Windows Analysis Report
213.exe

Overview

General Information

Sample name: 213.exe
Analysis ID: 1559172
MD5: 92b87c6d54d69691eaa9d2d3021b9cf6
SHA1: 177fb16e46c31239d6817dfebe438456801f6026
SHA256: 145f0792808529be8c426d0537641741881c2f997f9af96ac52d132154721900
Tags: exeopendiruser-Joker
Infos:

Detection

Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for dropped file
Machine Learning detection for sample
Renames NTDLL to bypass HIPS
Binary contains a suspicious time stamp
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Enables driver privileges
Enables security privileges
Entry point lies outside standard sections
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Sample file is different than original file name gathered from version info
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

AV Detection
barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Desktop\QQWER.dll ReversingLabs: Detection: 73%
Multi AV Scanner detection for submitted file
Source: 213.exe ReversingLabs: Detection: 47%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 95.2% probability
Machine Learning detection for dropped file
Source: C:\Users\user\Desktop\QQWER.dll Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 213.exe Joe Sandbox ML: detected

Compliance
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Desktop\213.exe Unpacked PE file: 1.2.213.exe.10000000.2.unpack
Source: C:\Users\user\Desktop\213.exe Unpacked PE file: 4.2.213.exe.10000000.2.unpack
Uses 32bit PE files
Source: 213.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Binary string: devco n.pdbo source: 213.exe
Source: Binary string: wntdll.pdbUGP source: 213.exe, 00000001.00000002.2649542491.0000000002D42000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1368992017.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1531909500.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649235913.0000000002C1E000.00000040.00000020.00020000.00000000.sdmp, 61d161.tmp.4.dr, 6191a9.tmp.1.dr
Source: Binary string: wntdll.pdb source: 213.exe, 00000001.00000002.2649542491.0000000002D42000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1368992017.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1531909500.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649235913.0000000002C1E000.00000040.00000020.00020000.00000000.sdmp, 61d161.tmp.4.dr, 6191a9.tmp.1.dr
Source: Binary string: DrvInDM U.pdbe source: 213.exe
Source: Binary string: wuser32.pdb source: 213.exe, 00000001.00000002.2649779035.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1369730161.0000000002B94000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1532972259.0000000002A67000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649482812.0000000002DD1000.00000040.00000020.00020000.00000000.sdmp, 619216.tmp.1.dr, 61d1bf.tmp.4.dr
Source: Binary string: devc@on.pdb source: 213.exe
Source: Binary string: wuser32.pdbUGP source: 213.exe, 00000001.00000002.2649779035.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1369730161.0000000002B94000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1532972259.0000000002A67000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649482812.0000000002DD1000.00000040.00000020.00020000.00000000.sdmp, 619216.tmp.1.dr, 61d1bf.tmp.4.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-28h], esp 1_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1001A199
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10018AD3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10018AD3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10018EEA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_100193C2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 1_2_100193C2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10007FDD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10018801
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_10017804
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10011772
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10013C18
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10011C1A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1001A031
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 1_2_10024C38
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_1001AC51
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_1001AC51
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_1001AC51
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10006051
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10006051
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001385A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10002461
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1000F472
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 1_2_1001847E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10022882
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-38h], esp 1_2_10025484
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 1_2_10025484
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_10006495
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10006C96
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10014096
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10014096
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000FCB0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_100198CC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_100188E1
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001A4E7
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1000210D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1000210D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 1_2_1000B90D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10003116
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10017D41
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10017D41
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000FD4D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_10001D56
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 1_2_10025977
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10010199
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_1001419C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_1001419C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10008DA3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_100111A7
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10007DB8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 1_2_100151BD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 1_2_100151BD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 1_2_100151BD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-28h], esp 1_2_1001D1C4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_1001D1C4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_100259D9
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 1_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 1_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 1_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 1_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 1_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_100189E6
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1000FDEA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_100101FB
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_10014203
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1000B61E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 1_2_1001221F
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 1_2_1001221F
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001A236
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1001363D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001363D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10008E40
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_10011653
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_10011653
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10010255
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10010255
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10007E55
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 1_2_10007E55
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-40h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-40h], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 1_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000FA6F
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10022A80
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10011E89
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-54h], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1001A6C7
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 1_2_10017ECA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10010AD6
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10010AD6
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-38h], esp 1_2_10008EDD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_1001BADE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_100246E4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 1_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_100236FF
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 1_2_100236FF
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000FF10
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10008B27
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_1001BB29
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_10015B34
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000833D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-34h], esp 1_2_10012B40
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_1000634E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000B353
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_10026356
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-54h], esp 1_2_1001DB5C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_1001DB5C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10017B68
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_10011772
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-38h], esp 1_2_10024781
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 1_2_10024781
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 1_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 1_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 1_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 1_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 1_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 1_2_1000A7A2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_100137A3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000F7AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10008BC4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10013FC8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_10007BCA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 1_2_10005FDA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_100253E7
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 1_2_1000B3F0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_100198CC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-28h], esp 4_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_1000710E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1001A199
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_10018AD3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_10018AD3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_10018EEA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_100193C2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 4_2_100193C2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10007FDD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10018801
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_10017804
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10011772
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10013C18
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_10011C1A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1001A031
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 4_2_10024C38
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_1001AC51
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_1001AC51
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_1001AC51
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10006051
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10006051
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001385A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_10002461
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1000F472
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 4_2_1001847E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10022882
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-38h], esp 4_2_10025484
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 4_2_10025484
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_10006495
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10006C96
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_10014096
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_10014096
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_100024AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1000FCB0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001A8BE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_100188E1
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001A4E7
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1000210D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1000210D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 4_2_1000B90D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10003116
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10017D41
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10017D41
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1000FD4D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_10001D56
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 4_2_10025977
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10010199
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_1001419C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_1001419C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10008DA3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_100111A7
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10007DB8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 4_2_100151BD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 4_2_100151BD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 4_2_100151BD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-28h], esp 4_2_1001D1C4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_1001D1C4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_100259D9
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 4_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 4_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 4_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 4_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 4_2_100221E2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_100189E6
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1000FDEA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_100101FB
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_10014203
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001121A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1000B61E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 4_2_1001221F
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-2Ch], esp 4_2_1001221F
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001A236
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1001363D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001363D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10008E40
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_10011653
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_10011653
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10010255
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10010255
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10007E55
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 4_2_10007E55
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-40h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-40h], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-3Ch], esp 4_2_1000C655
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1000FA6F
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10022A80
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10011E89
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-54h], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-50h], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_1002129C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1001A6C7
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-20h], esp 4_2_10017ECA
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10010AD6
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10010AD6
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-38h], esp 4_2_10008EDD
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_1001BADE
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_100246E4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0000008Ch], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-00000084h], esp 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 4_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1001A6F8
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_100236FF
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-08h], esp 4_2_100236FF
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1000FF10
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10008B27
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_1001BB29
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_10015B34
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1000833D
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-34h], esp 4_2_10012B40
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-04h], esp 4_2_1000634E
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1000B353
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_10026356
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-54h], esp 4_2_1001DB5C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_1001DB5C
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10017B68
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_10011772
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-38h], esp 4_2_10024781
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 4_2_10024781
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-14h], esp 4_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-0Ch], esp 4_2_1002378A
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-4Ch], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-58h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-44h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-48h], esp 4_2_10014289
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-24h], esp 4_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-1Ch], esp 4_2_1001BFA0
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-18h], esp 4_2_1000A7A2
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_100137A3
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_1000F7AC
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10008BC4
Source: C:\Users\user\Desktop\213.exe Code function: 4x nop then cmp dword ptr [ebp-10h], esp 4_2_10013FC8
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E5%AD%98%E6%A1%A3/.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E5%AD%98%E6%A1%A3/.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: unknown TCP traffic detected without corresponding DNS query: 42.193.100.57
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E5%AD%98%E6%A1%A3/.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /%E5%AD%98%E6%A1%A3/.txt HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Host: 42.193.100.57Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:15:20 GMTContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Date: Wed, 20 Nov 2024 08:15:35 GMTContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69
Source: 213.exe String found in binary or memory: http://.httpsset-cookie:;;
Source: 213.exe, 00000001.00000002.2647752348.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/
Source: 213.exe String found in binary or memory: http://42.193.100.57/%E5%AD%98%E6%A1%A3/
Source: 213.exe, 00000001.00000002.2647752348.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000002.2647752348.00000000009F7000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000002.2647752348.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2647341814.0000000000BA5000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2647341814.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2647341814.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2647341814.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E5%AD%98%E6%A1%A3/.txt
Source: 213.exe, 00000001.00000002.2647752348.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E5%AD%98%E6%A1%A3/.txt2
Source: 213.exe, 00000004.00000002.2647341814.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E5%AD%98%E6%A1%A3/.txtH
Source: 213.exe String found in binary or memory: http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt
Source: 213.exe, 00000001.00000002.2647752348.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt(
Source: 213.exe, 00000004.00000002.2647341814.0000000000B08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt3
Source: 213.exe, 00000004.00000002.2647341814.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txtD:
Source: 213.exe, 00000001.00000002.2647752348.0000000000A23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txtW
Source: 213.exe, 00000001.00000002.2647752348.0000000000A23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txtl
Source: 213.exe, 00000004.00000003.1611716242.0000000000BAC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9Or&8
Source: 213.exe String found in binary or memory: http://ocsp.t
Source: 213.exe String found in binary or memory: http://sf.symc
Source: 213.exe String found in binary or memory: http://ts-ocsp.ws.s
Source: 213.exe String found in binary or memory: http://ts-ocsp.ws.symantec.
Source: 213.exe String found in binary or memory: http://www.eyuyan.com)DVarFileInfo$
Source: 213.exe String found in binary or memory: https://note.youdao.com/yws/public/note/03cb89fe74e7b4305099ed5dabde2135?sev=j1
Source: 213.exe String found in binary or memory: https://ww(w.v
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1001F2ED IsWindow,IsIconic,GetDCEx,GetDCEx,GetWindowInfo,GetWindowRect,CreateCompatibleDC,CreateDIBSection,SelectObject,CreateCompatibleDC,SelectObject,PrintWindow,BitBlt,BitBlt,BitBlt,SelectObject,GetDIBits, 1_2_1001F2ED
Installs a raw input device (often for capturing keystrokes)
Source: 213.exe, 00000001.00000002.2647752348.00000000009AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_034dbfd8-5
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: 213.exe PID: 8064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 213.exe PID: 888, type: MEMORYSTR
Contains functionality to call native functions
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_10007FDD NtClose, 1_2_10007FDD
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1001419C ReleaseMutex,NtClose, 1_2_1001419C
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1001221F NtClose, 1_2_1001221F
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_10007FDD NtClose, 4_2_10007FDD
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_1001419C ReleaseMutex,NtClose, 4_2_1001419C
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_1001221F NtClose, 4_2_1001221F
Detected potential crypto function
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_004C6060 1_2_004C6060
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_004C4B80 1_2_004C4B80
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_10002628 1_2_10002628
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_100032EA 1_2_100032EA
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_004C6060 4_2_004C6060
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_004C4B80 4_2_004C4B80
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_10002628 4_2_10002628
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_100032EA 4_2_100032EA
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Desktop\QQWER.dll BE7A0A59B36299F40D6AC2FC126ACFD6C8BBFF8C4F8D9D85267DF3E2E1E3AED3
Enables driver privileges
Source: C:\Users\user\Desktop\213.exe Process token adjusted: Load Driver Jump to behavior
Enables security privileges
Source: C:\Users\user\Desktop\213.exe Process token adjusted: Security Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\213.exe Code function: String function: 10029640 appears 130 times
PE file contains executable resources (Code or Archives)
Source: 6191a9.tmp.1.dr Static PE information: Resource name: RT_MESSAGETABLE type: PDP-11 separate I&D executable not stripped
Source: 61d161.tmp.4.dr Static PE information: Resource name: RT_MESSAGETABLE type: PDP-11 separate I&D executable not stripped
PE file does not import any functions
Source: 6191a9.tmp.1.dr Static PE information: No import functions for PE file found
Source: 61d161.tmp.4.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: 213.exe, 00000001.00000002.2649542491.0000000002E6F000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 213.exe
Source: 213.exe, 00000001.00000003.1368992017.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 213.exe
Source: 213.exe, 00000001.00000003.1369730161.0000000002B94000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameuser32j% vs 213.exe
Source: 213.exe, 00000001.00000002.2649779035.0000000002F9C000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameuser32j% vs 213.exe
Source: 213.exe, 00000004.00000003.1532972259.0000000002A67000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameuser32j% vs 213.exe
Source: 213.exe, 00000004.00000002.2649482812.0000000002E7A000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameuser32j% vs 213.exe
Source: 213.exe, 00000004.00000002.2649235913.0000000002D4B000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 213.exe
Source: 213.exe, 00000004.00000003.1531909500.0000000002B8B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 213.exe
Uses 32bit PE files
Source: 213.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: QQWER.dll.1.dr Static PE information: Section: .rsrc ZLIB complexity 1.0002780183550337
Source: 6191a9.tmp.1.dr Binary string: \Device\IPT[
Source: classification engine Classification label: mal84.evad.winEXE@2/11@0/1
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_0041CB46 GetDiskFreeSpaceExA, 1_2_0041CB46
Source: C:\Users\user\Desktop\213.exe File created: C:\Users\user\Desktop\QQWER.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Mutant created: NULL
Source: C:\Users\user\Desktop\213.exe File created: C:\Users\user\AppData\Local\Temp\6191a9.tmp Jump to behavior
Source: 213.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\213.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 213.exe ReversingLabs: Detection: 47%
Source: unknown Process created: C:\Users\user\Desktop\213.exe "C:\Users\user\Desktop\213.exe"
Source: unknown Process created: C:\Users\user\Desktop\213.exe "C:\Users\user\Desktop\213.exe"
Source: C:\Users\user\Desktop\213.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\213.exe Window detected: Number of UI elements: 23
Source: 213.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 213.exe Static file information: File size 5222400 > 1048576
Source: 213.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x14f000
Source: 213.exe Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x286000
Source: 213.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x10d000
Source: Binary string: devco n.pdbo source: 213.exe
Source: Binary string: wntdll.pdbUGP source: 213.exe, 00000001.00000002.2649542491.0000000002D42000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1368992017.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1531909500.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649235913.0000000002C1E000.00000040.00000020.00020000.00000000.sdmp, 61d161.tmp.4.dr, 6191a9.tmp.1.dr
Source: Binary string: wntdll.pdb source: 213.exe, 00000001.00000002.2649542491.0000000002D42000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1368992017.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1531909500.0000000002A68000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649235913.0000000002C1E000.00000040.00000020.00020000.00000000.sdmp, 61d161.tmp.4.dr, 6191a9.tmp.1.dr
Source: Binary string: DrvInDM U.pdbe source: 213.exe
Source: Binary string: wuser32.pdb source: 213.exe, 00000001.00000002.2649779035.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1369730161.0000000002B94000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1532972259.0000000002A67000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649482812.0000000002DD1000.00000040.00000020.00020000.00000000.sdmp, 619216.tmp.1.dr, 61d1bf.tmp.4.dr
Source: Binary string: devc@on.pdb source: 213.exe
Source: Binary string: wuser32.pdbUGP source: 213.exe, 00000001.00000002.2649779035.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1369730161.0000000002B94000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1532972259.0000000002A67000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2649482812.0000000002DD1000.00000040.00000020.00020000.00000000.sdmp, 619216.tmp.1.dr, 61d1bf.tmp.4.dr

Data Obfuscation
barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Desktop\213.exe Unpacked PE file: 1.2.213.exe.10000000.2.unpack
Source: C:\Users\user\Desktop\213.exe Unpacked PE file: 4.2.213.exe.10000000.2.unpack
Binary contains a suspicious time stamp
Source: 619216.tmp.1.dr Static PE information: 0x9A58494B [Sun Jan 21 19:13:15 2052 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_004C3FD0 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary, 1_2_004C3FD0
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .rsrc
PE file contains sections with non-standard names
Source: QQWER.dll.1.dr Static PE information: section name: .Upack
Source: 6191a9.tmp.1.dr Static PE information: section name: RT
Source: 6191a9.tmp.1.dr Static PE information: section name: .mrdata
Source: 6191a9.tmp.1.dr Static PE information: section name: .00cfg
Source: 619216.tmp.1.dr Static PE information: section name: .didat
Source: 61d161.tmp.4.dr Static PE information: section name: RT
Source: 61d161.tmp.4.dr Static PE information: section name: .mrdata
Source: 61d161.tmp.4.dr Static PE information: section name: .00cfg
Source: 61d1bf.tmp.4.dr Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_0052ECA0 push eax; ret 1_2_0052ECCE
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_00530F14 push eax; ret 1_2_00530F32
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1002C7F8 push edi; ret 1_2_1002C7FC
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_0052ECA0 push eax; ret 4_2_0052ECCE
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_00530F14 push eax; ret 4_2_00530F32
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_1002C7F8 push edi; ret 4_2_1002C7FC
Source: QQWER.dll.1.dr Static PE information: section name: .rsrc entropy: 7.999713933191419
Source: 6191a9.tmp.1.dr Static PE information: section name: .text entropy: 6.844531704449234
Source: 61d161.tmp.4.dr Static PE information: section name: .text entropy: 6.844531704449234
Drops PE files
Source: C:\Users\user\Desktop\213.exe File created: C:\Users\user\AppData\Local\Temp\6191a9.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe File created: C:\Users\user\AppData\Local\Temp\61d1bf.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe File created: C:\Users\user\AppData\Local\Temp\619216.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe File created: C:\Users\user\AppData\Local\Temp\61d161.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe File created: C:\Users\user\Desktop\QQWER.dll Jump to dropped file
Source: C:\Users\user\Desktop\213.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Jump to behavior
Source: C:\Users\user\Desktop\213.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_004CBF70 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow, 1_2_004CBF70
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1001F2ED IsWindow,IsIconic,GetDCEx,GetDCEx,GetWindowInfo,GetWindowRect,CreateCompatibleDC,CreateDIBSection,SelectObject,CreateCompatibleDC,SelectObject,PrintWindow,BitBlt,BitBlt,BitBlt,SelectObject,GetDIBits, 1_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_004CBF70 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow, 4_2_004CBF70
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_1001F2ED IsWindow,IsIconic,GetDCEx,GetDCEx,GetWindowInfo,GetWindowRect,CreateCompatibleDC,CreateDIBSection,SelectObject,CreateCompatibleDC,SelectObject,PrintWindow,BitBlt,BitBlt,BitBlt,SelectObject,GetDIBits, 4_2_1001F2ED
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\Desktop\213.exe Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Renames NTDLL to bypass HIPS
Source: C:\Users\user\Desktop\213.exe File opened: C:\Windows\SysWOW64\ntdll.dll Jump to behavior
Source: C:\Users\user\Desktop\213.exe File opened: C:\Windows\SysWOW64\ntdll.dll Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\213.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6191a9.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\61d1bf.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\619216.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\61d161.tmp Jump to dropped file
Source: C:\Users\user\Desktop\213.exe Dropped PE file which has not been started: C:\Users\user\Desktop\QQWER.dll Jump to dropped file
Source: C:\Users\user\Desktop\213.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\213.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1000710E GetVersionExA,GetSystemInfo,RtlGetNtVersionNumbers, 1_2_1000710E
Source: 213.exe, 00000001.00000002.2647752348.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000002.2647752348.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2647341814.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000002.2647341814.0000000000B96000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000004.00000003.1612068298.0000000000B96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\213.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\213.exe API call chain: ExitProcess graph end node
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_10004B1B LdrInitializeThunk, 1_2_10004B1B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_004C3FD0 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary, 1_2_004C3FD0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1001A4C7 mov eax, dword ptr fs:[00000030h] 1_2_1001A4C7
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_1000AE99 mov eax, dword ptr fs:[00000030h] 1_2_1000AE99
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_1001A4C7 mov eax, dword ptr fs:[00000030h] 4_2_1001A4C7
Source: C:\Users\user\Desktop\213.exe Code function: 4_2_1000AE99 mov eax, dword ptr fs:[00000030h] 4_2_1000AE99
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_004B0C30 GetProcessHeap,RtlAllocateHeap, 1_2_004B0C30
Enables debug privileges
Source: C:\Users\user\Desktop\213.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\213.exe Process token adjusted: Debug Jump to behavior
Source: 213.exe Binary or memory string: @TaskbarCreatedShell_TrayWndTrayNotifyWndSysPagerToolbarWindow32@@
Source: 213.exe, 00000001.00000002.2647752348.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000002.2649779035.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1369730161.0000000002B94000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: GetProgmanWindow
Source: 213.exe Binary or memory string: Shell_TrayWnd
Source: 213.exe, 00000001.00000002.2647752348.00000000009AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SetProgmanWindow^
Source: 213.exe, 00000001.00000002.2647752348.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000002.2649779035.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, 213.exe, 00000001.00000003.1369730161.0000000002B94000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SetProgmanWindow
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_10019EDC cpuid 1_2_10019EDC
Source: C:\Users\user\Desktop\213.exe Code function: 1_2_0052D6A8 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA, 1_2_0052D6A8
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1559172 Sample: 213.exe Startdate: 20/11/2024 Architecture: WINDOWS Score: 84 24 Multi AV Scanner detection for dropped file 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Machine Learning detection for sample 2->28 30 2 other signatures 2->30 5 213.exe 1 23 2->5         started        10 213.exe 14 2->10         started        process3 dnsIp4 22 42.193.100.57, 49755, 49756, 49851 LILLY-ASUS China 5->22 12 C:\Users\user\Desktop\QQWER.dll, PE32 5->12 dropped 14 C:\Users\user\AppData\Local\Temp\619216.tmp, PE32 5->14 dropped 16 C:\Users\user\AppData\Local\Temp\6191a9.tmp, PE32 5->16 dropped 32 Detected unpacking (creates a PE file in dynamic memory) 5->32 34 Found evasive API chain (may stop execution after checking mutex) 5->34 36 Renames NTDLL to bypass HIPS 5->36 18 C:\Users\user\AppData\Local\Temp\61d1bf.tmp, PE32 10->18 dropped 20 C:\Users\user\AppData\Local\Temp\61d161.tmp, PE32 10->20 dropped file5 signatures6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
42.193.100.57
 unknown China
4249 LILLY-ASUS false

Contacted Domains

Name IP Active
s-part-0017.t-0009.t-msedge.net 13.107.246.45 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://42.193.100.57/%E5%AD%98%E6%A1%A3/.txt false
  • Avira URL Cloud: safe
 unknown
http://42.193.100.57/%E8%87%AA%E5%B7%B1%E7%9A%84%E6%A1%A3.txt false
  • Avira URL Cloud: safe
 unknown