Source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_0041A350 NtCreateFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_0041A400 NtReadFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_0041A480 NtClose, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_0041A530 NtAllocateVirtualMemory, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_0041A3FC NtReadFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F98F0 NtReadVirtualMemory,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9840 NtDelayExecution,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9860 NtQuerySystemInformation,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F99A0 NtCreateSection,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9A00 NtProtectVirtualMemory,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9A20 NtResumeThread,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9A50 NtCreateFile,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F95D0 NtClose,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9540 NtReadFile,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F96E0 NtFreeVirtualMemory,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9660 NtAllocateVirtualMemory,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9780 NtMapViewOfSection,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F97A0 NtUnmapViewOfSection,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9710 NtQueryInformationToken,LdrInitializeThunk, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F98A0 NtWriteVirtualMemory, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9820 NtEnumerateKey, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009FB040 NtSuspendThread, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F99D0 NtCreateProcessEx, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9950 NtQueueApcThread, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9A80 NtOpenDirectoryObject, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9A10 NtQuerySection, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009FA3B0 NtGetContextThread, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9B00 NtSetValueKey, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F95F0 NtQueryInformationFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009FAD30 NtSetContextThread, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9520 NtWaitForSingleObject, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9560 NtWriteFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F96D0 NtCreateKey, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9610 NtEnumerateValueKey, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9650 NtQueryValueKey, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9670 NtQueryInformationProcess, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9FE0 NtCreateMutant, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009FA710 NtOpenProcessToken, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9730 NtQueryVirtualMemory, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9770 NtSetInformationFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009FA770 NtOpenThread, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F9760 NtOpenProcess, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_1_0041A350 NtCreateFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_1_0041A400 NtReadFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_1_0041A480 NtClose, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_1_0041A530 NtAllocateVirtualMemory, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_1_0041A3FC NtReadFile, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049910 NtAdjustPrivilegesToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049540 NtReadFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050499A0 NtCreateSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050495D0 NtClose,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049840 NtDelayExecution,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049860 NtQuerySystemInformation,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049710 NtQueryInformationToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049780 NtMapViewOfSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049FE0 NtCreateMutant,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049650 NtQueryValueKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049A50 NtCreateFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049660 NtAllocateVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050496D0 NtCreateKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050496E0 NtFreeVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049520 NtWaitForSingleObject, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0504AD30 NtSetContextThread, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049950 NtQueueApcThread, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049560 NtWriteFile, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050499D0 NtCreateProcessEx, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050495F0 NtQueryInformationFile, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049820 NtEnumerateKey, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0504B040 NtSuspendThread, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050498A0 NtWriteVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050498F0 NtReadVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049B00 NtSetValueKey, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0504A710 NtOpenProcessToken, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049730 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049760 NtOpenProcess, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049770 NtSetInformationFile, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0504A770 NtOpenThread, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050497A0 NtUnmapViewOfSection, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0504A3B0 NtGetContextThread, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049A00 NtProtectVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049610 NtEnumerateValueKey, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049A10 NtQuerySection, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049A20 NtResumeThread, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049670 NtQueryInformationProcess, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05049A80 NtOpenDirectoryObject, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_00D9A350 NtCreateFile, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_00D9A480 NtClose, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_00D9A400 NtReadFile, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_00D9A530 NtAllocateVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_00D9A3FC NtReadFile, |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9080 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EF0BF mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EF0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EF0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A33884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A33884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F90AF mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4B8D0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B58EC mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B40E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B40E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B40E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A37016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A37016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A37016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A84015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A84015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D0050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D0050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A72073 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A81074 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A369A6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2990 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EA185 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DC182 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E61A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E61A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A441E8 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BB1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BB1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BB1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D4120 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DB944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DB944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BB171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BB171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BC962 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009ED294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009ED294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CAAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CAAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EFAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2ACB mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2AE4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D3A1C mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B5210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B5210 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B5210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B5210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BAA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BAA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C8A0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F4A2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F4A2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A6B260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A6B260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A88A62 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F927A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7EA55 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A44257 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2397 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A85BA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EB390 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C1B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C1B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A6D380 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7138A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E4BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E4BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E4BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A353CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A353CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DDBE9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7131B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BF358 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BDB40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E3B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E3B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A88B58 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BDB60 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C849B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A714FB mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A88CD6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A8740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A8740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A8740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EBC2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EA44B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D746D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4C450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4C450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A805AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A805AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EFD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EFD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E1DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E1DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E1DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E35A1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A68DF1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36DC9 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CD5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CD5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A3A537 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A88D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7E539 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E4D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E4D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E4D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BAD30 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009D7D50 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F3D43 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A33540 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A63D40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DC577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DC577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A346A7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A80EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A80EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A80EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4FE87 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E36CC mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F8EC7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A6FEC0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E16E0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A88ED6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C76E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EA61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EA61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A6FE3F mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BC600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BC600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BC600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009E8E00 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A71608 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009BE620 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7AE44 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A7AE44 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C766D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009C8794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A37794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A37794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A37794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009F37F5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009DF716 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EA70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EA70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A8070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A8070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009EE730 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4FF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A4FF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B4F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009B4F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_00A88F6A mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CEF40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\ff0231.exe | Code function: 3_2_009CFF60 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05009100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05009100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05009100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05024120 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500AD30 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050CE539 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05034D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05034D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05034D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D8D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0508A537 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05043D43 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05083540 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05027D50 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500C962 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502C182 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503A185 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05032990 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D05AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D05AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050335A1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050361A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050361A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050869A6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05031DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05031DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05031DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086DC9 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050941E8 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050B8DF1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D4015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D4015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05087016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05087016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05087016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503BC2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503A44B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05020050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05020050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509C450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509C450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502746D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D1074 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C2073 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05009080 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05083884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05083884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501849B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050490AF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503F0BF mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509B8D0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D8CD6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050058EC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C14FB mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05086CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502F716 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C131B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509FF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0509FF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05004F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05004F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503E730 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500DB40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501EF40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D8B58 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500F358 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500DB60 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0501FF60 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D8F6A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05033B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05033B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C138A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050BD380 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05011B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05011B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503B390 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05032397 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05018794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05087794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05087794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05087794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050D5BA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05034BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05034BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05034BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050853CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050853CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0502DBE9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050437F5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05038E00 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_050C1608 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05018A0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05005210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05005210 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05005210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05005210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0500AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_05023A1C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503A61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 9_2_0503A61C mov eax, dword ptr fs:[00000030h] |