Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 2_2_004181D0 NtCreateFile, |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 2_2_00418280 NtReadFile, |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 2_2_00418300 NtClose, |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 2_2_004183B0 NtAllocateVirtualMemory, |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 2_2_00418222 NtCreateFile, |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 2_2_004183AA NtAllocateVirtualMemory, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99840 NtDelayExecution,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99860 NtQuerySystemInformation,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C995D0 NtClose,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C999A0 NtCreateSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99540 NtReadFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99910 NtAdjustPrivilegesToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C996D0 NtCreateKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C996E0 NtFreeVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99A50 NtCreateFile,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99650 NtQueryValueKey,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99660 NtAllocateVirtualMemory,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99FE0 NtCreateMutant,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99780 NtMapViewOfSection,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99710 NtQueryInformationToken,LdrInitializeThunk, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C998F0 NtReadVirtualMemory, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C998A0 NtWriteVirtualMemory, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C9B040 NtSuspendThread, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99820 NtEnumerateKey, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C999D0 NtCreateProcessEx, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C995F0 NtQueryInformationFile, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99950 NtQueueApcThread, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99560 NtWriteFile, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99520 NtWaitForSingleObject, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C9AD30 NtSetContextThread, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99A80 NtOpenDirectoryObject, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99670 NtQueryInformationProcess, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99A00 NtProtectVirtualMemory, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99610 NtEnumerateValueKey, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99A10 NtQuerySection, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99A20 NtResumeThread, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C997A0 NtUnmapViewOfSection, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C9A3B0 NtGetContextThread, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99760 NtOpenProcess, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99770 NtSetInformationFile, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C9A770 NtOpenThread, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99B00 NtSetValueKey, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C9A710 NtOpenProcessToken, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C99730 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_009B81D0 NtCreateFile, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_009B8280 NtReadFile, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_009B83B0 NtAllocateVirtualMemory, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_009B8300 NtClose, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_009B8222 NtCreateFile, |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_009B83AA NtAllocateVirtualMemory, |
Source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE |
Source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY | Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 1_2_006E06DA mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 1_2_006E08EE mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 1_2_006E09DE mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 1_2_006E099F mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe | Code function: 1_2_006E0A1C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D28CD6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEB8D0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D114FB mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD6CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD6CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD6CF0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59080 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD3884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD3884 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6849B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C990AF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8F0BF mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8F0BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8A44B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C70050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C70050 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEC450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEC450 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D12073 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D21074 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7746D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D24015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D24015 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD7016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD7016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD7016 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D2740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D2740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D2740D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8BC2C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D08DF1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5B1E1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CE41E8 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6D5E0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7C182 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8A185 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8FD9B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C82990 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C861A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C861A0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C835A1 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD69A6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C81DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C81DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C81DB5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7B944 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C93D43 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD3540 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C77D50 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5C962 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7C577 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5B171 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59100 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D28D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C74120 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8513A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C84D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C84D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C84D3B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5AD30 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CDA537 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C82ACB mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D28ED6 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C836CC mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C98EC7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D0FEC0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C676E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C816E0 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C82AE4 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEFE87 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8D294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8D294 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD46A7 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6AAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6AAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D20EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D20EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D20EA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8FAB0 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CE4257 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6766D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D0B260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D0B260 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D28A62 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C9927A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5C600 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C88E00 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C68A0A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5AA16 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8A61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8A61C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C73A1C mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5E620 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D0FE3F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD53CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD53CA mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C937F5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C61B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C61B8F mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D0D380 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C68794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8B390 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD7794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD7794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CD7794 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D1138A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D25BA5 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5DB40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6EF40 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D28B58 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5F358 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C5DB60 mov ecx, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C6FF60 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C83B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C83B7A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D28F6A mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8A70E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D1131B mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C7F716 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEFF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04CEFF10 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D2070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04D2070D mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C54F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C54F2E mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\raserver.exe | Code function: 13_2_04C8E730 mov eax, dword ptr fs:[00000030h] |