: 01B2EA12 appears 86 times
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: String function: 01B3F290 appears 105 times
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: String function: 01AF5130 appears 58 times
One or more processes crash
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 228
PE file does not import any functions
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000019FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001D51000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001834000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe
Uses 32bit PE files
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: Section .text
Source: classification engine Classification label: mal80.troj.winEXE@2/5@0/0
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2664
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e637462d-74ae-412d-b6bf-cccfc9806afa Jump to behavior
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe ReversingLabs: Detection: 63%
Source: unknown Process created: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe "C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe"
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 228
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Section loaded: apphelp.dll Jump to behavior
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001A80000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000002.1998480350.0000000001C1E000.00000040.00001000.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1834406738.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe, 00000000.00000003.1830422340.0000000001711000.00000004.00000020.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F12076 push ss; iretd 0_2_00F1207D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F33053 push 8BD62211h; retf 0_2_00F33068
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F132B0 push eax; ret 0_2_00F132B2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F1D236 push 0000001Dh; iretd 0_2_00F1D238
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F183F9 push ebx; ret 0_2_00F183FA
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F2E3C5 push ss; iretd 0_2_00F2E3C6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F2CB76 push ecx; ret 0_2_00F2CB7C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F184B0 push esi; iretd 0_2_00F18505
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F2EC91 push ebx; iretd 0_2_00F2EC9F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F2A441 push eax; ret 0_2_00F2A442
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F2A43F push eax; iretd 0_2_00F2A440
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F11577 push ss; iretd 0_2_00F1158C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F2E57E push edi; retf 0_2_00F2E5A4
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F26D68 push ebp; retf 0_2_00F26D6D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F32EE3 push edi; ret 0_2_00F32EEE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F32ED8 push edi; ret 0_2_00F32EEE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F21683 push edi; ret 0_2_00F2168A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F21677 push edi; ret 0_2_00F2168A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F11E4B push ss; iretd 0_2_00F11E4D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F11793 push ss; iretd 0_2_00F11766
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F1175F push ss; iretd 0_2_00F11766
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F11731 push ss; iretd 0_2_00F11766
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F32F30 push edi; ret 0_2_00F32EEE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_00F32F07 push edi; ret 0_2_00F32F2D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01A8225F pushad ; ret 0_2_01A827F9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01A827FA pushad ; ret 0_2_01A827F9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB09AD push ecx; mov dword ptr [esp], ecx 0_2_01AB09B6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01A8283D push eax; iretd 0_2_01A82858
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01A81368 push eax; iretd 0_2_01A81369
Source: 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Static PE information: section name: .text entropy: 7.994347427666436
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF096E rdtsc 0_2_01AF096E
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe API coverage: 0.3 %
Source: Amcache.hve.3.dr Binary or memory string: VMware
Source: Amcache.hve.3.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF096E rdtsc 0_2_01AF096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2DF0 NtQuerySystemInformation,LdrInitializeThunk, 0_2_01AF2DF0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF0185 mov eax, dword ptr fs:[00000030h] 0_2_01AF0185
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h] 0_2_01B3019F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h] 0_2_01B3019F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h] 0_2_01B3019F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3019F mov eax, dword ptr fs:[00000030h] 0_2_01B3019F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B54180 mov eax, dword ptr fs:[00000030h] 0_2_01B54180
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B54180 mov eax, dword ptr fs:[00000030h] 0_2_01B54180
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAA197 mov eax, dword ptr fs:[00000030h] 0_2_01AAA197
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAA197 mov eax, dword ptr fs:[00000030h] 0_2_01AAA197
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAA197 mov eax, dword ptr fs:[00000030h] 0_2_01AAA197
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6C188 mov eax, dword ptr fs:[00000030h] 0_2_01B6C188
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6C188 mov eax, dword ptr fs:[00000030h] 0_2_01B6C188
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE01F8 mov eax, dword ptr fs:[00000030h] 0_2_01AE01F8
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B861E5 mov eax, dword ptr fs:[00000030h] 0_2_01B861E5
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h] 0_2_01B2E1D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h] 0_2_01B2E1D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E1D0 mov ecx, dword ptr fs:[00000030h] 0_2_01B2E1D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h] 0_2_01B2E1D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E1D0 mov eax, dword ptr fs:[00000030h] 0_2_01B2E1D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B761C3 mov eax, dword ptr fs:[00000030h] 0_2_01B761C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B761C3 mov eax, dword ptr fs:[00000030h] 0_2_01B761C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE0124 mov eax, dword ptr fs:[00000030h] 0_2_01AE0124
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B70115 mov eax, dword ptr fs:[00000030h] 0_2_01B70115
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5A118 mov ecx, dword ptr fs:[00000030h] 0_2_01B5A118
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5A118 mov eax, dword ptr fs:[00000030h] 0_2_01B5A118
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5A118 mov eax, dword ptr fs:[00000030h] 0_2_01B5A118
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5A118 mov eax, dword ptr fs:[00000030h] 0_2_01B5A118
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov eax, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E10E mov ecx, dword ptr fs:[00000030h] 0_2_01B5E10E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84164 mov eax, dword ptr fs:[00000030h] 0_2_01B84164
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84164 mov eax, dword ptr fs:[00000030h] 0_2_01B84164
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B48158 mov eax, dword ptr fs:[00000030h] 0_2_01B48158
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h] 0_2_01B44144
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h] 0_2_01B44144
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B44144 mov ecx, dword ptr fs:[00000030h] 0_2_01B44144
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h] 0_2_01B44144
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B44144 mov eax, dword ptr fs:[00000030h] 0_2_01B44144
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAC156 mov eax, dword ptr fs:[00000030h] 0_2_01AAC156
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB6154 mov eax, dword ptr fs:[00000030h] 0_2_01AB6154
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB6154 mov eax, dword ptr fs:[00000030h] 0_2_01AB6154
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA80A0 mov eax, dword ptr fs:[00000030h] 0_2_01AA80A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B760B8 mov eax, dword ptr fs:[00000030h] 0_2_01B760B8
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B760B8 mov ecx, dword ptr fs:[00000030h] 0_2_01B760B8
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B480A8 mov eax, dword ptr fs:[00000030h] 0_2_01B480A8
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB208A mov eax, dword ptr fs:[00000030h] 0_2_01AB208A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB80E9 mov eax, dword ptr fs:[00000030h] 0_2_01AB80E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAA0E3 mov ecx, dword ptr fs:[00000030h] 0_2_01AAA0E3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B360E0 mov eax, dword ptr fs:[00000030h] 0_2_01B360E0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAC0F0 mov eax, dword ptr fs:[00000030h] 0_2_01AAC0F0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF20F0 mov ecx, dword ptr fs:[00000030h] 0_2_01AF20F0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B320DE mov eax, dword ptr fs:[00000030h] 0_2_01B320DE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B46030 mov eax, dword ptr fs:[00000030h] 0_2_01B46030
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAA020 mov eax, dword ptr fs:[00000030h] 0_2_01AAA020
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAC020 mov eax, dword ptr fs:[00000030h] 0_2_01AAC020
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B34000 mov ecx, dword ptr fs:[00000030h] 0_2_01B34000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B52000 mov eax, dword ptr fs:[00000030h] 0_2_01B52000
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h] 0_2_01ACE016
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h] 0_2_01ACE016
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h] 0_2_01ACE016
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE016 mov eax, dword ptr fs:[00000030h] 0_2_01ACE016
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADC073 mov eax, dword ptr fs:[00000030h] 0_2_01ADC073
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36050 mov eax, dword ptr fs:[00000030h] 0_2_01B36050
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB2050 mov eax, dword ptr fs:[00000030h] 0_2_01AB2050
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAE388 mov eax, dword ptr fs:[00000030h] 0_2_01AAE388
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAE388 mov eax, dword ptr fs:[00000030h] 0_2_01AAE388
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAE388 mov eax, dword ptr fs:[00000030h] 0_2_01AAE388
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD438F mov eax, dword ptr fs:[00000030h] 0_2_01AD438F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD438F mov eax, dword ptr fs:[00000030h] 0_2_01AD438F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA8397 mov eax, dword ptr fs:[00000030h] 0_2_01AA8397
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA8397 mov eax, dword ptr fs:[00000030h] 0_2_01AA8397
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA8397 mov eax, dword ptr fs:[00000030h] 0_2_01AA8397
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC03E9 mov eax, dword ptr fs:[00000030h] 0_2_01AC03E9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE63FF mov eax, dword ptr fs:[00000030h] 0_2_01AE63FF
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE3F0 mov eax, dword ptr fs:[00000030h] 0_2_01ACE3F0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE3F0 mov eax, dword ptr fs:[00000030h] 0_2_01ACE3F0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE3F0 mov eax, dword ptr fs:[00000030h] 0_2_01ACE3F0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B543D4 mov eax, dword ptr fs:[00000030h] 0_2_01B543D4
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B543D4 mov eax, dword ptr fs:[00000030h] 0_2_01B543D4
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA3C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA3C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA3C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA3C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA3C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA3C0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA3C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h] 0_2_01AB83C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h] 0_2_01AB83C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h] 0_2_01AB83C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB83C0 mov eax, dword ptr fs:[00000030h] 0_2_01AB83C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E3DB mov eax, dword ptr fs:[00000030h] 0_2_01B5E3DB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E3DB mov eax, dword ptr fs:[00000030h] 0_2_01B5E3DB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E3DB mov ecx, dword ptr fs:[00000030h] 0_2_01B5E3DB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5E3DB mov eax, dword ptr fs:[00000030h] 0_2_01B5E3DB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B363C0 mov eax, dword ptr fs:[00000030h] 0_2_01B363C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6C3CD mov eax, dword ptr fs:[00000030h] 0_2_01B6C3CD
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B88324 mov eax, dword ptr fs:[00000030h] 0_2_01B88324
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B88324 mov ecx, dword ptr fs:[00000030h] 0_2_01B88324
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B88324 mov eax, dword ptr fs:[00000030h] 0_2_01B88324
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B88324 mov eax, dword ptr fs:[00000030h] 0_2_01B88324
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA30B mov eax, dword ptr fs:[00000030h] 0_2_01AEA30B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA30B mov eax, dword ptr fs:[00000030h] 0_2_01AEA30B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA30B mov eax, dword ptr fs:[00000030h] 0_2_01AEA30B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAC310 mov ecx, dword ptr fs:[00000030h] 0_2_01AAC310
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD0310 mov ecx, dword ptr fs:[00000030h] 0_2_01AD0310
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5437C mov eax, dword ptr fs:[00000030h] 0_2_01B5437C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7A352 mov eax, dword ptr fs:[00000030h] 0_2_01B7A352
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B58350 mov ecx, dword ptr fs:[00000030h] 0_2_01B58350
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h] 0_2_01B3035C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h] 0_2_01B3035C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h] 0_2_01B3035C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3035C mov ecx, dword ptr fs:[00000030h] 0_2_01B3035C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h] 0_2_01B3035C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3035C mov eax, dword ptr fs:[00000030h] 0_2_01B3035C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B8634F mov eax, dword ptr fs:[00000030h] 0_2_01B8634F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B32349 mov eax, dword ptr fs:[00000030h] 0_2_01B32349
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC02A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC02A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC02A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC02A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h] 0_2_01B462A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B462A0 mov ecx, dword ptr fs:[00000030h] 0_2_01B462A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h] 0_2_01B462A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h] 0_2_01B462A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h] 0_2_01B462A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B462A0 mov eax, dword ptr fs:[00000030h] 0_2_01B462A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE284 mov eax, dword ptr fs:[00000030h] 0_2_01AEE284
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE284 mov eax, dword ptr fs:[00000030h] 0_2_01AEE284
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B30283 mov eax, dword ptr fs:[00000030h] 0_2_01B30283
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B30283 mov eax, dword ptr fs:[00000030h] 0_2_01B30283
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B30283 mov eax, dword ptr fs:[00000030h] 0_2_01B30283
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC02E1 mov eax, dword ptr fs:[00000030h] 0_2_01AC02E1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC02E1 mov eax, dword ptr fs:[00000030h] 0_2_01AC02E1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC02E1 mov eax, dword ptr fs:[00000030h] 0_2_01AC02E1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h] 0_2_01ABA2C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h] 0_2_01ABA2C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h] 0_2_01ABA2C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h] 0_2_01ABA2C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA2C3 mov eax, dword ptr fs:[00000030h] 0_2_01ABA2C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B862D6 mov eax, dword ptr fs:[00000030h] 0_2_01B862D6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA823B mov eax, dword ptr fs:[00000030h] 0_2_01AA823B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA826B mov eax, dword ptr fs:[00000030h] 0_2_01AA826B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B60274 mov eax, dword ptr fs:[00000030h] 0_2_01B60274
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB4260 mov eax, dword ptr fs:[00000030h] 0_2_01AB4260
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB4260 mov eax, dword ptr fs:[00000030h] 0_2_01AB4260
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB4260 mov eax, dword ptr fs:[00000030h] 0_2_01AB4260
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B8625D mov eax, dword ptr fs:[00000030h] 0_2_01B8625D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6A250 mov eax, dword ptr fs:[00000030h] 0_2_01B6A250
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6A250 mov eax, dword ptr fs:[00000030h] 0_2_01B6A250
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B38243 mov eax, dword ptr fs:[00000030h] 0_2_01B38243
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B38243 mov ecx, dword ptr fs:[00000030h] 0_2_01B38243
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB6259 mov eax, dword ptr fs:[00000030h] 0_2_01AB6259
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAA250 mov eax, dword ptr fs:[00000030h] 0_2_01AAA250
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B305A7 mov eax, dword ptr fs:[00000030h] 0_2_01B305A7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B305A7 mov eax, dword ptr fs:[00000030h] 0_2_01B305A7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B305A7 mov eax, dword ptr fs:[00000030h] 0_2_01B305A7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD45B1 mov eax, dword ptr fs:[00000030h] 0_2_01AD45B1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD45B1 mov eax, dword ptr fs:[00000030h] 0_2_01AD45B1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE4588 mov eax, dword ptr fs:[00000030h] 0_2_01AE4588
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB2582 mov eax, dword ptr fs:[00000030h] 0_2_01AB2582
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB2582 mov ecx, dword ptr fs:[00000030h] 0_2_01AB2582
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE59C mov eax, dword ptr fs:[00000030h] 0_2_01AEE59C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC5ED mov eax, dword ptr fs:[00000030h] 0_2_01AEC5ED
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC5ED mov eax, dword ptr fs:[00000030h] 0_2_01AEC5ED
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE5E7 mov eax, dword ptr fs:[00000030h] 0_2_01ADE5E7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB25E0 mov eax, dword ptr fs:[00000030h] 0_2_01AB25E0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE5CF mov eax, dword ptr fs:[00000030h] 0_2_01AEE5CF
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE5CF mov eax, dword ptr fs:[00000030h] 0_2_01AEE5CF
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB65D0 mov eax, dword ptr fs:[00000030h] 0_2_01AB65D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA5D0 mov eax, dword ptr fs:[00000030h] 0_2_01AEA5D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA5D0 mov eax, dword ptr fs:[00000030h] 0_2_01AEA5D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h] 0_2_01ADE53E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h] 0_2_01ADE53E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h] 0_2_01ADE53E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h] 0_2_01ADE53E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE53E mov eax, dword ptr fs:[00000030h] 0_2_01ADE53E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h] 0_2_01AC0535
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h] 0_2_01AC0535
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h] 0_2_01AC0535
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h] 0_2_01AC0535
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h] 0_2_01AC0535
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0535 mov eax, dword ptr fs:[00000030h] 0_2_01AC0535
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B46500 mov eax, dword ptr fs:[00000030h] 0_2_01B46500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h] 0_2_01B84500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h] 0_2_01B84500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h] 0_2_01B84500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h] 0_2_01B84500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h] 0_2_01B84500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h] 0_2_01B84500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84500 mov eax, dword ptr fs:[00000030h] 0_2_01B84500
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE656A mov eax, dword ptr fs:[00000030h] 0_2_01AE656A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE656A mov eax, dword ptr fs:[00000030h] 0_2_01AE656A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE656A mov eax, dword ptr fs:[00000030h] 0_2_01AE656A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8550 mov eax, dword ptr fs:[00000030h] 0_2_01AB8550
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8550 mov eax, dword ptr fs:[00000030h] 0_2_01AB8550
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB64AB mov eax, dword ptr fs:[00000030h] 0_2_01AB64AB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3A4B0 mov eax, dword ptr fs:[00000030h] 0_2_01B3A4B0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE44B0 mov ecx, dword ptr fs:[00000030h] 0_2_01AE44B0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6A49A mov eax, dword ptr fs:[00000030h] 0_2_01B6A49A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB04E5 mov ecx, dword ptr fs:[00000030h] 0_2_01AB04E5
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAE420 mov eax, dword ptr fs:[00000030h] 0_2_01AAE420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAE420 mov eax, dword ptr fs:[00000030h] 0_2_01AAE420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAE420 mov eax, dword ptr fs:[00000030h] 0_2_01AAE420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AAC427 mov eax, dword ptr fs:[00000030h] 0_2_01AAC427
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h] 0_2_01B36420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h] 0_2_01B36420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h] 0_2_01B36420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h] 0_2_01B36420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h] 0_2_01B36420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h] 0_2_01B36420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B36420 mov eax, dword ptr fs:[00000030h] 0_2_01B36420
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA430 mov eax, dword ptr fs:[00000030h] 0_2_01AEA430
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE8402 mov eax, dword ptr fs:[00000030h] 0_2_01AE8402
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE8402 mov eax, dword ptr fs:[00000030h] 0_2_01AE8402
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE8402 mov eax, dword ptr fs:[00000030h] 0_2_01AE8402
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3C460 mov ecx, dword ptr fs:[00000030h] 0_2_01B3C460
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADA470 mov eax, dword ptr fs:[00000030h] 0_2_01ADA470
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADA470 mov eax, dword ptr fs:[00000030h] 0_2_01ADA470
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADA470 mov eax, dword ptr fs:[00000030h] 0_2_01ADA470
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B6A456 mov eax, dword ptr fs:[00000030h] 0_2_01B6A456
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEE443 mov eax, dword ptr fs:[00000030h] 0_2_01AEE443
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA645D mov eax, dword ptr fs:[00000030h] 0_2_01AA645D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD245A mov eax, dword ptr fs:[00000030h] 0_2_01AD245A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB07AF mov eax, dword ptr fs:[00000030h] 0_2_01AB07AF
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B647A0 mov eax, dword ptr fs:[00000030h] 0_2_01B647A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5678E mov eax, dword ptr fs:[00000030h] 0_2_01B5678E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD27ED mov eax, dword ptr fs:[00000030h] 0_2_01AD27ED
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD27ED mov eax, dword ptr fs:[00000030h] 0_2_01AD27ED
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD27ED mov eax, dword ptr fs:[00000030h] 0_2_01AD27ED
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB47FB mov eax, dword ptr fs:[00000030h] 0_2_01AB47FB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB47FB mov eax, dword ptr fs:[00000030h] 0_2_01AB47FB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3E7E1 mov eax, dword ptr fs:[00000030h] 0_2_01B3E7E1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABC7C0 mov eax, dword ptr fs:[00000030h] 0_2_01ABC7C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B307C3 mov eax, dword ptr fs:[00000030h] 0_2_01B307C3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2C730 mov eax, dword ptr fs:[00000030h] 0_2_01B2C730
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC720 mov eax, dword ptr fs:[00000030h] 0_2_01AEC720
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC720 mov eax, dword ptr fs:[00000030h] 0_2_01AEC720
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE273C mov eax, dword ptr fs:[00000030h] 0_2_01AE273C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE273C mov ecx, dword ptr fs:[00000030h] 0_2_01AE273C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE273C mov eax, dword ptr fs:[00000030h] 0_2_01AE273C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC700 mov eax, dword ptr fs:[00000030h] 0_2_01AEC700
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0710 mov eax, dword ptr fs:[00000030h] 0_2_01AB0710
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE0710 mov eax, dword ptr fs:[00000030h] 0_2_01AE0710
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8770 mov eax, dword ptr fs:[00000030h] 0_2_01AB8770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0770 mov eax, dword ptr fs:[00000030h] 0_2_01AC0770
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE674D mov esi, dword ptr fs:[00000030h] 0_2_01AE674D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE674D mov eax, dword ptr fs:[00000030h] 0_2_01AE674D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE674D mov eax, dword ptr fs:[00000030h] 0_2_01AE674D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B34755 mov eax, dword ptr fs:[00000030h] 0_2_01B34755
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3E75D mov eax, dword ptr fs:[00000030h] 0_2_01B3E75D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0750 mov eax, dword ptr fs:[00000030h] 0_2_01AB0750
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2750 mov eax, dword ptr fs:[00000030h] 0_2_01AF2750
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2750 mov eax, dword ptr fs:[00000030h] 0_2_01AF2750
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC6A6 mov eax, dword ptr fs:[00000030h] 0_2_01AEC6A6
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE66B0 mov eax, dword ptr fs:[00000030h] 0_2_01AE66B0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB4690 mov eax, dword ptr fs:[00000030h] 0_2_01AB4690
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB4690 mov eax, dword ptr fs:[00000030h] 0_2_01AB4690
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h] 0_2_01B2E6F2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h] 0_2_01B2E6F2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h] 0_2_01B2E6F2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E6F2 mov eax, dword ptr fs:[00000030h] 0_2_01B2E6F2
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B306F1 mov eax, dword ptr fs:[00000030h] 0_2_01B306F1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B306F1 mov eax, dword ptr fs:[00000030h] 0_2_01B306F1
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA6C7 mov ebx, dword ptr fs:[00000030h] 0_2_01AEA6C7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA6C7 mov eax, dword ptr fs:[00000030h] 0_2_01AEA6C7
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB262C mov eax, dword ptr fs:[00000030h] 0_2_01AB262C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACE627 mov eax, dword ptr fs:[00000030h] 0_2_01ACE627
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE6620 mov eax, dword ptr fs:[00000030h] 0_2_01AE6620
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE8620 mov eax, dword ptr fs:[00000030h] 0_2_01AE8620
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h] 0_2_01AC260B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h] 0_2_01AC260B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h] 0_2_01AC260B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h] 0_2_01AC260B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h] 0_2_01AC260B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h] 0_2_01AC260B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC260B mov eax, dword ptr fs:[00000030h] 0_2_01AC260B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF2619 mov eax, dword ptr fs:[00000030h] 0_2_01AF2619
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E609 mov eax, dword ptr fs:[00000030h] 0_2_01B2E609
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA660 mov eax, dword ptr fs:[00000030h] 0_2_01AEA660
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA660 mov eax, dword ptr fs:[00000030h] 0_2_01AEA660
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7866E mov eax, dword ptr fs:[00000030h] 0_2_01B7866E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7866E mov eax, dword ptr fs:[00000030h] 0_2_01B7866E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE2674 mov eax, dword ptr fs:[00000030h] 0_2_01AE2674
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ACC640 mov eax, dword ptr fs:[00000030h] 0_2_01ACC640
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B389B3 mov esi, dword ptr fs:[00000030h] 0_2_01B389B3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B389B3 mov eax, dword ptr fs:[00000030h] 0_2_01B389B3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B389B3 mov eax, dword ptr fs:[00000030h] 0_2_01B389B3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB09AD mov eax, dword ptr fs:[00000030h] 0_2_01AB09AD
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB09AD mov eax, dword ptr fs:[00000030h] 0_2_01AB09AD
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC29A0 mov eax, dword ptr fs:[00000030h] 0_2_01AC29A0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3E9E0 mov eax, dword ptr fs:[00000030h] 0_2_01B3E9E0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE29F9 mov eax, dword ptr fs:[00000030h] 0_2_01AE29F9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE29F9 mov eax, dword ptr fs:[00000030h] 0_2_01AE29F9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7A9D3 mov eax, dword ptr fs:[00000030h] 0_2_01B7A9D3
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B469C0 mov eax, dword ptr fs:[00000030h] 0_2_01B469C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA9D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA9D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA9D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA9D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA9D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABA9D0 mov eax, dword ptr fs:[00000030h] 0_2_01ABA9D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE49D0 mov eax, dword ptr fs:[00000030h] 0_2_01AE49D0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3892A mov eax, dword ptr fs:[00000030h] 0_2_01B3892A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B4892B mov eax, dword ptr fs:[00000030h] 0_2_01B4892B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3C912 mov eax, dword ptr fs:[00000030h] 0_2_01B3C912
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA8918 mov eax, dword ptr fs:[00000030h] 0_2_01AA8918
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA8918 mov eax, dword ptr fs:[00000030h] 0_2_01AA8918
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E908 mov eax, dword ptr fs:[00000030h] 0_2_01B2E908
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2E908 mov eax, dword ptr fs:[00000030h] 0_2_01B2E908
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF096E mov eax, dword ptr fs:[00000030h] 0_2_01AF096E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF096E mov edx, dword ptr fs:[00000030h] 0_2_01AF096E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AF096E mov eax, dword ptr fs:[00000030h] 0_2_01AF096E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B54978 mov eax, dword ptr fs:[00000030h] 0_2_01B54978
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B54978 mov eax, dword ptr fs:[00000030h] 0_2_01B54978
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD6962 mov eax, dword ptr fs:[00000030h] 0_2_01AD6962
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD6962 mov eax, dword ptr fs:[00000030h] 0_2_01AD6962
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD6962 mov eax, dword ptr fs:[00000030h] 0_2_01AD6962
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3C97C mov eax, dword ptr fs:[00000030h] 0_2_01B3C97C
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B30946 mov eax, dword ptr fs:[00000030h] 0_2_01B30946
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84940 mov eax, dword ptr fs:[00000030h] 0_2_01B84940
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0887 mov eax, dword ptr fs:[00000030h] 0_2_01AB0887
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3C89D mov eax, dword ptr fs:[00000030h] 0_2_01B3C89D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7A8E4 mov eax, dword ptr fs:[00000030h] 0_2_01B7A8E4
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC8F9 mov eax, dword ptr fs:[00000030h] 0_2_01AEC8F9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEC8F9 mov eax, dword ptr fs:[00000030h] 0_2_01AEC8F9
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADE8C0 mov eax, dword ptr fs:[00000030h] 0_2_01ADE8C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B808C0 mov eax, dword ptr fs:[00000030h] 0_2_01B808C0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5483A mov eax, dword ptr fs:[00000030h] 0_2_01B5483A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5483A mov eax, dword ptr fs:[00000030h] 0_2_01B5483A
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h] 0_2_01AD2835
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h] 0_2_01AD2835
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h] 0_2_01AD2835
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD2835 mov ecx, dword ptr fs:[00000030h] 0_2_01AD2835
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h] 0_2_01AD2835
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD2835 mov eax, dword ptr fs:[00000030h] 0_2_01AD2835
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEA830 mov eax, dword ptr fs:[00000030h] 0_2_01AEA830
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3C810 mov eax, dword ptr fs:[00000030h] 0_2_01B3C810
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3E872 mov eax, dword ptr fs:[00000030h] 0_2_01B3E872
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3E872 mov eax, dword ptr fs:[00000030h] 0_2_01B3E872
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B46870 mov eax, dword ptr fs:[00000030h] 0_2_01B46870
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B46870 mov eax, dword ptr fs:[00000030h] 0_2_01B46870
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC2840 mov ecx, dword ptr fs:[00000030h] 0_2_01AC2840
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB4859 mov eax, dword ptr fs:[00000030h] 0_2_01AB4859
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB4859 mov eax, dword ptr fs:[00000030h] 0_2_01AB4859
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE0854 mov eax, dword ptr fs:[00000030h] 0_2_01AE0854
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B64BB0 mov eax, dword ptr fs:[00000030h] 0_2_01B64BB0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B64BB0 mov eax, dword ptr fs:[00000030h] 0_2_01B64BB0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0BBE mov eax, dword ptr fs:[00000030h] 0_2_01AC0BBE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AC0BBE mov eax, dword ptr fs:[00000030h] 0_2_01AC0BBE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3CBF0 mov eax, dword ptr fs:[00000030h] 0_2_01B3CBF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADEBFC mov eax, dword ptr fs:[00000030h] 0_2_01ADEBFC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8BF0 mov eax, dword ptr fs:[00000030h] 0_2_01AB8BF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8BF0 mov eax, dword ptr fs:[00000030h] 0_2_01AB8BF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8BF0 mov eax, dword ptr fs:[00000030h] 0_2_01AB8BF0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5EBD0 mov eax, dword ptr fs:[00000030h] 0_2_01B5EBD0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0BCD mov eax, dword ptr fs:[00000030h] 0_2_01AB0BCD
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0BCD mov eax, dword ptr fs:[00000030h] 0_2_01AB0BCD
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0BCD mov eax, dword ptr fs:[00000030h] 0_2_01AB0BCD
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD0BCB mov eax, dword ptr fs:[00000030h] 0_2_01AD0BCB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD0BCB mov eax, dword ptr fs:[00000030h] 0_2_01AD0BCB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD0BCB mov eax, dword ptr fs:[00000030h] 0_2_01AD0BCB
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADEB20 mov eax, dword ptr fs:[00000030h] 0_2_01ADEB20
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADEB20 mov eax, dword ptr fs:[00000030h] 0_2_01ADEB20
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B78B28 mov eax, dword ptr fs:[00000030h] 0_2_01B78B28
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B78B28 mov eax, dword ptr fs:[00000030h] 0_2_01B78B28
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2EB1D mov eax, dword ptr fs:[00000030h] 0_2_01B2EB1D
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84B00 mov eax, dword ptr fs:[00000030h] 0_2_01B84B00
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AACB7E mov eax, dword ptr fs:[00000030h] 0_2_01AACB7E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B5EB50 mov eax, dword ptr fs:[00000030h] 0_2_01B5EB50
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h] 0_2_01B82B57
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h] 0_2_01B82B57
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h] 0_2_01B82B57
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B82B57 mov eax, dword ptr fs:[00000030h] 0_2_01B82B57
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B46B40 mov eax, dword ptr fs:[00000030h] 0_2_01B46B40
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B46B40 mov eax, dword ptr fs:[00000030h] 0_2_01B46B40
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B7AB40 mov eax, dword ptr fs:[00000030h] 0_2_01B7AB40
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B58B42 mov eax, dword ptr fs:[00000030h] 0_2_01B58B42
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AA8B50 mov eax, dword ptr fs:[00000030h] 0_2_01AA8B50
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B64B4B mov eax, dword ptr fs:[00000030h] 0_2_01B64B4B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B64B4B mov eax, dword ptr fs:[00000030h] 0_2_01B64B4B
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8AA0 mov eax, dword ptr fs:[00000030h] 0_2_01AB8AA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB8AA0 mov eax, dword ptr fs:[00000030h] 0_2_01AB8AA0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B06AA4 mov eax, dword ptr fs:[00000030h] 0_2_01B06AA4
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ABEA80 mov eax, dword ptr fs:[00000030h] 0_2_01ABEA80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B84A80 mov eax, dword ptr fs:[00000030h] 0_2_01B84A80
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE8A90 mov edx, dword ptr fs:[00000030h] 0_2_01AE8A90
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEAAEE mov eax, dword ptr fs:[00000030h] 0_2_01AEAAEE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AEAAEE mov eax, dword ptr fs:[00000030h] 0_2_01AEAAEE
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AB0AD0 mov eax, dword ptr fs:[00000030h] 0_2_01AB0AD0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B06ACC mov eax, dword ptr fs:[00000030h] 0_2_01B06ACC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B06ACC mov eax, dword ptr fs:[00000030h] 0_2_01B06ACC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B06ACC mov eax, dword ptr fs:[00000030h] 0_2_01B06ACC
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE4AD0 mov eax, dword ptr fs:[00000030h] 0_2_01AE4AD0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AE4AD0 mov eax, dword ptr fs:[00000030h] 0_2_01AE4AD0
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01ADEA2E mov eax, dword ptr fs:[00000030h] 0_2_01ADEA2E
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AECA24 mov eax, dword ptr fs:[00000030h] 0_2_01AECA24
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AECA38 mov eax, dword ptr fs:[00000030h] 0_2_01AECA38
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD4A35 mov eax, dword ptr fs:[00000030h] 0_2_01AD4A35
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AD4A35 mov eax, dword ptr fs:[00000030h] 0_2_01AD4A35
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B3CA11 mov eax, dword ptr fs:[00000030h] 0_2_01B3CA11
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2CA72 mov eax, dword ptr fs:[00000030h] 0_2_01B2CA72
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01B2CA72 mov eax, dword ptr fs:[00000030h] 0_2_01B2CA72
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AECA6F mov eax, dword ptr fs:[00000030h] 0_2_01AECA6F
Source: C:\Users\user\Desktop\17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe Code function: 0_2_01AECA6F mov eax, dword ptr fs:[00000030h] 0_2_01AECA6F
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.3.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1998268034.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1528396 Sample: 17283307843512ddb9da5feb065... Startdate: 07/10/2024 Architecture: WINDOWS Score: 80 10 Malicious sample detected (through community Yara rule) 2->10 12 Antivirus / Scanner detection for submitted sample 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 3 other signatures 2->16 6 17283307843512ddb9da5feb065e9e51f430014971376a63e309c849f05d5ebedafef72522599.dat-decoded.exe 2->6         started        process3 process4 8 WerFault.exe 21 16 6->8         started       
⊘No contacted IP infos