Windows Analysis Report
5ZLQrKA4ge.exe

Overview

General Information

Sample name: 5ZLQrKA4ge.exe
renamed because original name is a hash value
Original sample name: 282cc024b77357ebf01066b447e9aba43980a62478750ae24b5af2d22c9a7767.exe
Analysis ID: 1530782
MD5: f7defbfeafc669edb9f091e02ebfc851
SHA1: 288ba25fa5e5f998ccdeb46ab653bf2857377ceb
SHA256: 282cc024b77357ebf01066b447e9aba43980a62478750ae24b5af2d22c9a7767
Tags: exeuser-adrian__luca
Infos:

Detection

FormBook
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Machine Learning detection for sample
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file does not import any functions
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 5ZLQrKA4ge.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: 5ZLQrKA4ge.exe ReversingLabs: Detection: 60%
Yara detected FormBook
Source: Yara match File source: 0.2.5ZLQrKA4ge.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2786935120.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2787009901.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 5ZLQrKA4ge.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 5ZLQrKA4ge.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 5ZLQrKA4ge.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: 5ZLQrKA4ge.exe, 00000000.00000003.2457542544.0000000000949000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000003.2455770471.000000000079B000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000C8E000.00000040.00001000.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 5ZLQrKA4ge.exe, 5ZLQrKA4ge.exe, 00000000.00000003.2457542544.0000000000949000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000003.2455770471.000000000079B000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000C8E000.00000040.00001000.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.5ZLQrKA4ge.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2786935120.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2787009901.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.5ZLQrKA4ge.exe.110000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2786935120.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.2787009901.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0013C703 NtClose, 0_2_0013C703
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00111A7D NtProtectVirtualMemory, 0_2_00111A7D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62B60 NtClose,LdrInitializeThunk, 0_2_00B62B60
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62C70 NtFreeVirtualMemory,LdrInitializeThunk, 0_2_00B62C70
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62DF0 NtQuerySystemInformation,LdrInitializeThunk, 0_2_00B62DF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B635C0 NtCreateMutant,LdrInitializeThunk, 0_2_00B635C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B64340 NtSetContextThread, 0_2_00B64340
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B64650 NtSuspendThread, 0_2_00B64650
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62AB0 NtWaitForSingleObject, 0_2_00B62AB0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62AF0 NtWriteFile, 0_2_00B62AF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62AD0 NtReadFile, 0_2_00B62AD0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62BA0 NtEnumerateValueKey, 0_2_00B62BA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62B80 NtQueryInformationFile, 0_2_00B62B80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62BF0 NtAllocateVirtualMemory, 0_2_00B62BF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62BE0 NtQueryValueKey, 0_2_00B62BE0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62CA0 NtQueryInformationToken, 0_2_00B62CA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62CF0 NtOpenProcess, 0_2_00B62CF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62CC0 NtQueryVirtualMemory, 0_2_00B62CC0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62C00 NtQueryInformationProcess, 0_2_00B62C00
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62C60 NtCreateKey, 0_2_00B62C60
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62DB0 NtEnumerateKey, 0_2_00B62DB0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62DD0 NtDelayExecution, 0_2_00B62DD0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62D30 NtUnmapViewOfSection, 0_2_00B62D30
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62D10 NtMapViewOfSection, 0_2_00B62D10
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62D00 NtSetInformationFile, 0_2_00B62D00
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62EA0 NtAdjustPrivilegesToken, 0_2_00B62EA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62E80 NtReadVirtualMemory, 0_2_00B62E80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62EE0 NtQueueApcThread, 0_2_00B62EE0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62E30 NtWriteVirtualMemory, 0_2_00B62E30
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62FB0 NtResumeThread, 0_2_00B62FB0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62FA0 NtQuerySection, 0_2_00B62FA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62F90 NtProtectVirtualMemory, 0_2_00B62F90
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62FE0 NtCreateFile, 0_2_00B62FE0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62F30 NtCreateSection, 0_2_00B62F30
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62F60 NtCreateProcessEx, 0_2_00B62F60
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B63090 NtSetValueKey, 0_2_00B63090
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B63010 NtOpenDirectoryObject, 0_2_00B63010
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B639B0 NtGetContextThread, 0_2_00B639B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B63D10 NtOpenProcessToken, 0_2_00B63D10
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B63D70 NtOpenThread, 0_2_00B63D70
Detected potential crypto function
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00126893 0_2_00126893
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_001110CC 0_2_001110CC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_001200E3 0_2_001200E3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00113100 0_2_00113100
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0011E163 0_2_0011E163
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_001129B0 0_2_001129B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00111260 0_2_00111260
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0013ED53 0_2_0013ED53
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00112D69 0_2_00112D69
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00112670 0_2_00112670
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00112664 0_2_00112664
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0011FEBA 0_2_0011FEBA
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0011FEC3 0_2_0011FEC3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF01AA 0_2_00BF01AA
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE41A2 0_2_00BE41A2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE81CC 0_2_00BE81CC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCA118 0_2_00BCA118
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20100 0_2_00B20100
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB8158 0_2_00BB8158
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB02C0 0_2_00BB02C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E3F0 0_2_00B3E3F0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF03E6 0_2_00BF03E6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEA352 0_2_00BEA352
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDE4F6 0_2_00BDE4F6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD4420 0_2_00BD4420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE2446 0_2_00BE2446
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF0591 0_2_00BF0591
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30535 0_2_00B30535
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4C6E0 0_2_00B4C6E0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2C7C0 0_2_00B2C7C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B54750 0_2_00B54750
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B168B8 0_2_00B168B8
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E8F0 0_2_00B5E8F0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3A840 0_2_00B3A840
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B32840 0_2_00B32840
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BFA9A6 0_2_00BFA9A6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B46962 0_2_00B46962
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE6BD7 0_2_00BE6BD7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEAB40 0_2_00BEAB40
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0CB5 0_2_00BD0CB5
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20CF2 0_2_00B20CF2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30C00 0_2_00B30C00
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B48DBF 0_2_00B48DBF
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2ADE0 0_2_00B2ADE0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCCD1F 0_2_00BCCD1F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3AD00 0_2_00B3AD00
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B42E90 0_2_00B42E90
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BECE93 0_2_00BECE93
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEEEDB 0_2_00BEEEDB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEEE26 0_2_00BEEE26
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30E59 0_2_00B30E59
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAEFA0 0_2_00BAEFA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3CFE0 0_2_00B3CFE0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B22FC8 0_2_00B22FC8
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B50F30 0_2_00B50F30
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD2F30 0_2_00BD2F30
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B72F28 0_2_00B72F28
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA4F40 0_2_00BA4F40
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE70E9 0_2_00BE70E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEF0E0 0_2_00BEF0E0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDF0CC 0_2_00BDF0CC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B370C0 0_2_00B370C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3B1B0 0_2_00B3B1B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1F172 0_2_00B1F172
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BFB16B 0_2_00BFB16B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B6516C 0_2_00B6516C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B352A0 0_2_00B352A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD12ED 0_2_00BD12ED
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4B2C0 0_2_00B4B2C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B7739A 0_2_00B7739A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE132D 0_2_00BE132D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1D34C 0_2_00B1D34C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEF43F 0_2_00BEF43F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B21460 0_2_00B21460
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCD5B0 0_2_00BCD5B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF95C3 0_2_00BF95C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE7571 0_2_00BE7571
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE16CC 0_2_00BE16CC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B75630 0_2_00B75630
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEF7B0 0_2_00BEF7B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B338E0 0_2_00B338E0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9D800 0_2_00B9D800
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC5910 0_2_00BC5910
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B39950 0_2_00B39950
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4B950 0_2_00B4B950
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCDAAC 0_2_00BCDAAC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B75AA0 0_2_00B75AA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD1AA3 0_2_00BD1AA3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDDAC6 0_2_00BDDAC6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA3A6C 0_2_00BA3A6C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEFA49 0_2_00BEFA49
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE7A46 0_2_00BE7A46
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4FB80 0_2_00B4FB80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA5BF0 0_2_00BA5BF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B6DBF9 0_2_00B6DBF9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEFB76 0_2_00BEFB76
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEFCF2 0_2_00BEFCF2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA9C32 0_2_00BA9C32
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4FDC0 0_2_00B4FDC0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE7D73 0_2_00BE7D73
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE1D5A 0_2_00BE1D5A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B33D40 0_2_00B33D40
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B39EB0 0_2_00B39EB0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEFFB1 0_2_00BEFFB1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B31F92 0_2_00B31F92
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00AF3FD5 0_2_00AF3FD5
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00AF3FD2 0_2_00AF3FD2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEFF09 0_2_00BEFF09
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: String function: 00B1B970 appears 280 times
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: String function: 00B9EA12 appears 86 times
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: String function: 00BAF290 appears 105 times
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: String function: 00B65130 appears 58 times
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: String function: 00B77E54 appears 111 times
PE file does not import any functions
Source: 5ZLQrKA4ge.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: 5ZLQrKA4ge.exe, 00000000.00000003.2455770471.00000000008BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 5ZLQrKA4ge.exe
Source: 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000C1D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 5ZLQrKA4ge.exe
Source: 5ZLQrKA4ge.exe, 00000000.00000003.2457542544.0000000000A76000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 5ZLQrKA4ge.exe
Uses 32bit PE files
Source: 5ZLQrKA4ge.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.5ZLQrKA4ge.exe.110000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2786935120.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.2787009901.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5ZLQrKA4ge.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5ZLQrKA4ge.exe Static PE information: Section .text
Source: classification engine Classification label: mal80.troj.winEXE@1/0@0/0
Source: 5ZLQrKA4ge.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 5ZLQrKA4ge.exe ReversingLabs: Detection: 60%
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Section loaded: apphelp.dll Jump to behavior
Source: 5ZLQrKA4ge.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: 5ZLQrKA4ge.exe, 00000000.00000003.2457542544.0000000000949000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000003.2455770471.000000000079B000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000C8E000.00000040.00001000.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 5ZLQrKA4ge.exe, 5ZLQrKA4ge.exe, 00000000.00000003.2457542544.0000000000949000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000003.2455770471.000000000079B000.00000004.00000020.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000C8E000.00000040.00001000.00020000.00000000.sdmp, 5ZLQrKA4ge.exe, 00000000.00000002.2787146850.0000000000AF0000.00000040.00001000.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0011212D push es; retf 0_2_001121CE
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0011218B push es; retf 0_2_001121CE
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0011BB97 push ss; ret 0_2_0011BB98
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00113380 push eax; ret 0_2_00113382
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00124BC1 push 00000078h; iretd 0_2_00124BC6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_0012EBE5 push DFEE3EF2h; retf 0_2_0012EC02
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00118591 push es; ret 0_2_00118592
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00125EE3 push ecx; retf 0_2_00125F1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00AF225F pushad ; ret 0_2_00AF27F9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00AF27FA pushad ; ret 0_2_00AF27F9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00AF283D push eax; iretd 0_2_00AF2858
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B209AD push ecx; mov dword ptr [esp], ecx 0_2_00B209B6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00AF1368 push eax; iretd 0_2_00AF1369
Source: 5ZLQrKA4ge.exe Static PE information: section name: .text entropy: 7.99599916957851
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B6096E rdtsc 0_2_00B6096E
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe API coverage: 0.6 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B6096E rdtsc 0_2_00B6096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00127843 LdrLoadDll, 0_2_00127843
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE60B8 mov eax, dword ptr fs:[00000030h] 0_2_00BE60B8
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE60B8 mov ecx, dword ptr fs:[00000030h] 0_2_00BE60B8
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B180A0 mov eax, dword ptr fs:[00000030h] 0_2_00B180A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB80A8 mov eax, dword ptr fs:[00000030h] 0_2_00BB80A8
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2208A mov eax, dword ptr fs:[00000030h] 0_2_00B2208A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1C0F0 mov eax, dword ptr fs:[00000030h] 0_2_00B1C0F0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B620F0 mov ecx, dword ptr fs:[00000030h] 0_2_00B620F0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1A0E3 mov ecx, dword ptr fs:[00000030h] 0_2_00B1A0E3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA60E0 mov eax, dword ptr fs:[00000030h] 0_2_00BA60E0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B280E9 mov eax, dword ptr fs:[00000030h] 0_2_00B280E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA20DE mov eax, dword ptr fs:[00000030h] 0_2_00BA20DE
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB6030 mov eax, dword ptr fs:[00000030h] 0_2_00BB6030
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1A020 mov eax, dword ptr fs:[00000030h] 0_2_00B1A020
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1C020 mov eax, dword ptr fs:[00000030h] 0_2_00B1C020
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E016 mov eax, dword ptr fs:[00000030h] 0_2_00B3E016
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E016 mov eax, dword ptr fs:[00000030h] 0_2_00B3E016
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E016 mov eax, dword ptr fs:[00000030h] 0_2_00B3E016
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E016 mov eax, dword ptr fs:[00000030h] 0_2_00B3E016
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA4000 mov ecx, dword ptr fs:[00000030h] 0_2_00BA4000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC2000 mov eax, dword ptr fs:[00000030h] 0_2_00BC2000
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4C073 mov eax, dword ptr fs:[00000030h] 0_2_00B4C073
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B22050 mov eax, dword ptr fs:[00000030h] 0_2_00B22050
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6050 mov eax, dword ptr fs:[00000030h] 0_2_00BA6050
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA019F mov eax, dword ptr fs:[00000030h] 0_2_00BA019F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA019F mov eax, dword ptr fs:[00000030h] 0_2_00BA019F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA019F mov eax, dword ptr fs:[00000030h] 0_2_00BA019F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA019F mov eax, dword ptr fs:[00000030h] 0_2_00BA019F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1A197 mov eax, dword ptr fs:[00000030h] 0_2_00B1A197
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1A197 mov eax, dword ptr fs:[00000030h] 0_2_00B1A197
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1A197 mov eax, dword ptr fs:[00000030h] 0_2_00B1A197
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B60185 mov eax, dword ptr fs:[00000030h] 0_2_00B60185
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDC188 mov eax, dword ptr fs:[00000030h] 0_2_00BDC188
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDC188 mov eax, dword ptr fs:[00000030h] 0_2_00BDC188
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC4180 mov eax, dword ptr fs:[00000030h] 0_2_00BC4180
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC4180 mov eax, dword ptr fs:[00000030h] 0_2_00BC4180
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B501F8 mov eax, dword ptr fs:[00000030h] 0_2_00B501F8
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF61E5 mov eax, dword ptr fs:[00000030h] 0_2_00BF61E5
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E1D0 mov eax, dword ptr fs:[00000030h] 0_2_00B9E1D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E1D0 mov eax, dword ptr fs:[00000030h] 0_2_00B9E1D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E1D0 mov ecx, dword ptr fs:[00000030h] 0_2_00B9E1D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E1D0 mov eax, dword ptr fs:[00000030h] 0_2_00B9E1D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E1D0 mov eax, dword ptr fs:[00000030h] 0_2_00B9E1D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE61C3 mov eax, dword ptr fs:[00000030h] 0_2_00BE61C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE61C3 mov eax, dword ptr fs:[00000030h] 0_2_00BE61C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B50124 mov eax, dword ptr fs:[00000030h] 0_2_00B50124
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCA118 mov ecx, dword ptr fs:[00000030h] 0_2_00BCA118
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCA118 mov eax, dword ptr fs:[00000030h] 0_2_00BCA118
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCA118 mov eax, dword ptr fs:[00000030h] 0_2_00BCA118
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCA118 mov eax, dword ptr fs:[00000030h] 0_2_00BCA118
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE0115 mov eax, dword ptr fs:[00000030h] 0_2_00BE0115
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov eax, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov ecx, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov eax, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov eax, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov ecx, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov eax, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov eax, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov ecx, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov eax, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE10E mov ecx, dword ptr fs:[00000030h] 0_2_00BCE10E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4164 mov eax, dword ptr fs:[00000030h] 0_2_00BF4164
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4164 mov eax, dword ptr fs:[00000030h] 0_2_00BF4164
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB8158 mov eax, dword ptr fs:[00000030h] 0_2_00BB8158
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26154 mov eax, dword ptr fs:[00000030h] 0_2_00B26154
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26154 mov eax, dword ptr fs:[00000030h] 0_2_00B26154
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1C156 mov eax, dword ptr fs:[00000030h] 0_2_00B1C156
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB4144 mov eax, dword ptr fs:[00000030h] 0_2_00BB4144
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB4144 mov eax, dword ptr fs:[00000030h] 0_2_00BB4144
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB4144 mov ecx, dword ptr fs:[00000030h] 0_2_00BB4144
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB4144 mov eax, dword ptr fs:[00000030h] 0_2_00BB4144
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB4144 mov eax, dword ptr fs:[00000030h] 0_2_00BB4144
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB62A0 mov eax, dword ptr fs:[00000030h] 0_2_00BB62A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB62A0 mov ecx, dword ptr fs:[00000030h] 0_2_00BB62A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB62A0 mov eax, dword ptr fs:[00000030h] 0_2_00BB62A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB62A0 mov eax, dword ptr fs:[00000030h] 0_2_00BB62A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB62A0 mov eax, dword ptr fs:[00000030h] 0_2_00BB62A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB62A0 mov eax, dword ptr fs:[00000030h] 0_2_00BB62A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E284 mov eax, dword ptr fs:[00000030h] 0_2_00B5E284
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E284 mov eax, dword ptr fs:[00000030h] 0_2_00B5E284
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA0283 mov eax, dword ptr fs:[00000030h] 0_2_00BA0283
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA0283 mov eax, dword ptr fs:[00000030h] 0_2_00BA0283
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA0283 mov eax, dword ptr fs:[00000030h] 0_2_00BA0283
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B302E1 mov eax, dword ptr fs:[00000030h] 0_2_00B302E1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B302E1 mov eax, dword ptr fs:[00000030h] 0_2_00B302E1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B302E1 mov eax, dword ptr fs:[00000030h] 0_2_00B302E1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF62D6 mov eax, dword ptr fs:[00000030h] 0_2_00BF62D6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A2C3 mov eax, dword ptr fs:[00000030h] 0_2_00B2A2C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A2C3 mov eax, dword ptr fs:[00000030h] 0_2_00B2A2C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A2C3 mov eax, dword ptr fs:[00000030h] 0_2_00B2A2C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A2C3 mov eax, dword ptr fs:[00000030h] 0_2_00B2A2C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A2C3 mov eax, dword ptr fs:[00000030h] 0_2_00B2A2C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1823B mov eax, dword ptr fs:[00000030h] 0_2_00B1823B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD0274 mov eax, dword ptr fs:[00000030h] 0_2_00BD0274
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B24260 mov eax, dword ptr fs:[00000030h] 0_2_00B24260
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B24260 mov eax, dword ptr fs:[00000030h] 0_2_00B24260
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B24260 mov eax, dword ptr fs:[00000030h] 0_2_00B24260
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1826B mov eax, dword ptr fs:[00000030h] 0_2_00B1826B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1A250 mov eax, dword ptr fs:[00000030h] 0_2_00B1A250
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF625D mov eax, dword ptr fs:[00000030h] 0_2_00BF625D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26259 mov eax, dword ptr fs:[00000030h] 0_2_00B26259
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDA250 mov eax, dword ptr fs:[00000030h] 0_2_00BDA250
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDA250 mov eax, dword ptr fs:[00000030h] 0_2_00BDA250
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA8243 mov eax, dword ptr fs:[00000030h] 0_2_00BA8243
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA8243 mov ecx, dword ptr fs:[00000030h] 0_2_00BA8243
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B18397 mov eax, dword ptr fs:[00000030h] 0_2_00B18397
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B18397 mov eax, dword ptr fs:[00000030h] 0_2_00B18397
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B18397 mov eax, dword ptr fs:[00000030h] 0_2_00B18397
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1E388 mov eax, dword ptr fs:[00000030h] 0_2_00B1E388
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1E388 mov eax, dword ptr fs:[00000030h] 0_2_00B1E388
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1E388 mov eax, dword ptr fs:[00000030h] 0_2_00B1E388
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4438F mov eax, dword ptr fs:[00000030h] 0_2_00B4438F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4438F mov eax, dword ptr fs:[00000030h] 0_2_00B4438F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E3F0 mov eax, dword ptr fs:[00000030h] 0_2_00B3E3F0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E3F0 mov eax, dword ptr fs:[00000030h] 0_2_00B3E3F0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E3F0 mov eax, dword ptr fs:[00000030h] 0_2_00B3E3F0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B563FF mov eax, dword ptr fs:[00000030h] 0_2_00B563FF
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B303E9 mov eax, dword ptr fs:[00000030h] 0_2_00B303E9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE3DB mov eax, dword ptr fs:[00000030h] 0_2_00BCE3DB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE3DB mov eax, dword ptr fs:[00000030h] 0_2_00BCE3DB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE3DB mov ecx, dword ptr fs:[00000030h] 0_2_00BCE3DB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCE3DB mov eax, dword ptr fs:[00000030h] 0_2_00BCE3DB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC43D4 mov eax, dword ptr fs:[00000030h] 0_2_00BC43D4
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC43D4 mov eax, dword ptr fs:[00000030h] 0_2_00BC43D4
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDC3CD mov eax, dword ptr fs:[00000030h] 0_2_00BDC3CD
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A3C0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A3C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A3C0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A3C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A3C0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A3C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A3C0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A3C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A3C0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A3C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A3C0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A3C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B283C0 mov eax, dword ptr fs:[00000030h] 0_2_00B283C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B283C0 mov eax, dword ptr fs:[00000030h] 0_2_00B283C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B283C0 mov eax, dword ptr fs:[00000030h] 0_2_00B283C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B283C0 mov eax, dword ptr fs:[00000030h] 0_2_00B283C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA63C0 mov eax, dword ptr fs:[00000030h] 0_2_00BA63C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF8324 mov eax, dword ptr fs:[00000030h] 0_2_00BF8324
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF8324 mov ecx, dword ptr fs:[00000030h] 0_2_00BF8324
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF8324 mov eax, dword ptr fs:[00000030h] 0_2_00BF8324
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF8324 mov eax, dword ptr fs:[00000030h] 0_2_00BF8324
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1C310 mov ecx, dword ptr fs:[00000030h] 0_2_00B1C310
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B40310 mov ecx, dword ptr fs:[00000030h] 0_2_00B40310
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A30B mov eax, dword ptr fs:[00000030h] 0_2_00B5A30B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A30B mov eax, dword ptr fs:[00000030h] 0_2_00B5A30B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A30B mov eax, dword ptr fs:[00000030h] 0_2_00B5A30B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC437C mov eax, dword ptr fs:[00000030h] 0_2_00BC437C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA035C mov eax, dword ptr fs:[00000030h] 0_2_00BA035C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA035C mov eax, dword ptr fs:[00000030h] 0_2_00BA035C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA035C mov eax, dword ptr fs:[00000030h] 0_2_00BA035C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA035C mov ecx, dword ptr fs:[00000030h] 0_2_00BA035C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA035C mov eax, dword ptr fs:[00000030h] 0_2_00BA035C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA035C mov eax, dword ptr fs:[00000030h] 0_2_00BA035C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEA352 mov eax, dword ptr fs:[00000030h] 0_2_00BEA352
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC8350 mov ecx, dword ptr fs:[00000030h] 0_2_00BC8350
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF634F mov eax, dword ptr fs:[00000030h] 0_2_00BF634F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA2349 mov eax, dword ptr fs:[00000030h] 0_2_00BA2349
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B544B0 mov ecx, dword ptr fs:[00000030h] 0_2_00B544B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAA4B0 mov eax, dword ptr fs:[00000030h] 0_2_00BAA4B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B264AB mov eax, dword ptr fs:[00000030h] 0_2_00B264AB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDA49A mov eax, dword ptr fs:[00000030h] 0_2_00BDA49A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B204E5 mov ecx, dword ptr fs:[00000030h] 0_2_00B204E5
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A430 mov eax, dword ptr fs:[00000030h] 0_2_00B5A430
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1E420 mov eax, dword ptr fs:[00000030h] 0_2_00B1E420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1E420 mov eax, dword ptr fs:[00000030h] 0_2_00B1E420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1E420 mov eax, dword ptr fs:[00000030h] 0_2_00B1E420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1C427 mov eax, dword ptr fs:[00000030h] 0_2_00B1C427
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6420 mov eax, dword ptr fs:[00000030h] 0_2_00BA6420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6420 mov eax, dword ptr fs:[00000030h] 0_2_00BA6420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6420 mov eax, dword ptr fs:[00000030h] 0_2_00BA6420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6420 mov eax, dword ptr fs:[00000030h] 0_2_00BA6420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6420 mov eax, dword ptr fs:[00000030h] 0_2_00BA6420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6420 mov eax, dword ptr fs:[00000030h] 0_2_00BA6420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA6420 mov eax, dword ptr fs:[00000030h] 0_2_00BA6420
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B58402 mov eax, dword ptr fs:[00000030h] 0_2_00B58402
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B58402 mov eax, dword ptr fs:[00000030h] 0_2_00B58402
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B58402 mov eax, dword ptr fs:[00000030h] 0_2_00B58402
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4A470 mov eax, dword ptr fs:[00000030h] 0_2_00B4A470
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4A470 mov eax, dword ptr fs:[00000030h] 0_2_00B4A470
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4A470 mov eax, dword ptr fs:[00000030h] 0_2_00B4A470
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAC460 mov ecx, dword ptr fs:[00000030h] 0_2_00BAC460
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BDA456 mov eax, dword ptr fs:[00000030h] 0_2_00BDA456
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1645D mov eax, dword ptr fs:[00000030h] 0_2_00B1645D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4245A mov eax, dword ptr fs:[00000030h] 0_2_00B4245A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E443 mov eax, dword ptr fs:[00000030h] 0_2_00B5E443
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B445B1 mov eax, dword ptr fs:[00000030h] 0_2_00B445B1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B445B1 mov eax, dword ptr fs:[00000030h] 0_2_00B445B1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA05A7 mov eax, dword ptr fs:[00000030h] 0_2_00BA05A7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA05A7 mov eax, dword ptr fs:[00000030h] 0_2_00BA05A7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA05A7 mov eax, dword ptr fs:[00000030h] 0_2_00BA05A7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E59C mov eax, dword ptr fs:[00000030h] 0_2_00B5E59C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B22582 mov eax, dword ptr fs:[00000030h] 0_2_00B22582
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B22582 mov ecx, dword ptr fs:[00000030h] 0_2_00B22582
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B54588 mov eax, dword ptr fs:[00000030h] 0_2_00B54588
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B225E0 mov eax, dword ptr fs:[00000030h] 0_2_00B225E0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E5E7 mov eax, dword ptr fs:[00000030h] 0_2_00B4E5E7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C5ED mov eax, dword ptr fs:[00000030h] 0_2_00B5C5ED
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C5ED mov eax, dword ptr fs:[00000030h] 0_2_00B5C5ED
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B265D0 mov eax, dword ptr fs:[00000030h] 0_2_00B265D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A5D0 mov eax, dword ptr fs:[00000030h] 0_2_00B5A5D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A5D0 mov eax, dword ptr fs:[00000030h] 0_2_00B5A5D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E5CF mov eax, dword ptr fs:[00000030h] 0_2_00B5E5CF
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5E5CF mov eax, dword ptr fs:[00000030h] 0_2_00B5E5CF
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30535 mov eax, dword ptr fs:[00000030h] 0_2_00B30535
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30535 mov eax, dword ptr fs:[00000030h] 0_2_00B30535
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30535 mov eax, dword ptr fs:[00000030h] 0_2_00B30535
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30535 mov eax, dword ptr fs:[00000030h] 0_2_00B30535
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30535 mov eax, dword ptr fs:[00000030h] 0_2_00B30535
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30535 mov eax, dword ptr fs:[00000030h] 0_2_00B30535
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E53E mov eax, dword ptr fs:[00000030h] 0_2_00B4E53E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E53E mov eax, dword ptr fs:[00000030h] 0_2_00B4E53E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E53E mov eax, dword ptr fs:[00000030h] 0_2_00B4E53E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E53E mov eax, dword ptr fs:[00000030h] 0_2_00B4E53E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E53E mov eax, dword ptr fs:[00000030h] 0_2_00B4E53E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB6500 mov eax, dword ptr fs:[00000030h] 0_2_00BB6500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4500 mov eax, dword ptr fs:[00000030h] 0_2_00BF4500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4500 mov eax, dword ptr fs:[00000030h] 0_2_00BF4500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4500 mov eax, dword ptr fs:[00000030h] 0_2_00BF4500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4500 mov eax, dword ptr fs:[00000030h] 0_2_00BF4500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4500 mov eax, dword ptr fs:[00000030h] 0_2_00BF4500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4500 mov eax, dword ptr fs:[00000030h] 0_2_00BF4500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4500 mov eax, dword ptr fs:[00000030h] 0_2_00BF4500
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5656A mov eax, dword ptr fs:[00000030h] 0_2_00B5656A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5656A mov eax, dword ptr fs:[00000030h] 0_2_00B5656A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5656A mov eax, dword ptr fs:[00000030h] 0_2_00B5656A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28550 mov eax, dword ptr fs:[00000030h] 0_2_00B28550
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28550 mov eax, dword ptr fs:[00000030h] 0_2_00B28550
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B566B0 mov eax, dword ptr fs:[00000030h] 0_2_00B566B0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C6A6 mov eax, dword ptr fs:[00000030h] 0_2_00B5C6A6
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B24690 mov eax, dword ptr fs:[00000030h] 0_2_00B24690
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B24690 mov eax, dword ptr fs:[00000030h] 0_2_00B24690
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E6F2 mov eax, dword ptr fs:[00000030h] 0_2_00B9E6F2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E6F2 mov eax, dword ptr fs:[00000030h] 0_2_00B9E6F2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E6F2 mov eax, dword ptr fs:[00000030h] 0_2_00B9E6F2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E6F2 mov eax, dword ptr fs:[00000030h] 0_2_00B9E6F2
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA06F1 mov eax, dword ptr fs:[00000030h] 0_2_00BA06F1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA06F1 mov eax, dword ptr fs:[00000030h] 0_2_00BA06F1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A6C7 mov ebx, dword ptr fs:[00000030h] 0_2_00B5A6C7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A6C7 mov eax, dword ptr fs:[00000030h] 0_2_00B5A6C7
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3E627 mov eax, dword ptr fs:[00000030h] 0_2_00B3E627
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B56620 mov eax, dword ptr fs:[00000030h] 0_2_00B56620
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B58620 mov eax, dword ptr fs:[00000030h] 0_2_00B58620
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2262C mov eax, dword ptr fs:[00000030h] 0_2_00B2262C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62619 mov eax, dword ptr fs:[00000030h] 0_2_00B62619
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E609 mov eax, dword ptr fs:[00000030h] 0_2_00B9E609
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3260B mov eax, dword ptr fs:[00000030h] 0_2_00B3260B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3260B mov eax, dword ptr fs:[00000030h] 0_2_00B3260B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3260B mov eax, dword ptr fs:[00000030h] 0_2_00B3260B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3260B mov eax, dword ptr fs:[00000030h] 0_2_00B3260B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3260B mov eax, dword ptr fs:[00000030h] 0_2_00B3260B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3260B mov eax, dword ptr fs:[00000030h] 0_2_00B3260B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3260B mov eax, dword ptr fs:[00000030h] 0_2_00B3260B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B52674 mov eax, dword ptr fs:[00000030h] 0_2_00B52674
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE866E mov eax, dword ptr fs:[00000030h] 0_2_00BE866E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE866E mov eax, dword ptr fs:[00000030h] 0_2_00BE866E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A660 mov eax, dword ptr fs:[00000030h] 0_2_00B5A660
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A660 mov eax, dword ptr fs:[00000030h] 0_2_00B5A660
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B3C640 mov eax, dword ptr fs:[00000030h] 0_2_00B3C640
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B207AF mov eax, dword ptr fs:[00000030h] 0_2_00B207AF
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD47A0 mov eax, dword ptr fs:[00000030h] 0_2_00BD47A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC678E mov eax, dword ptr fs:[00000030h] 0_2_00BC678E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B247FB mov eax, dword ptr fs:[00000030h] 0_2_00B247FB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B247FB mov eax, dword ptr fs:[00000030h] 0_2_00B247FB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B427ED mov eax, dword ptr fs:[00000030h] 0_2_00B427ED
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B427ED mov eax, dword ptr fs:[00000030h] 0_2_00B427ED
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B427ED mov eax, dword ptr fs:[00000030h] 0_2_00B427ED
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAE7E1 mov eax, dword ptr fs:[00000030h] 0_2_00BAE7E1
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2C7C0 mov eax, dword ptr fs:[00000030h] 0_2_00B2C7C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA07C3 mov eax, dword ptr fs:[00000030h] 0_2_00BA07C3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5273C mov eax, dword ptr fs:[00000030h] 0_2_00B5273C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5273C mov ecx, dword ptr fs:[00000030h] 0_2_00B5273C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5273C mov eax, dword ptr fs:[00000030h] 0_2_00B5273C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9C730 mov eax, dword ptr fs:[00000030h] 0_2_00B9C730
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C720 mov eax, dword ptr fs:[00000030h] 0_2_00B5C720
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C720 mov eax, dword ptr fs:[00000030h] 0_2_00B5C720
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20710 mov eax, dword ptr fs:[00000030h] 0_2_00B20710
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B50710 mov eax, dword ptr fs:[00000030h] 0_2_00B50710
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C700 mov eax, dword ptr fs:[00000030h] 0_2_00B5C700
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28770 mov eax, dword ptr fs:[00000030h] 0_2_00B28770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30770 mov eax, dword ptr fs:[00000030h] 0_2_00B30770
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20750 mov eax, dword ptr fs:[00000030h] 0_2_00B20750
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62750 mov eax, dword ptr fs:[00000030h] 0_2_00B62750
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B62750 mov eax, dword ptr fs:[00000030h] 0_2_00B62750
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAE75D mov eax, dword ptr fs:[00000030h] 0_2_00BAE75D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA4755 mov eax, dword ptr fs:[00000030h] 0_2_00BA4755
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5674D mov esi, dword ptr fs:[00000030h] 0_2_00B5674D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5674D mov eax, dword ptr fs:[00000030h] 0_2_00B5674D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5674D mov eax, dword ptr fs:[00000030h] 0_2_00B5674D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAC89D mov eax, dword ptr fs:[00000030h] 0_2_00BAC89D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20887 mov eax, dword ptr fs:[00000030h] 0_2_00B20887
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C8F9 mov eax, dword ptr fs:[00000030h] 0_2_00B5C8F9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5C8F9 mov eax, dword ptr fs:[00000030h] 0_2_00B5C8F9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEA8E4 mov eax, dword ptr fs:[00000030h] 0_2_00BEA8E4
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4E8C0 mov eax, dword ptr fs:[00000030h] 0_2_00B4E8C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF08C0 mov eax, dword ptr fs:[00000030h] 0_2_00BF08C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B42835 mov eax, dword ptr fs:[00000030h] 0_2_00B42835
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B42835 mov eax, dword ptr fs:[00000030h] 0_2_00B42835
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B42835 mov eax, dword ptr fs:[00000030h] 0_2_00B42835
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B42835 mov ecx, dword ptr fs:[00000030h] 0_2_00B42835
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B42835 mov eax, dword ptr fs:[00000030h] 0_2_00B42835
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B42835 mov eax, dword ptr fs:[00000030h] 0_2_00B42835
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5A830 mov eax, dword ptr fs:[00000030h] 0_2_00B5A830
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC483A mov eax, dword ptr fs:[00000030h] 0_2_00BC483A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC483A mov eax, dword ptr fs:[00000030h] 0_2_00BC483A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAC810 mov eax, dword ptr fs:[00000030h] 0_2_00BAC810
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAE872 mov eax, dword ptr fs:[00000030h] 0_2_00BAE872
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAE872 mov eax, dword ptr fs:[00000030h] 0_2_00BAE872
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB6870 mov eax, dword ptr fs:[00000030h] 0_2_00BB6870
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB6870 mov eax, dword ptr fs:[00000030h] 0_2_00BB6870
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B50854 mov eax, dword ptr fs:[00000030h] 0_2_00B50854
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B24859 mov eax, dword ptr fs:[00000030h] 0_2_00B24859
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B24859 mov eax, dword ptr fs:[00000030h] 0_2_00B24859
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B32840 mov ecx, dword ptr fs:[00000030h] 0_2_00B32840
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA89B3 mov esi, dword ptr fs:[00000030h] 0_2_00BA89B3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA89B3 mov eax, dword ptr fs:[00000030h] 0_2_00BA89B3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA89B3 mov eax, dword ptr fs:[00000030h] 0_2_00BA89B3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B329A0 mov eax, dword ptr fs:[00000030h] 0_2_00B329A0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B209AD mov eax, dword ptr fs:[00000030h] 0_2_00B209AD
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B209AD mov eax, dword ptr fs:[00000030h] 0_2_00B209AD
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B529F9 mov eax, dword ptr fs:[00000030h] 0_2_00B529F9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B529F9 mov eax, dword ptr fs:[00000030h] 0_2_00B529F9
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAE9E0 mov eax, dword ptr fs:[00000030h] 0_2_00BAE9E0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A9D0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A9D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A9D0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A9D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A9D0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A9D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A9D0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A9D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A9D0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A9D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2A9D0 mov eax, dword ptr fs:[00000030h] 0_2_00B2A9D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B549D0 mov eax, dword ptr fs:[00000030h] 0_2_00B549D0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BEA9D3 mov eax, dword ptr fs:[00000030h] 0_2_00BEA9D3
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB69C0 mov eax, dword ptr fs:[00000030h] 0_2_00BB69C0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA892A mov eax, dword ptr fs:[00000030h] 0_2_00BA892A
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BB892B mov eax, dword ptr fs:[00000030h] 0_2_00BB892B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAC912 mov eax, dword ptr fs:[00000030h] 0_2_00BAC912
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B18918 mov eax, dword ptr fs:[00000030h] 0_2_00B18918
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B18918 mov eax, dword ptr fs:[00000030h] 0_2_00B18918
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E908 mov eax, dword ptr fs:[00000030h] 0_2_00B9E908
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9E908 mov eax, dword ptr fs:[00000030h] 0_2_00B9E908
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC4978 mov eax, dword ptr fs:[00000030h] 0_2_00BC4978
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BC4978 mov eax, dword ptr fs:[00000030h] 0_2_00BC4978
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BAC97C mov eax, dword ptr fs:[00000030h] 0_2_00BAC97C
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B46962 mov eax, dword ptr fs:[00000030h] 0_2_00B46962
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B46962 mov eax, dword ptr fs:[00000030h] 0_2_00B46962
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B46962 mov eax, dword ptr fs:[00000030h] 0_2_00B46962
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B6096E mov eax, dword ptr fs:[00000030h] 0_2_00B6096E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B6096E mov edx, dword ptr fs:[00000030h] 0_2_00B6096E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B6096E mov eax, dword ptr fs:[00000030h] 0_2_00B6096E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BA0946 mov eax, dword ptr fs:[00000030h] 0_2_00BA0946
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4940 mov eax, dword ptr fs:[00000030h] 0_2_00BF4940
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28AA0 mov eax, dword ptr fs:[00000030h] 0_2_00B28AA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28AA0 mov eax, dword ptr fs:[00000030h] 0_2_00B28AA0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B76AA4 mov eax, dword ptr fs:[00000030h] 0_2_00B76AA4
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B58A90 mov edx, dword ptr fs:[00000030h] 0_2_00B58A90
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B2EA80 mov eax, dword ptr fs:[00000030h] 0_2_00B2EA80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4A80 mov eax, dword ptr fs:[00000030h] 0_2_00BF4A80
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5AAEE mov eax, dword ptr fs:[00000030h] 0_2_00B5AAEE
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5AAEE mov eax, dword ptr fs:[00000030h] 0_2_00B5AAEE
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20AD0 mov eax, dword ptr fs:[00000030h] 0_2_00B20AD0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B54AD0 mov eax, dword ptr fs:[00000030h] 0_2_00B54AD0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B54AD0 mov eax, dword ptr fs:[00000030h] 0_2_00B54AD0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B76ACC mov eax, dword ptr fs:[00000030h] 0_2_00B76ACC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B76ACC mov eax, dword ptr fs:[00000030h] 0_2_00B76ACC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B76ACC mov eax, dword ptr fs:[00000030h] 0_2_00B76ACC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B44A35 mov eax, dword ptr fs:[00000030h] 0_2_00B44A35
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B44A35 mov eax, dword ptr fs:[00000030h] 0_2_00B44A35
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5CA38 mov eax, dword ptr fs:[00000030h] 0_2_00B5CA38
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5CA24 mov eax, dword ptr fs:[00000030h] 0_2_00B5CA24
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4EA2E mov eax, dword ptr fs:[00000030h] 0_2_00B4EA2E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BACA11 mov eax, dword ptr fs:[00000030h] 0_2_00BACA11
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9CA72 mov eax, dword ptr fs:[00000030h] 0_2_00B9CA72
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9CA72 mov eax, dword ptr fs:[00000030h] 0_2_00B9CA72
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5CA6F mov eax, dword ptr fs:[00000030h] 0_2_00B5CA6F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5CA6F mov eax, dword ptr fs:[00000030h] 0_2_00B5CA6F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B5CA6F mov eax, dword ptr fs:[00000030h] 0_2_00B5CA6F
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCEA60 mov eax, dword ptr fs:[00000030h] 0_2_00BCEA60
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26A50 mov eax, dword ptr fs:[00000030h] 0_2_00B26A50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26A50 mov eax, dword ptr fs:[00000030h] 0_2_00B26A50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26A50 mov eax, dword ptr fs:[00000030h] 0_2_00B26A50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26A50 mov eax, dword ptr fs:[00000030h] 0_2_00B26A50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26A50 mov eax, dword ptr fs:[00000030h] 0_2_00B26A50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26A50 mov eax, dword ptr fs:[00000030h] 0_2_00B26A50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B26A50 mov eax, dword ptr fs:[00000030h] 0_2_00B26A50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30A5B mov eax, dword ptr fs:[00000030h] 0_2_00B30A5B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30A5B mov eax, dword ptr fs:[00000030h] 0_2_00B30A5B
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30BBE mov eax, dword ptr fs:[00000030h] 0_2_00B30BBE
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B30BBE mov eax, dword ptr fs:[00000030h] 0_2_00B30BBE
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD4BB0 mov eax, dword ptr fs:[00000030h] 0_2_00BD4BB0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BD4BB0 mov eax, dword ptr fs:[00000030h] 0_2_00BD4BB0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28BF0 mov eax, dword ptr fs:[00000030h] 0_2_00B28BF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28BF0 mov eax, dword ptr fs:[00000030h] 0_2_00B28BF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B28BF0 mov eax, dword ptr fs:[00000030h] 0_2_00B28BF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4EBFC mov eax, dword ptr fs:[00000030h] 0_2_00B4EBFC
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BACBF0 mov eax, dword ptr fs:[00000030h] 0_2_00BACBF0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BCEBD0 mov eax, dword ptr fs:[00000030h] 0_2_00BCEBD0
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B40BCB mov eax, dword ptr fs:[00000030h] 0_2_00B40BCB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B40BCB mov eax, dword ptr fs:[00000030h] 0_2_00B40BCB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B40BCB mov eax, dword ptr fs:[00000030h] 0_2_00B40BCB
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20BCD mov eax, dword ptr fs:[00000030h] 0_2_00B20BCD
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20BCD mov eax, dword ptr fs:[00000030h] 0_2_00B20BCD
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B20BCD mov eax, dword ptr fs:[00000030h] 0_2_00B20BCD
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4EB20 mov eax, dword ptr fs:[00000030h] 0_2_00B4EB20
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B4EB20 mov eax, dword ptr fs:[00000030h] 0_2_00B4EB20
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE8B28 mov eax, dword ptr fs:[00000030h] 0_2_00BE8B28
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BE8B28 mov eax, dword ptr fs:[00000030h] 0_2_00BE8B28
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B9EB1D mov eax, dword ptr fs:[00000030h] 0_2_00B9EB1D
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF4B00 mov eax, dword ptr fs:[00000030h] 0_2_00BF4B00
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B1CB7E mov eax, dword ptr fs:[00000030h] 0_2_00B1CB7E
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00B18B50 mov eax, dword ptr fs:[00000030h] 0_2_00B18B50
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF2B57 mov eax, dword ptr fs:[00000030h] 0_2_00BF2B57
Source: C:\Users\user\Desktop\5ZLQrKA4ge.exe Code function: 0_2_00BF2B57 mov eax, dword ptr fs:[00000030h] 0_2_00BF2B57
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.5ZLQrKA4ge.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2786935120.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2787009901.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 0.2.5ZLQrKA4ge.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2786935120.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2787009901.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1530782 Sample: 5ZLQrKA4ge.exe Startdate: 10/10/2024 Architecture: WINDOWS Score: 80 7 Malicious sample detected (through community Yara rule) 2->7 9 Antivirus / Scanner detection for submitted sample 2->9 11 Multi AV Scanner detection for submitted file 2->11 13 3 other signatures 2->13 5 5ZLQrKA4ge.exe 2->5         started        process3
⊘No contacted IP infos