Source: C:\Users\user\Desktop\20210113432.exe | Code function: 2_2_00419D50 NtCreateFile, |
Source: C:\Users\user\Desktop\20210113432.exe | Code function: 2_2_00419E00 NtReadFile, |
Source: C:\Users\user\Desktop\20210113432.exe | Code function: 2_2_00419E80 NtClose, |
Source: C:\Users\user\Desktop\20210113432.exe | Code function: 2_2_00419F30 NtAllocateVirtualMemory, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949840 NtDelayExecution,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949860 NtQuerySystemInformation,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049499A0 NtCreateSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049495D0 NtClose,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949910 NtAdjustPrivilegesToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949540 NtReadFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049496D0 NtCreateKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049496E0 NtFreeVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949650 NtQueryValueKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949A50 NtCreateFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949660 NtAllocateVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949780 NtMapViewOfSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949FE0 NtCreateMutant,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949710 NtQueryInformationToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049498A0 NtWriteVirtualMemory, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049498F0 NtReadVirtualMemory, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949820 NtEnumerateKey, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0494B040 NtSuspendThread, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049499D0 NtCreateProcessEx, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049495F0 NtQueryInformationFile, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0494AD30 NtSetContextThread, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949520 NtWaitForSingleObject, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949950 NtQueueApcThread, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949560 NtWriteFile, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949A80 NtOpenDirectoryObject, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949610 NtEnumerateValueKey, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949A10 NtQuerySection, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949A00 NtProtectVirtualMemory, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949A20 NtResumeThread, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949670 NtQueryInformationProcess, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0494A3B0 NtGetContextThread, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049497A0 NtUnmapViewOfSection, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0494A710 NtOpenProcessToken, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949B00 NtSetValueKey, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949730 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949770 NtSetInformationFile, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0494A770 NtOpenThread, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04949760 NtOpenProcess, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_00859D50 NtCreateFile, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_00859E80 NtClose, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_00859E00 NtReadFile, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_00859F30 NtAllocateVirtualMemory, |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491849B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909080 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04983884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04983884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493F0BF mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049490AF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499B8D0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D8CD6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C14FB mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049058EC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D4015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D4015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04987016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04987016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04987016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493BC2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04920050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04920050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499C450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499C450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493A44B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D1074 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C2073 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492746D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932990 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492C182 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493A185 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04931DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04931DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04931DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D05AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D05AC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049335A1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049361A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049361A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049869A6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986DC9 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049B8DF1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049941E8 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490AD30 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CE539 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04934D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04934D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04934D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D8D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0498A537 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04924120 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04927D50 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04943D43 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04983540 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490C962 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493D294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493D294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499FE87 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491AAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491AAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493FAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D0EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D0EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D0EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049846A7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D8ED6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04948EC7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932ACB mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049BFEC0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049336CC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049316E0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049176E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932AE4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04905210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04905210 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04905210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04905210 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04923A1C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493A61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493A61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04938E00 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C1608 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04918A0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049BFE3F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490E620 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04944A2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04944A2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CEA55 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04994257 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CAE44 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049CAE44 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0494927A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049BB260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049BB260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491766D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D8A62 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493B390 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04932397 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04918794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04987794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04987794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04987794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C138A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049BD380 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04911B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04911B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D5BA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04934BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04934BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04934BAD mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049853CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049853CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049437F5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492DBE9 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0492F716 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049C131B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499FF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0499FF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0493E730 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04904F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04904F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D8B58 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490F358 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490DB40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491EF40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04933B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_04933B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0490DB60 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_0491FF60 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\cmstp.exe | Code function: 10_2_049D8F6A mov eax, dword ptr fs:[00000030h] |