Analysis Report MT103---USD42880.45---20201127--dbs--9900.exe

Overview

General Information

Sample Name: MT103---USD42880.45---20201127--dbs--9900.exe
Analysis ID: 323965
MD5: d7545487bde794de42b3a655f3664c8d
SHA1: f4728d4c214b0282efc7d0779cd673d4b68e7da0
SHA256: 4d39dfd975de3e9aca4e430390618b2e548db3f3d4bf2d0409f643be7da2a91e
Tags: exe

Most interesting Screenshot:

Detection

FormBook
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to detect virtual machines (SMSW)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: MT103---USD42880.45---20201127--dbs--9900.exe Virustotal: Detection: 37% Perma Link
Source: MT103---USD42880.45---20201127--dbs--9900.exe ReversingLabs: Detection: 47%
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: MT103---USD42880.45---20201127--dbs--9900.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4c50000.8.unpack Avira: Label: TR/Hijacker.Gen
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 4x nop then mov eax, dword ptr [00460BCCh] 0_3_02C7896C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 4x nop then mov eax, ecx 0_3_02C78C98
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 4x nop then pop ebx 1_2_00407AFB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 4x nop then pop edi 1_2_0040E43D

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.137.232 162.159.137.232
Source: Joe Sandbox View IP Address: 162.159.129.233 162.159.129.233
Source: unknown DNS traffic detected: queries for: discord.com
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.disc8
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discorda
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attac
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachmen
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/78183
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/781839169$
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/7818391691222
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/78183916912220570
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/781839169122205709/781839
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/781839169122205709/78183922049902
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/781839169122205709/781839220499021834/Yipmyyy
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/781839169122205709/781839220499021834x
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/781839169122205709/7818392204d
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/7H
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://discord.com/
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213462989.0000000002E50000.00000004.00000001.sdmp String found in binary or memory: https://discord.com/V
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419D60 NtCreateFile, 1_2_00419D60
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419E10 NtReadFile, 1_2_00419E10
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419E90 NtClose, 1_2_00419E90
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419F40 NtAllocateVirtualMemory, 1_2_00419F40
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419D5B NtCreateFile, 1_2_00419D5B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419E0A NtReadFile, 1_2_00419E0A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419E8B NtClose, 1_2_00419E8B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419EBA NtClose, 1_2_00419EBA
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00419F3A NtAllocateVirtualMemory, 1_2_00419F3A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B396E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_00B396E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_00B39660
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_00B39860
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B3B040 NtSuspendThread, 1_2_00B3B040
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B3A3B0 NtGetContextThread, 1_2_00B3A3B0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B395F0 NtQueryInformationFile, 1_2_00B395F0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B395D0 NtClose, 1_2_00B395D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39520 NtWaitForSingleObject, 1_2_00B39520
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39560 NtWriteFile, 1_2_00B39560
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39540 NtReadFile, 1_2_00B39540
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B396D0 NtCreateKey, 1_2_00B396D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39610 NtEnumerateValueKey, 1_2_00B39610
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39670 NtQueryInformationProcess, 1_2_00B39670
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39650 NtQueryValueKey, 1_2_00B39650
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B397A0 NtUnmapViewOfSection, 1_2_00B397A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39780 NtMapViewOfSection, 1_2_00B39780
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39730 NtQueryVirtualMemory, 1_2_00B39730
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39710 NtQueryInformationToken, 1_2_00B39710
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B3A710 NtOpenProcessToken, 1_2_00B3A710
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B3A770 NtOpenThread, 1_2_00B3A770
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39770 NtSetInformationFile, 1_2_00B39770
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39760 NtOpenProcess, 1_2_00B39760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B398A0 NtWriteVirtualMemory, 1_2_00B398A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B398F0 NtReadVirtualMemory, 1_2_00B398F0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39820 NtEnumerateKey, 1_2_00B39820
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39840 NtDelayExecution, 1_2_00B39840
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B399A0 NtCreateSection, 1_2_00B399A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B399D0 NtCreateProcessEx, 1_2_00B399D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39910 NtAdjustPrivilegesToken, 1_2_00B39910
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39950 NtQueueApcThread, 1_2_00B39950
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39A80 NtOpenDirectoryObject, 1_2_00B39A80
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39A20 NtResumeThread, 1_2_00B39A20
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39A10 NtQuerySection, 1_2_00B39A10
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39A00 NtProtectVirtualMemory, 1_2_00B39A00
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39A50 NtCreateFile, 1_2_00B39A50
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39B00 NtSetValueKey, 1_2_00B39B00
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B3AD30 NtSetContextThread, 1_2_00B3AD30
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B39FE0 NtCreateMutant, 1_2_00B39FE0
Detected potential crypto function
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_02314000 0_3_02314000
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_023144FE 0_3_023144FE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_02C6A4F4 0_3_02C6A4F4
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_0041E972 1_2_0041E972
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_0041D376 1_2_0041D376
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00402D89 1_2_00402D89
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00409E40 1_2_00409E40
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00409E3B 1_2_00409E3B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_0041CFA3 1_2_0041CFA3
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B220A0 1_2_00B220A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC20A8 1_2_00BC20A8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B090 1_2_00B0B090
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB60F5 1_2_00BB60F5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2701D 1_2_00B2701D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB1002 1_2_00BB1002
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0C1C0 1_2_00B0C1C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14120 1_2_00B14120
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC22AE 1_2_00BC22AE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC32A9 1_2_00BC32A9
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBE2C5 1_2_00BBE2C5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B236 1_2_00B1B236
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AD225E 1_2_00AD225E
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AD3382 1_2_00AD3382
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2138B 1_2_00B2138B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BA23E3 1_2_00BA23E3
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB03DA 1_2_00BB03DA
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB231B 1_2_00BB231B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AD337D 1_2_00AD337D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B13360 1_2_00B13360
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AD94B8 1_2_00AD94B8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B12430 1_2_00B12430
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0841F 1_2_00B0841F
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBD466 1_2_00BBD466
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B265A0 1_2_00B265A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B22581 1_2_00B22581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0D5E0 1_2_00B0D5E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC25DD 1_2_00BC25DD
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBD616 1_2_00BBD616
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9660 1_2_00AF9660
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB67E2 1_2_00BB67E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC28EC 1_2_00BC28EC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A830 1_2_00B1A830
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BCE824 1_2_00BCE824
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF6800 1_2_00AF6800
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B199BF 1_2_00B199BF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B12990 1_2_00B12990
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B01915 1_2_00B01915
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFF900 1_2_00AFF900
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4AEF 1_2_00BB4AEF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BAFA2B 1_2_00BAFA2B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB5A4F 1_2_00BB5A4F
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2EBB0 1_2_00B2EBB0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1EB9A 1_2_00B1EB9A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B9EB8A 1_2_00B9EB8A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B48BE8 1_2_00B48BE8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBDBD2 1_2_00BBDBD2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2ABD8 1_2_00B2ABD8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC2B28 1_2_00BC2B28
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1AB40 1_2_00B1AB40
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B9CB4F 1_2_00B9CB4F
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B04CEC 1_2_00B04CEC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B24CD4 1_2_00B24CD4
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBCC77 1_2_00BBCC77
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB2D82 1_2_00BB2D82
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF0D20 1_2_00AF0D20
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC2D07 1_2_00BC2D07
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B12D50 1_2_00B12D50
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC1D55 1_2_00BC1D55
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BA1EB6 1_2_00BA1EB6
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC2EF7 1_2_00BC2EF7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B16E30 1_2_00B16E30
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B7AE60 1_2_00B7AE60
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC1FF1 1_2_00BC1FF1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BCDFCE 1_2_00BCDFCE
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: String function: 00B4D08C appears 55 times
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: String function: 00B85720 appears 85 times
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: String function: 00AFB150 appears 177 times
PE file contains strange resources
Source: MT103---USD42880.45---20201127--dbs--9900.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: MT103---USD42880.45---20201127--dbs--9900.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213987933.0000000004BE0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemswsock.dll.muij% vs MT103---USD42880.45---20201127--dbs--9900.exe
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.212592770.0000000002500000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs MT103---USD42880.45---20201127--dbs--9900.exe
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213608327.0000000002F60000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs MT103---USD42880.45---20201127--dbs--9900.exe
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.214005915.0000000004C10000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamenlsbres.dllj% vs MT103---USD42880.45---20201127--dbs--9900.exe
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.213601876.0000000002F50000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamecomctl32.DLL.MUIj% vs MT103---USD42880.45---20201127--dbs--9900.exe
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000000.00000002.214013653.0000000004C20000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs MT103---USD42880.45---20201127--dbs--9900.exe
Source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000001.00000002.213736069.0000000000BEF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs MT103---USD42880.45---20201127--dbs--9900.exe
Yara signature match
Source: 00000000.00000002.214074450.0000000004C67000.00000020.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000000.00000002.214074450.0000000004C67000.00000020.00000001.sdmp, type: MEMORY Matched rule: Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/ItsReallyNick/status/1176229087196696577, score = 27.09.2019
Source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal84.troj.evad.winEXE@3/0@2/2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: MT103---USD42880.45---20201127--dbs--9900.exe Virustotal: Detection: 37%
Source: MT103---USD42880.45---20201127--dbs--9900.exe ReversingLabs: Detection: 47%
Source: unknown Process created: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe 'C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe'
Source: unknown Process created: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Process created: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Jump to behavior
Source: MT103---USD42880.45---20201127--dbs--9900.exe Static file information: File size 1289728 > 1048576
Source: Binary string: wntdll.pdbUGP source: MT103---USD42880.45---20201127--dbs--9900.exe, 00000001.00000002.213524549.0000000000AD0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: MT103---USD42880.45---20201127--dbs--9900.exe

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Unpacked PE file: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239B338 push esi; retf 0_3_0239B33C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239943F push edi; ret 0_3_0239944C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C137 push esi; retf 0_3_0239C146
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239D536 push esi; retf 0_3_0239D537
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_02399C23 push ebx; ret 0_3_02399C39
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C724 push esi; retf 0_3_0239C819
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239D61B push esi; retf 0_3_0239D621
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C81F push esi; retf 0_3_0239C822
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_02399E14 push ebx; ret 0_3_02399E16
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239D207 push esi; retf 0_3_0239D211
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239D607 push esi; retf 0_3_0239D615
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239B178 push esi; retf 0_3_0239B1A8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239997C push ebx; ret 0_3_02399987
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239926C push esi; retf 0_3_02399272
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_02399A6C push esi; retf 0_3_02399A70
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239D153 push esi; retf 0_3_0239D201
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239D24E push esi; retf 0_3_0239D24F
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239A7B0 push esi; retf 0_3_0239A7D8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239B0B3 push esi; retf 0_3_0239B16C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C1A9 push esi; retf 0_3_0239C1EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239949D push ebx; ret 0_3_0239949F
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C49C push esi; retf 0_3_0239C4BC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239A392 push edi; iretd 0_3_0239A393
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239B287 push esi; retf 0_3_0239B288
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C2FC push esi; retf 0_3_0239C393
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_02399EE9 push ebx; ret 0_3_02399EEB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C4EF push esi; retf 0_3_0239C4F1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239B5E4 push esi; retf 0_3_0239B5E5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C5D6 push esi; retf 0_3_0239C5FE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_0239C3C2 push esi; retf 0_3_0239C3CF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 0_3_02C62ADC push ecx; mov dword ptr [esp], edx 0_3_02C62AE0

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00409A90 rdtsc 1_2_00409A90
Contains functionality to detect virtual machines (SMSW)
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_004163C0 smsw ebx 1_2_004163C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00409A90 rdtsc 1_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B396E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_00B396E0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2F0BF mov ecx, dword ptr fs:[00000030h] 1_2_00B2F0BF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2F0BF mov eax, dword ptr fs:[00000030h] 1_2_00B2F0BF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2F0BF mov eax, dword ptr fs:[00000030h] 1_2_00B2F0BF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B220A0 mov eax, dword ptr fs:[00000030h] 1_2_00B220A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B220A0 mov eax, dword ptr fs:[00000030h] 1_2_00B220A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B220A0 mov eax, dword ptr fs:[00000030h] 1_2_00B220A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B220A0 mov eax, dword ptr fs:[00000030h] 1_2_00B220A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B220A0 mov eax, dword ptr fs:[00000030h] 1_2_00B220A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B220A0 mov eax, dword ptr fs:[00000030h] 1_2_00B220A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B390AF mov eax, dword ptr fs:[00000030h] 1_2_00B390AF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9080 mov eax, dword ptr fs:[00000030h] 1_2_00AF9080
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB080 mov eax, dword ptr fs:[00000030h] 1_2_00AFB080
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF40E1 mov eax, dword ptr fs:[00000030h] 1_2_00AF40E1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF40E1 mov eax, dword ptr fs:[00000030h] 1_2_00AF40E1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF40E1 mov eax, dword ptr fs:[00000030h] 1_2_00AF40E1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB60F5 mov eax, dword ptr fs:[00000030h] 1_2_00BB60F5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB60F5 mov eax, dword ptr fs:[00000030h] 1_2_00BB60F5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB60F5 mov eax, dword ptr fs:[00000030h] 1_2_00BB60F5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB60F5 mov eax, dword ptr fs:[00000030h] 1_2_00BB60F5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF70C0 mov eax, dword ptr fs:[00000030h] 1_2_00AF70C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF70C0 mov eax, dword ptr fs:[00000030h] 1_2_00AF70C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB0C7 mov eax, dword ptr fs:[00000030h] 1_2_00BBB0C7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB0C7 mov eax, dword ptr fs:[00000030h] 1_2_00BBB0C7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B24020 mov edi, dword ptr fs:[00000030h] 1_2_00B24020
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B02A mov eax, dword ptr fs:[00000030h] 1_2_00B0B02A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B02A mov eax, dword ptr fs:[00000030h] 1_2_00B0B02A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B02A mov eax, dword ptr fs:[00000030h] 1_2_00B0B02A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B02A mov eax, dword ptr fs:[00000030h] 1_2_00B0B02A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2002D mov eax, dword ptr fs:[00000030h] 1_2_00B2002D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2002D mov eax, dword ptr fs:[00000030h] 1_2_00B2002D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2002D mov eax, dword ptr fs:[00000030h] 1_2_00B2002D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2002D mov eax, dword ptr fs:[00000030h] 1_2_00B2002D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2002D mov eax, dword ptr fs:[00000030h] 1_2_00B2002D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B77016 mov eax, dword ptr fs:[00000030h] 1_2_00B77016
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B77016 mov eax, dword ptr fs:[00000030h] 1_2_00B77016
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B77016 mov eax, dword ptr fs:[00000030h] 1_2_00B77016
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B83019 mov eax, dword ptr fs:[00000030h] 1_2_00B83019
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC4015 mov eax, dword ptr fs:[00000030h] 1_2_00BC4015
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC4015 mov eax, dword ptr fs:[00000030h] 1_2_00BC4015
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2701D mov eax, dword ptr fs:[00000030h] 1_2_00B2701D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2701D mov eax, dword ptr fs:[00000030h] 1_2_00B2701D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2701D mov eax, dword ptr fs:[00000030h] 1_2_00B2701D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2701D mov eax, dword ptr fs:[00000030h] 1_2_00B2701D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2701D mov eax, dword ptr fs:[00000030h] 1_2_00B2701D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2701D mov eax, dword ptr fs:[00000030h] 1_2_00B2701D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB2073 mov eax, dword ptr fs:[00000030h] 1_2_00BB2073
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC1074 mov eax, dword ptr fs:[00000030h] 1_2_00BC1074
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B10050 mov eax, dword ptr fs:[00000030h] 1_2_00B10050
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B10050 mov eax, dword ptr fs:[00000030h] 1_2_00B10050
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF7057 mov eax, dword ptr fs:[00000030h] 1_2_00AF7057
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF5050 mov eax, dword ptr fs:[00000030h] 1_2_00AF5050
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF5050 mov eax, dword ptr fs:[00000030h] 1_2_00AF5050
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF5050 mov eax, dword ptr fs:[00000030h] 1_2_00AF5050
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B751BE mov eax, dword ptr fs:[00000030h] 1_2_00B751BE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B751BE mov eax, dword ptr fs:[00000030h] 1_2_00B751BE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B751BE mov eax, dword ptr fs:[00000030h] 1_2_00B751BE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B751BE mov eax, dword ptr fs:[00000030h] 1_2_00B751BE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BCF1B5 mov eax, dword ptr fs:[00000030h] 1_2_00BCF1B5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BCF1B5 mov eax, dword ptr fs:[00000030h] 1_2_00BCF1B5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B261A0 mov eax, dword ptr fs:[00000030h] 1_2_00B261A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B261A0 mov eax, dword ptr fs:[00000030h] 1_2_00B261A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B061A7 mov eax, dword ptr fs:[00000030h] 1_2_00B061A7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B061A7 mov eax, dword ptr fs:[00000030h] 1_2_00B061A7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B061A7 mov eax, dword ptr fs:[00000030h] 1_2_00B061A7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B061A7 mov eax, dword ptr fs:[00000030h] 1_2_00B061A7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B24190 mov eax, dword ptr fs:[00000030h] 1_2_00B24190
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF519E mov eax, dword ptr fs:[00000030h] 1_2_00AF519E
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF519E mov ecx, dword ptr fs:[00000030h] 1_2_00AF519E
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBA189 mov eax, dword ptr fs:[00000030h] 1_2_00BBA189
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBA189 mov ecx, dword ptr fs:[00000030h] 1_2_00BBA189
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1C182 mov eax, dword ptr fs:[00000030h] 1_2_00B1C182
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2A185 mov eax, dword ptr fs:[00000030h] 1_2_00B2A185
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8190 mov ecx, dword ptr fs:[00000030h] 1_2_00AF8190
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8D1F9 mov eax, dword ptr fs:[00000030h] 1_2_00B8D1F9
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB1E1 mov eax, dword ptr fs:[00000030h] 1_2_00AFB1E1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB1E1 mov eax, dword ptr fs:[00000030h] 1_2_00AFB1E1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB1E1 mov eax, dword ptr fs:[00000030h] 1_2_00AFB1E1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF31E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF31E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B841E8 mov eax, dword ptr fs:[00000030h] 1_2_00B841E8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1D1EF mov eax, dword ptr fs:[00000030h] 1_2_00B1D1EF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov ecx, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov ecx, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB31DC mov eax, dword ptr fs:[00000030h] 1_2_00BB31DC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0C1C0 mov eax, dword ptr fs:[00000030h] 1_2_00B0C1C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2513A mov eax, dword ptr fs:[00000030h] 1_2_00B2513A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2513A mov eax, dword ptr fs:[00000030h] 1_2_00B2513A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14120 mov eax, dword ptr fs:[00000030h] 1_2_00B14120
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14120 mov eax, dword ptr fs:[00000030h] 1_2_00B14120
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14120 mov eax, dword ptr fs:[00000030h] 1_2_00B14120
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14120 mov eax, dword ptr fs:[00000030h] 1_2_00B14120
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14120 mov ecx, dword ptr fs:[00000030h] 1_2_00B14120
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF3138 mov ecx, dword ptr fs:[00000030h] 1_2_00AF3138
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9100 mov eax, dword ptr fs:[00000030h] 1_2_00AF9100
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9100 mov eax, dword ptr fs:[00000030h] 1_2_00AF9100
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9100 mov eax, dword ptr fs:[00000030h] 1_2_00AF9100
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B00100 mov eax, dword ptr fs:[00000030h] 1_2_00B00100
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B00100 mov eax, dword ptr fs:[00000030h] 1_2_00B00100
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B00100 mov eax, dword ptr fs:[00000030h] 1_2_00B00100
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB171 mov eax, dword ptr fs:[00000030h] 1_2_00AFB171
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB171 mov eax, dword ptr fs:[00000030h] 1_2_00AFB171
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AF52A5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AF52A5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AF52A5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AF52A5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF52A5 mov eax, dword ptr fs:[00000030h] 1_2_00AF52A5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B212BD mov esi, dword ptr fs:[00000030h] 1_2_00B212BD
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B212BD mov eax, dword ptr fs:[00000030h] 1_2_00B212BD
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B212BD mov eax, dword ptr fs:[00000030h] 1_2_00B212BD
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B062A0 mov eax, dword ptr fs:[00000030h] 1_2_00B062A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B062A0 mov eax, dword ptr fs:[00000030h] 1_2_00B062A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B062A0 mov eax, dword ptr fs:[00000030h] 1_2_00B062A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B062A0 mov eax, dword ptr fs:[00000030h] 1_2_00B062A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB129A mov eax, dword ptr fs:[00000030h] 1_2_00BB129A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2D294 mov eax, dword ptr fs:[00000030h] 1_2_00B2D294
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2D294 mov eax, dword ptr fs:[00000030h] 1_2_00B2D294
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB2E8 mov eax, dword ptr fs:[00000030h] 1_2_00BBB2E8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB2E8 mov eax, dword ptr fs:[00000030h] 1_2_00BBB2E8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB2E8 mov eax, dword ptr fs:[00000030h] 1_2_00BBB2E8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB2E8 mov eax, dword ptr fs:[00000030h] 1_2_00BBB2E8
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF12D4 mov eax, dword ptr fs:[00000030h] 1_2_00AF12D4
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B236 mov eax, dword ptr fs:[00000030h] 1_2_00B1B236
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B236 mov eax, dword ptr fs:[00000030h] 1_2_00B1B236
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B236 mov eax, dword ptr fs:[00000030h] 1_2_00B1B236
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B236 mov eax, dword ptr fs:[00000030h] 1_2_00B1B236
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B236 mov eax, dword ptr fs:[00000030h] 1_2_00B1B236
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B236 mov eax, dword ptr fs:[00000030h] 1_2_00B1B236
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB1229 mov eax, dword ptr fs:[00000030h] 1_2_00BB1229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8239 mov eax, dword ptr fs:[00000030h] 1_2_00AF8239
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8239 mov eax, dword ptr fs:[00000030h] 1_2_00AF8239
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8239 mov eax, dword ptr fs:[00000030h] 1_2_00AF8239
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A229 mov eax, dword ptr fs:[00000030h] 1_2_00B1A229
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB233 mov eax, dword ptr fs:[00000030h] 1_2_00AFB233
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB233 mov eax, dword ptr fs:[00000030h] 1_2_00AFB233
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF5210 mov eax, dword ptr fs:[00000030h] 1_2_00AF5210
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF5210 mov ecx, dword ptr fs:[00000030h] 1_2_00AF5210
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF5210 mov eax, dword ptr fs:[00000030h] 1_2_00AF5210
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF5210 mov eax, dword ptr fs:[00000030h] 1_2_00AF5210
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B3927A mov eax, dword ptr fs:[00000030h] 1_2_00B3927A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BAB260 mov eax, dword ptr fs:[00000030h] 1_2_00BAB260
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BAB260 mov eax, dword ptr fs:[00000030h] 1_2_00BAB260
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B84257 mov eax, dword ptr fs:[00000030h] 1_2_00B84257
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9240 mov eax, dword ptr fs:[00000030h] 1_2_00AF9240
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9240 mov eax, dword ptr fs:[00000030h] 1_2_00AF9240
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9240 mov eax, dword ptr fs:[00000030h] 1_2_00AF9240
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9240 mov eax, dword ptr fs:[00000030h] 1_2_00AF9240
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2B390 mov eax, dword ptr fs:[00000030h] 1_2_00B2B390
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B22397 mov eax, dword ptr fs:[00000030h] 1_2_00B22397
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB138A mov eax, dword ptr fs:[00000030h] 1_2_00BB138A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2138B mov eax, dword ptr fs:[00000030h] 1_2_00B2138B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2138B mov eax, dword ptr fs:[00000030h] 1_2_00B2138B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2138B mov eax, dword ptr fs:[00000030h] 1_2_00B2138B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BAD380 mov ecx, dword ptr fs:[00000030h] 1_2_00BAD380
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B203E2 mov eax, dword ptr fs:[00000030h] 1_2_00B203E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B203E2 mov eax, dword ptr fs:[00000030h] 1_2_00B203E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B203E2 mov eax, dword ptr fs:[00000030h] 1_2_00B203E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B203E2 mov eax, dword ptr fs:[00000030h] 1_2_00B203E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B203E2 mov eax, dword ptr fs:[00000030h] 1_2_00B203E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B203E2 mov eax, dword ptr fs:[00000030h] 1_2_00B203E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BA23E3 mov ecx, dword ptr fs:[00000030h] 1_2_00BA23E3
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BA23E3 mov ecx, dword ptr fs:[00000030h] 1_2_00BA23E3
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BA23E3 mov eax, dword ptr fs:[00000030h] 1_2_00BA23E3
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B253C5 mov eax, dword ptr fs:[00000030h] 1_2_00B253C5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B753CA mov eax, dword ptr fs:[00000030h] 1_2_00B753CA
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B753CA mov eax, dword ptr fs:[00000030h] 1_2_00B753CA
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB131B mov eax, dword ptr fs:[00000030h] 1_2_00BB131B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A309 mov eax, dword ptr fs:[00000030h] 1_2_00B1A309
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0F370 mov eax, dword ptr fs:[00000030h] 1_2_00B0F370
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0F370 mov eax, dword ptr fs:[00000030h] 1_2_00B0F370
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0F370 mov eax, dword ptr fs:[00000030h] 1_2_00B0F370
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B86365 mov eax, dword ptr fs:[00000030h] 1_2_00B86365
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B86365 mov eax, dword ptr fs:[00000030h] 1_2_00B86365
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B86365 mov eax, dword ptr fs:[00000030h] 1_2_00B86365
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFF358 mov eax, dword ptr fs:[00000030h] 1_2_00AFF358
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B034B1 mov eax, dword ptr fs:[00000030h] 1_2_00B034B1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B034B1 mov eax, dword ptr fs:[00000030h] 1_2_00B034B1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2D4B0 mov eax, dword ptr fs:[00000030h] 1_2_00B2D4B0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B864B5 mov eax, dword ptr fs:[00000030h] 1_2_00B864B5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B864B5 mov eax, dword ptr fs:[00000030h] 1_2_00B864B5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B834A0 mov eax, dword ptr fs:[00000030h] 1_2_00B834A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B834A0 mov eax, dword ptr fs:[00000030h] 1_2_00B834A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B834A0 mov eax, dword ptr fs:[00000030h] 1_2_00B834A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B014A9 mov eax, dword ptr fs:[00000030h] 1_2_00B014A9
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B014A9 mov ecx, dword ptr fs:[00000030h] 1_2_00B014A9
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0849B mov eax, dword ptr fs:[00000030h] 1_2_00B0849B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB4496 mov eax, dword ptr fs:[00000030h] 1_2_00BB4496
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF1480 mov eax, dword ptr fs:[00000030h] 1_2_00AF1480
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF649B mov eax, dword ptr fs:[00000030h] 1_2_00AF649B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF649B mov eax, dword ptr fs:[00000030h] 1_2_00AF649B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB14FB mov eax, dword ptr fs:[00000030h] 1_2_00BB14FB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B284E0 mov eax, dword ptr fs:[00000030h] 1_2_00B284E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B284E0 mov eax, dword ptr fs:[00000030h] 1_2_00B284E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B284E0 mov eax, dword ptr fs:[00000030h] 1_2_00B284E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B284E0 mov eax, dword ptr fs:[00000030h] 1_2_00B284E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B284E0 mov eax, dword ptr fs:[00000030h] 1_2_00B284E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B284E0 mov eax, dword ptr fs:[00000030h] 1_2_00B284E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B12430 mov eax, dword ptr fs:[00000030h] 1_2_00B12430
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B12430 mov eax, dword ptr fs:[00000030h] 1_2_00B12430
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B433 mov eax, dword ptr fs:[00000030h] 1_2_00B0B433
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B433 mov eax, dword ptr fs:[00000030h] 1_2_00B0B433
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B433 mov eax, dword ptr fs:[00000030h] 1_2_00B0B433
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF4439 mov eax, dword ptr fs:[00000030h] 1_2_00AF4439
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC740D mov eax, dword ptr fs:[00000030h] 1_2_00BC740D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC740D mov eax, dword ptr fs:[00000030h] 1_2_00BC740D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC740D mov eax, dword ptr fs:[00000030h] 1_2_00BC740D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8410 mov eax, dword ptr fs:[00000030h] 1_2_00AF8410
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B477 mov eax, dword ptr fs:[00000030h] 1_2_00B1B477
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8466 mov eax, dword ptr fs:[00000030h] 1_2_00AF8466
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8466 mov eax, dword ptr fs:[00000030h] 1_2_00AF8466
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1746D mov eax, dword ptr fs:[00000030h] 1_2_00B1746D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8C450 mov eax, dword ptr fs:[00000030h] 1_2_00B8C450
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8C450 mov eax, dword ptr fs:[00000030h] 1_2_00B8C450
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC8450 mov eax, dword ptr fs:[00000030h] 1_2_00BC8450
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2A44B mov eax, dword ptr fs:[00000030h] 1_2_00B2A44B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9450 mov eax, dword ptr fs:[00000030h] 1_2_00AF9450
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC05AC mov eax, dword ptr fs:[00000030h] 1_2_00BC05AC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC05AC mov eax, dword ptr fs:[00000030h] 1_2_00BC05AC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B265A0 mov eax, dword ptr fs:[00000030h] 1_2_00B265A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B265A0 mov eax, dword ptr fs:[00000030h] 1_2_00B265A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B265A0 mov eax, dword ptr fs:[00000030h] 1_2_00B265A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B235A1 mov eax, dword ptr fs:[00000030h] 1_2_00B235A1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B22581 mov eax, dword ptr fs:[00000030h] 1_2_00B22581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B22581 mov eax, dword ptr fs:[00000030h] 1_2_00B22581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B22581 mov eax, dword ptr fs:[00000030h] 1_2_00B22581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B22581 mov eax, dword ptr fs:[00000030h] 1_2_00B22581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB581 mov eax, dword ptr fs:[00000030h] 1_2_00BBB581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB581 mov eax, dword ptr fs:[00000030h] 1_2_00BBB581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB581 mov eax, dword ptr fs:[00000030h] 1_2_00BBB581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBB581 mov eax, dword ptr fs:[00000030h] 1_2_00BBB581
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF3591 mov eax, dword ptr fs:[00000030h] 1_2_00AF3591
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00B0D5E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00B0D5E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B295EC mov eax, dword ptr fs:[00000030h] 1_2_00B295EC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF95F0 mov eax, dword ptr fs:[00000030h] 1_2_00AF95F0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF95F0 mov ecx, dword ptr fs:[00000030h] 1_2_00AF95F0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF15C1 mov eax, dword ptr fs:[00000030h] 1_2_00AF15C1
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B7A537 mov eax, dword ptr fs:[00000030h] 1_2_00B7A537
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BBE539 mov eax, dword ptr fs:[00000030h] 1_2_00BBE539
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2F527 mov eax, dword ptr fs:[00000030h] 1_2_00B2F527
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2F527 mov eax, dword ptr fs:[00000030h] 1_2_00B2F527
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2F527 mov eax, dword ptr fs:[00000030h] 1_2_00B2F527
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB3518 mov eax, dword ptr fs:[00000030h] 1_2_00BB3518
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB3518 mov eax, dword ptr fs:[00000030h] 1_2_00BB3518
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB3518 mov eax, dword ptr fs:[00000030h] 1_2_00BB3518
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF751A mov eax, dword ptr fs:[00000030h] 1_2_00AF751A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF751A mov eax, dword ptr fs:[00000030h] 1_2_00AF751A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF751A mov eax, dword ptr fs:[00000030h] 1_2_00AF751A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF751A mov eax, dword ptr fs:[00000030h] 1_2_00AF751A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF9515 mov ecx, dword ptr fs:[00000030h] 1_2_00AF9515
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1C577 mov eax, dword ptr fs:[00000030h] 1_2_00B1C577
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1C577 mov eax, dword ptr fs:[00000030h] 1_2_00B1C577
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF354C mov eax, dword ptr fs:[00000030h] 1_2_00AF354C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF354C mov eax, dword ptr fs:[00000030h] 1_2_00AF354C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB540 mov eax, dword ptr fs:[00000030h] 1_2_00AFB540
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFB540 mov eax, dword ptr fs:[00000030h] 1_2_00AFB540
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B73540 mov eax, dword ptr fs:[00000030h] 1_2_00B73540
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB56B6 mov eax, dword ptr fs:[00000030h] 1_2_00BB56B6
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB56B6 mov eax, dword ptr fs:[00000030h] 1_2_00BB56B6
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF86A0 mov eax, dword ptr fs:[00000030h] 1_2_00AF86A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B746A7 mov eax, dword ptr fs:[00000030h] 1_2_00B746A7
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B216E0 mov ecx, dword ptr fs:[00000030h] 1_2_00B216E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B076E2 mov eax, dword ptr fs:[00000030h] 1_2_00B076E2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov ecx, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B206C0 mov eax, dword ptr fs:[00000030h] 1_2_00B206C0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B236CC mov eax, dword ptr fs:[00000030h] 1_2_00B236CC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFE620 mov eax, dword ptr fs:[00000030h] 1_2_00AFE620
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2C63D mov eax, dword ptr fs:[00000030h] 1_2_00B2C63D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B27620 mov eax, dword ptr fs:[00000030h] 1_2_00B27620
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B27620 mov eax, dword ptr fs:[00000030h] 1_2_00B27620
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B27620 mov eax, dword ptr fs:[00000030h] 1_2_00B27620
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B27620 mov eax, dword ptr fs:[00000030h] 1_2_00B27620
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B27620 mov eax, dword ptr fs:[00000030h] 1_2_00B27620
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B27620 mov eax, dword ptr fs:[00000030h] 1_2_00B27620
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFA63B mov eax, dword ptr fs:[00000030h] 1_2_00AFA63B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFA63B mov eax, dword ptr fs:[00000030h] 1_2_00AFA63B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B75623 mov eax, dword ptr fs:[00000030h] 1_2_00B75623
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B62E mov eax, dword ptr fs:[00000030h] 1_2_00B0B62E
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0B62E mov eax, dword ptr fs:[00000030h] 1_2_00B0B62E
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0161A mov eax, dword ptr fs:[00000030h] 1_2_00B0161A
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2A61C mov eax, dword ptr fs:[00000030h] 1_2_00B2A61C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2A61C mov eax, dword ptr fs:[00000030h] 1_2_00B2A61C
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFC600 mov eax, dword ptr fs:[00000030h] 1_2_00AFC600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFC600 mov eax, dword ptr fs:[00000030h] 1_2_00AFC600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFC600 mov eax, dword ptr fs:[00000030h] 1_2_00AFC600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov ecx, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov ecx, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov ecx, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov ecx, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B15600 mov eax, dword ptr fs:[00000030h] 1_2_00B15600
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB1608 mov eax, dword ptr fs:[00000030h] 1_2_00BB1608
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF1618 mov eax, dword ptr fs:[00000030h] 1_2_00AF1618
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14670 mov eax, dword ptr fs:[00000030h] 1_2_00B14670
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14670 mov eax, dword ptr fs:[00000030h] 1_2_00B14670
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14670 mov eax, dword ptr fs:[00000030h] 1_2_00B14670
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B14670 mov eax, dword ptr fs:[00000030h] 1_2_00B14670
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B0766D mov eax, dword ptr fs:[00000030h] 1_2_00B0766D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B86652 mov eax, dword ptr fs:[00000030h] 1_2_00B86652
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B017B5 mov eax, dword ptr fs:[00000030h] 1_2_00B017B5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B77794 mov eax, dword ptr fs:[00000030h] 1_2_00B77794
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B77794 mov eax, dword ptr fs:[00000030h] 1_2_00B77794
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B77794 mov eax, dword ptr fs:[00000030h] 1_2_00B77794
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B08794 mov eax, dword ptr fs:[00000030h] 1_2_00B08794
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B337F5 mov eax, dword ptr fs:[00000030h] 1_2_00B337F5
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B237EB mov eax, dword ptr fs:[00000030h] 1_2_00B237EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B237EB mov eax, dword ptr fs:[00000030h] 1_2_00B237EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B237EB mov eax, dword ptr fs:[00000030h] 1_2_00B237EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B237EB mov eax, dword ptr fs:[00000030h] 1_2_00B237EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B237EB mov eax, dword ptr fs:[00000030h] 1_2_00B237EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B237EB mov eax, dword ptr fs:[00000030h] 1_2_00B237EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B237EB mov eax, dword ptr fs:[00000030h] 1_2_00B237EB
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B197ED mov eax, dword ptr fs:[00000030h] 1_2_00B197ED
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B197ED mov eax, dword ptr fs:[00000030h] 1_2_00B197ED
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B197ED mov eax, dword ptr fs:[00000030h] 1_2_00B197ED
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B197ED mov eax, dword ptr fs:[00000030h] 1_2_00B197ED
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B197ED mov eax, dword ptr fs:[00000030h] 1_2_00B197ED
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B197ED mov eax, dword ptr fs:[00000030h] 1_2_00B197ED
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B197ED mov eax, dword ptr fs:[00000030h] 1_2_00B197ED
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB17D2 mov eax, dword ptr fs:[00000030h] 1_2_00BB17D2
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC87CF mov eax, dword ptr fs:[00000030h] 1_2_00BC87CF
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2D7CA mov eax, dword ptr fs:[00000030h] 1_2_00B2D7CA
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2D7CA mov eax, dword ptr fs:[00000030h] 1_2_00B2D7CA
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2E730 mov eax, dword ptr fs:[00000030h] 1_2_00B2E730
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B73D mov eax, dword ptr fs:[00000030h] 1_2_00B1B73D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B73D mov eax, dword ptr fs:[00000030h] 1_2_00B1B73D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF6730 mov eax, dword ptr fs:[00000030h] 1_2_00AF6730
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF6730 mov eax, dword ptr fs:[00000030h] 1_2_00AF6730
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF6730 mov eax, dword ptr fs:[00000030h] 1_2_00AF6730
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B24710 mov eax, dword ptr fs:[00000030h] 1_2_00B24710
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1F716 mov eax, dword ptr fs:[00000030h] 1_2_00B1F716
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2D715 mov eax, dword ptr fs:[00000030h] 1_2_00B2D715
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2D715 mov eax, dword ptr fs:[00000030h] 1_2_00B2D715
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC070D mov eax, dword ptr fs:[00000030h] 1_2_00BC070D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC070D mov eax, dword ptr fs:[00000030h] 1_2_00BC070D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2C707 mov eax, dword ptr fs:[00000030h] 1_2_00B2C707
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2C707 mov ecx, dword ptr fs:[00000030h] 1_2_00B2C707
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2C707 mov eax, dword ptr fs:[00000030h] 1_2_00B2C707
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2A70E mov eax, dword ptr fs:[00000030h] 1_2_00B2A70E
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2A70E mov eax, dword ptr fs:[00000030h] 1_2_00B2A70E
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov ecx, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF8760 mov eax, dword ptr fs:[00000030h] 1_2_00AF8760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1E760 mov eax, dword ptr fs:[00000030h] 1_2_00B1E760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1E760 mov eax, dword ptr fs:[00000030h] 1_2_00B1E760
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB1751 mov eax, dword ptr fs:[00000030h] 1_2_00BB1751
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AFA745 mov eax, dword ptr fs:[00000030h] 1_2_00AFA745
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B278A0 mov eax, dword ptr fs:[00000030h] 1_2_00B278A0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028AE mov eax, dword ptr fs:[00000030h] 1_2_00B028AE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028AE mov eax, dword ptr fs:[00000030h] 1_2_00B028AE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028AE mov eax, dword ptr fs:[00000030h] 1_2_00B028AE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028AE mov ecx, dword ptr fs:[00000030h] 1_2_00B028AE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028AE mov eax, dword ptr fs:[00000030h] 1_2_00B028AE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028AE mov eax, dword ptr fs:[00000030h] 1_2_00B028AE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF3880 mov eax, dword ptr fs:[00000030h] 1_2_00AF3880
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF3880 mov eax, dword ptr fs:[00000030h] 1_2_00AF3880
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B73884 mov eax, dword ptr fs:[00000030h] 1_2_00B73884
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B73884 mov eax, dword ptr fs:[00000030h] 1_2_00B73884
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BC98FE mov eax, dword ptr fs:[00000030h] 1_2_00BC98FE
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF58EC mov eax, dword ptr fs:[00000030h] 1_2_00AF58EC
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028FD mov eax, dword ptr fs:[00000030h] 1_2_00B028FD
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028FD mov eax, dword ptr fs:[00000030h] 1_2_00B028FD
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B028FD mov eax, dword ptr fs:[00000030h] 1_2_00B028FD
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF88E0 mov eax, dword ptr fs:[00000030h] 1_2_00AF88E0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B8E4 mov eax, dword ptr fs:[00000030h] 1_2_00B1B8E4
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1B8E4 mov eax, dword ptr fs:[00000030h] 1_2_00B1B8E4
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B8B8D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8B8D0 mov ecx, dword ptr fs:[00000030h] 1_2_00B8B8D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B8B8D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B8B8D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B8B8D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B8B8D0 mov eax, dword ptr fs:[00000030h] 1_2_00B8B8D0
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB18CA mov eax, dword ptr fs:[00000030h] 1_2_00BB18CA
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF78D6 mov eax, dword ptr fs:[00000030h] 1_2_00AF78D6
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF78D6 mov eax, dword ptr fs:[00000030h] 1_2_00AF78D6
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF78D6 mov ecx, dword ptr fs:[00000030h] 1_2_00AF78D6
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A830 mov eax, dword ptr fs:[00000030h] 1_2_00B1A830
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A830 mov eax, dword ptr fs:[00000030h] 1_2_00B1A830
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A830 mov eax, dword ptr fs:[00000030h] 1_2_00B1A830
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1A830 mov eax, dword ptr fs:[00000030h] 1_2_00B1A830
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF6800 mov eax, dword ptr fs:[00000030h] 1_2_00AF6800
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF6800 mov eax, dword ptr fs:[00000030h] 1_2_00AF6800
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF6800 mov eax, dword ptr fs:[00000030h] 1_2_00AF6800
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF381B mov eax, dword ptr fs:[00000030h] 1_2_00AF381B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00AF381B mov eax, dword ptr fs:[00000030h] 1_2_00AF381B
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B1F86D mov eax, dword ptr fs:[00000030h] 1_2_00B1F86D
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00BB1843 mov eax, dword ptr fs:[00000030h] 1_2_00BB1843
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Code function: 1_2_00B2C9BF mov eax, dword ptr fs:[00000030h] 1_2_00B2C9BF

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Memory written: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Process created: C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe C:\Users\user\Desktop\MT103---USD42880.45---20201127--dbs--9900.exe Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.214175689.0000000004CC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.213378752.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.214642043.0000000005126000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.211862077.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.MT103---USD42880.45---20201127--dbs--9900.exe.4cc0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.MT103---USD42880.45---20201127--dbs--9900.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 323965 Sample: MT103---USD42880.45---20201... Startdate: 28/11/2020 Architecture: WINDOWS Score: 84 16 Malicious sample detected (through community Yara rule) 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 Yara detected FormBook 2->20 22 Machine Learning detection for sample 2->22 6 MT103---USD42880.45---20201127--dbs--9900.exe 2->6         started        process3 dnsIp4 12 cdn.discordapp.com 162.159.129.233, 443, 49715 CLOUDFLARENETUS United States 6->12 14 discord.com 162.159.137.232, 443, 49714 CLOUDFLARENETUS United States 6->14 24 Detected unpacking (changes PE section rights) 6->24 26 Tries to detect virtualization through RDTSC time measurements 6->26 28 Injects a PE file into a foreign processes 6->28 10 MT103---USD42880.45---20201127--dbs--9900.exe 6->10         started        signatures5 process6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.137.232
 unknown United States
13335 CLOUDFLARENETUS false
162.159.129.233
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
discord.com 162.159.137.232 true
cdn.discordapp.com 162.159.129.233 true