Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp, explorer.exe, 0000000B.00000000.331004335.000000000F640000.00000004.00000001.sdmp | String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0 |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0? |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0 |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://fontfabrik.com |
Source: explorer.exe, 0000000B.00000000.331004335.000000000F640000.00000004.00000001.sdmp | String found in binary or memory: http://logo.verisign |
Source: New-Order 04758485.exe, 00000000.00000003.227583172.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adb |
Source: New-Order 04758485.exe, 00000000.00000003.301790150.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.ado/1 |
Source: New-Order 04758485.exe, 00000000.00000003.227583172.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.ado/1O |
Source: New-Order 04758485.exe, 00000000.00000003.227284672.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adob |
Source: New-Order 04758485.exe, 00000000.00000003.227583172.0000000006F42000.00000004.00000001.sdmp, New-Order 04758485.exe, 00000000.00000003.227284672.0000000006F42000.00000004.00000001.sdmp, New-Order 04758485.exe, 00000000.00000003.227189386.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe |
Source: New-Order 04758485.exe, 00000000.00000003.301790150.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe.c/g |
Source: New-Order 04758485.exe, 00000000.00000003.227583172.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe.c/gO |
Source: New-Order 04758485.exe, 00000000.00000003.227189386.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe.cD |
Source: New-Order 04758485.exe, 00000000.00000003.227490070.0000000006F42000.00000004.00000001.sdmp, New-Order 04758485.exe, 00000000.00000003.227189386.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe.cK |
Source: New-Order 04758485.exe, 00000000.00000003.227583172.0000000006F42000.00000004.00000001.sdmp, New-Order 04758485.exe, 00000000.00000003.301790150.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe.co |
Source: New-Order 04758485.exe, 00000000.00000003.301805201.0000000006F4C000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe.cobj |
Source: New-Order 04758485.exe, 00000000.00000003.227583172.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://ns.adobe.cobjO |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://ocsp.digicert.com0: |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://ocsp.msocsp.com0 |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://ocsp.pki.goog/gsr202 |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://ocsp.pki.goog/gts1o1core0 |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0 |
Source: New-Order 04758485.exe, 00000000.00000003.227284672.0000000006F42000.00000004.00000001.sdmp | String found in binary or memory: http://purl.r |
Source: New-Order 04758485.exe, 00000000.00000002.302817037.0000000002A21000.00000004.00000001.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.carterandcone.coml |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com/designers |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/? |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com/designers8 |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com/designers? |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fontbureau.com/designersG |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.fonts.com |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.founder.com.cn/cn |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.founder.com.cn/cn/bThe |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.founder.com.cn/cn/cThe |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.galapagosdesign.com/DPlease |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.goodfont.co.kr |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.jiyu-kobo.co.jp/ |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.sajatypeworks.com |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.sakkal.com |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.sandoll.co.kr |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.tiro.com |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.typography.netD |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.urwpp.deDPlease |
Source: explorer.exe, 0000000B.00000000.328332626.0000000008B46000.00000002.00000001.sdmp | String found in binary or memory: http://www.zhongyicts.com.cn |
Source: New-Order 04758485.exe, 00000000.00000002.302607546.0000000000F16000.00000004.00000020.sdmp | String found in binary or memory: https://pki.goog/repository/0 |
Source: New-Order 04758485.exe, 00000000.00000002.302817037.0000000002A21000.00000004.00000001.sdmp | String found in binary or memory: https://www.google.com |
Source: New-Order 04758485.exe, 00000000.00000002.302817037.0000000002A21000.00000004.00000001.sdmp | String found in binary or memory: https://www.google.com/ |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041A060 NtClose, |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041A110 NtAllocateVirtualMemory, |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00419F30 NtCreateFile, |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00419FE0 NtReadFile, |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041A05A NtClose, |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041A10C NtAllocateVirtualMemory, |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00419FDA NtReadFile, |
Source: C:\Windows\explorer.exe | Code function: 11_2_061AFA52 NtCreateFile, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D595D0 NtClose,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59540 NtReadFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D596D0 NtCreateKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D596E0 NtFreeVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59650 NtQueryValueKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59660 NtAllocateVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59FE0 NtCreateMutant,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59780 NtMapViewOfSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59710 NtQueryInformationToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59840 NtDelayExecution,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59860 NtQuerySystemInformation,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D599A0 NtCreateSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59910 NtAdjustPrivilegesToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59A50 NtCreateFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D595F0 NtQueryInformationFile, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59560 NtWriteFile, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D5AD30 NtSetContextThread, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59520 NtWaitForSingleObject, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59670 NtQueryInformationProcess, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59610 NtEnumerateValueKey, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D597A0 NtUnmapViewOfSection, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D5A770 NtOpenThread, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59770 NtSetInformationFile, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59760 NtOpenProcess, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D5A710 NtOpenProcessToken, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59730 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D598F0 NtReadVirtualMemory, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D598A0 NtWriteVirtualMemory, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D5B040 NtSuspendThread, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59820 NtEnumerateKey, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D599D0 NtCreateProcessEx, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59950 NtQueueApcThread, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59A80 NtOpenDirectoryObject, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59A10 NtQuerySection, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59A00 NtProtectVirtualMemory, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59A20 NtResumeThread, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D5A3B0 NtGetContextThread, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D59B00 NtSetValueKey, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7A060 NtClose, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7A110 NtAllocateVirtualMemory, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C79FE0 NtReadFile, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C79F30 NtCreateFile, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7A05A NtClose, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7A10C NtAllocateVirtualMemory, |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C79FDA NtReadFile, |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B00C78 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B03568 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B016D8 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B02410 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B0355A |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B00006 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B00040 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B009AD |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06B04188 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1AFC8 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1E4E0 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1A4D0 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1DDB0 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1C2F0 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E19800 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E197F0 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E17FA0 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1AFB8 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E17F90 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1F749 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1F758 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1A4C0 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1E4D1 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1DDAD |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 0_2_06E1C2E1 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00401029 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00401030 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041D173 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041E3E6 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041DBBB |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00402D87 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041D589 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00402D90 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00409E40 |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00409E3B |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_0041DFAA |
Source: C:\Users\user\Desktop\New-Order 04758485.exe | Code function: 10_2_00402FB0 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061AFA52 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061B2A0C |
Source: C:\Windows\explorer.exe | Code function: 11_2_061A6072 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061A6069 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061AE882 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061A7CF2 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061A7CE9 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061AAB1F |
Source: C:\Windows\explorer.exe | Code function: 11_2_061AAB22 |
Source: C:\Windows\explorer.exe | Code function: 11_2_061AD152 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDD466 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2841F |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE25DD |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2D5E0 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42581 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE1D55 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE2D07 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D10D20 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE2EF7 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDD616 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D36E30 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DEDFCE |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE1FF1 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE28EC |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2B090 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D420A0 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE20A8 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1002 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DEE824 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1F900 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D34120 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE22AE |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DCFA2B |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD03DA |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDDBD2 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4EBB0 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE2B28 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7D173 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7E3E6 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C62D87 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7D589 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C62D90 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C69E40 |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C69E3B |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C7DFAA |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_00C62FB0 |
Source: 0000000A.00000002.342372255.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000A.00000002.342372255.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000C.00000002.474310455.0000000004920000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000C.00000002.474310455.0000000004920000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000000.00000002.307323456.0000000003AFA000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000000.00000002.307323456.0000000003AFA000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000A.00000002.342960367.00000000011A0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000A.00000002.342960367.00000000011A0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000A.00000002.342980918.00000000011D0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000A.00000002.342980918.00000000011D0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000C.00000002.474480183.0000000004950000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000C.00000002.474480183.0000000004950000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000000.00000002.307802950.0000000003BDE000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000000.00000002.307802950.0000000003BDE000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000C.00000002.472057276.0000000000C60000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000C.00000002.472057276.0000000000C60000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000000.00000002.307176477.0000000003A97000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000000.00000002.307176477.0000000003A97000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 10.2.New-Order 04758485.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 10.2.New-Order 04758485.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 10.2.New-Order 04758485.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 10.2.New-Order 04758485.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE8CD6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD14FB mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2849B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAC450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAC450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4A44B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3746D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4BC2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96DC9 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D96DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DC8DF1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D12D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D12D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D12D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D12D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D12D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D41DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D41DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D41DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE05AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE05AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D435A1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D37D50 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D53D43 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D93540 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DC3D40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1AD30 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDE539 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D23D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE8D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D9A537 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D44D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D44D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D44D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE8ED6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D58EC7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D436CC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DCFEC0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D276E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D416E0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAFE87 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE0EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE0EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE0EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D946A7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D27E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D27E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D27E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D27E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D27E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D27E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDAE44 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDAE44 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2766D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4A61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4A61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D48E00 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD1608 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DCFE3F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1E620 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D537F5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D28794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D97794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D97794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D97794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2EF40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2FF60 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE8F6A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3F716 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAFF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAFF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4E730 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D14F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D14F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAB8D0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DAB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D140E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D140E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D140E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D158EC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19080 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D93884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D93884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4F0BF mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D420A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D420A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D420A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D420A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D420A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D420A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D590AF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D30050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D30050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE1074 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD2073 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE4015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE4015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D97016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D97016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D97016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DA41E8 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42990 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3C182 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4A185 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D951BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D951BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D951BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D951BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D461A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D461A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD49A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD49A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD49A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD49A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D969A6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1C962 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D34120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D34120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D34120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D34120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D34120 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42ACB mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42AE4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4D294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4D294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2AAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D2AAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4FAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D152A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D152A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D152A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D152A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D152A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDEA55 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DA4257 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D19240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D5927A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DCB260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DCB260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE8A62 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D15210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D15210 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D15210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D15210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDAA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DDAA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D33A1C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D28A0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D54A2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D54A2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D953CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D953CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D403E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D403E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D403E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D403E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D403E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D403E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D3DBE9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D42397 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D4B390 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD138A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DCD380 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D21B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D21B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D44BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D44BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D44BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE5BA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DE8B58 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1F358 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1DB40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D43B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D43B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04D1DB60 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmmon32.exe | Code function: 12_2_04DD131B mov eax, dword ptr fs:[00000030h] |