Windows Analysis Report
HIRE SOA FOR DEC_2021.exe

Overview

General Information

Sample Name: HIRE SOA FOR DEC_2021.exe
Analysis ID: 562107
MD5: d8af2363d5a46336733b6121c0b4cf0e
SHA1: fcb0ee44436230d924b2550fc9935ee76f2498fe
SHA256: 2a4415721925c12ce8a80719697ffbda5daf88fe34804b0549bc5d5605790cdb
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Machine Learning detection for sample
Self deletion via cmd delete
Injects a PE file into a foreign processes
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses ipconfig to lookup or modify the Windows network settings
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.littlesportsacademy.com/cxep/"], "decoy": ["estateglobal.info", "loransstore.com", "loginofy.com", "fjallravenz.online", "cefseguranca-app.com", "safontadiestramiento.com", "bubbleteapro.com", "morethanmummies.com", "serviciopersonalizadoweb.com", "headerbidder.info", "skworkforce.com", "heightsorthodontics.com", "chulavistapd.com", "southjerseyautobody.net", "chargedbygratitude.com", "meltingpotspot.com", "gdjiachen.com", "luckdrawprogram.com", "vintagepaseo.com", "bequestslojyh.xyz", "layeredrofbes.xyz", "com-weekly.email", "suddisaddu.com", "jnlord.com", "outerverse.ventures", "terraroyale.com", "hairclub.info", "rent2owninusa.com", "pmaonline.xyz", "wearecampo.com", "multiplezonesplit.com", "angry-mandala.com", "ikigaiofficial.store", "princewoodwork.store", "moviesaver24.com", "btec-solutions.com", "valurgrayenterprises.com", "homesofsilverspur.com", "leysy-y-nazareno.com", "grade8.tech", "ammarus.com", "researchjournal.net", "nicolaslacasse.com", "khukhuantainha.com", "resultlv.com", "toraportal.com", "wickedhunterworld.com", "clickspromolp.com", "b148tlrnd09ustnnaku2721.com", "high-low-ga.info", "norcalfirewoodllc.com", "fatima2021.com", "aaronsmathquest.com", "decal-mania.com", "spitfiredefenceindustries.com", "mireyita.com", "simonhaidomous.com", "roofingcontractorhickory.com", "mgav69.xyz", "spacebymeghan.com", "hot144.com", "mmfirewood.net", "akshayaasri.com", "bilgisayarimnekadar.com"]}
Multi AV Scanner detection for submitted file
Source: HIRE SOA FOR DEC_2021.exe Virustotal: Detection: 41% Perma Link
Source: HIRE SOA FOR DEC_2021.exe ReversingLabs: Detection: 37%
Yara detected FormBook
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.fjallravenz.online/cxep/?oL08qf=sGuO4U2D4QpvxfM4Tie03jNQ5o3Udlnj3BRVJisDJxm1gCdwebUZDD2ARlBl478rs+gp&r4e=MFQPj4OXxHZ8i Avira URL Cloud: Label: phishing
Source: http://www.simonhaidomous.com/cxep/?oL08qf=UgSNVuZrhE3Z8z0ZgFZcy2vBLKCwBFY+sTDX0qorCT9gsCOpfKa0UREUH3qfIqk5g45k&r4e=MFQPj4OXxHZ8i Avira URL Cloud: Label: malware
Source: www.littlesportsacademy.com/cxep/ Avira URL Cloud: Label: malware
Source: http://www.spacebymeghan.com/cxep/?oL08qf=ptEMQJ9wcGHn8Y3e8b7dTbimCX2/D160Z9ziomc9eLzNI2egxKU0hugwHCLO4F78raSg&r4e=MFQPj4OXxHZ8i Avira URL Cloud: Label: malware
Source: http://www.akshayaasri.com/cxep/?oL08qf=Byxtzwy9R0GD0IyvX+TGY0P09qT9QyNZPQIOfaNvzxOEg7PFqVlYKXle2hnRLry+JL4w&r4e=MFQPj4OXxHZ8i Avira URL Cloud: Label: malware
Source: http://www.morethanmummies.com/cxep/?oL08qf=PktwisKIh9eqiZaZPdqfCAueqx7lopJ2FQkTMDOUcG0hgTiBceSgN5Z4VAFzyceEWpkB&r4e=MFQPj4OXxHZ8i Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: HIRE SOA FOR DEC_2021.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.1.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.2.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.3.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.2.ipconfig.exe.325796c.4.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.2.ipconfig.exe.28f11e8.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance
barindex
Uses 32bit PE files
Source: HIRE SOA FOR DEC_2021.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: ipconfig.pdb source: HIRE SOA FOR DEC_2021.exe, 00000003.00000002.728290163.0000000002610000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: ipconfig.pdbGCTL source: HIRE SOA FOR DEC_2021.exe, 00000003.00000002.728290163.0000000002610000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: HIRE SOA FOR DEC_2021.exe, 00000001.00000003.662712540.000000001AE50000.00000004.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000001.00000003.664381253.000000001ACC0000.00000004.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727670079.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727845226.0000000000C3F000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000008.00000002.924248760.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000008.00000002.924431470.0000000002E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: HIRE SOA FOR DEC_2021.exe, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727670079.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727845226.0000000000C3F000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, ipconfig.exe, 00000008.00000002.924248760.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000008.00000002.924431470.0000000002E3F000.00000040.00000800.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00405D7C FindFirstFileA,FindClose, 1_2_00405D7C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 1_2_004053AA
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00402630 FindFirstFileA, 1_2_00402630

Networking
barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49795 -> 15.197.142.173:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49795 -> 15.197.142.173:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49795 -> 15.197.142.173:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49800 -> 154.212.212.21:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49800 -> 154.212.212.21:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49800 -> 154.212.212.21:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49827 -> 142.250.203.115:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49827 -> 142.250.203.115:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49827 -> 142.250.203.115:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.estateglobal.info
Source: C:\Windows\explorer.exe Network Connect: 212.1.210.76 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 160.153.136.3 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 104.21.86.185 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.com-weekly.email
Source: C:\Windows\explorer.exe Domain query: www.mmfirewood.net
Source: C:\Windows\explorer.exe Network Connect: 52.6.230.169 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.akshayaasri.com
Source: C:\Windows\explorer.exe Domain query: www.fjallravenz.online
Source: C:\Windows\explorer.exe Domain query: www.morethanmummies.com
Source: C:\Windows\explorer.exe Domain query: www.simonhaidomous.com
Source: C:\Windows\explorer.exe Network Connect: 154.212.212.21 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.spacebymeghan.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.littlesportsacademy.com/cxep/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-HOSTINGERLT AS-HOSTINGERLT
Source: Joe Sandbox View ASN Name: GODADDY-AMSDE GODADDY-AMSDE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=sGuO4U2D4QpvxfM4Tie03jNQ5o3Udlnj3BRVJisDJxm1gCdwebUZDD2ARlBl478rs+gp&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.fjallravenz.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=tKr7e/ysfkFa3UQ2/S4tB4cSlqebmf+Bdoeimz8jp9iwh3bj6jf6wnxNjQM++WQWQx0o&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.mmfirewood.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=UgSNVuZrhE3Z8z0ZgFZcy2vBLKCwBFY+sTDX0qorCT9gsCOpfKa0UREUH3qfIqk5g45k&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.simonhaidomous.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=ptEMQJ9wcGHn8Y3e8b7dTbimCX2/D160Z9ziomc9eLzNI2egxKU0hugwHCLO4F78raSg&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.spacebymeghan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=Byxtzwy9R0GD0IyvX+TGY0P09qT9QyNZPQIOfaNvzxOEg7PFqVlYKXle2hnRLry+JL4w&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.akshayaasri.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=PktwisKIh9eqiZaZPdqfCAueqx7lopJ2FQkTMDOUcG0hgTiBceSgN5Z4VAFzyceEWpkB&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.morethanmummies.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=PktwisKIh9eqiZaZPdqfCAueqx7lopJ2FQkTMDOUcG0hgTiBceSgN5Z4VAFzyceEWpkB&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.morethanmummies.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 160.153.136.3 160.153.136.3
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Fri, 28 Jan 2022 12:43:52 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Fri, 28 Jan 2022 12:43:58 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72
Source: HIRE SOA FOR DEC_2021.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: HIRE SOA FOR DEC_2021.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ipconfig.exe, 00000008.00000002.924948301.00000000033D2000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.litespeedtech.com/error-page
Source: ipconfig.exe, 00000008.00000002.924948301.00000000033D2000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: unknown DNS traffic detected: queries for: www.fjallravenz.online
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=sGuO4U2D4QpvxfM4Tie03jNQ5o3Udlnj3BRVJisDJxm1gCdwebUZDD2ARlBl478rs+gp&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.fjallravenz.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=tKr7e/ysfkFa3UQ2/S4tB4cSlqebmf+Bdoeimz8jp9iwh3bj6jf6wnxNjQM++WQWQx0o&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.mmfirewood.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=UgSNVuZrhE3Z8z0ZgFZcy2vBLKCwBFY+sTDX0qorCT9gsCOpfKa0UREUH3qfIqk5g45k&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.simonhaidomous.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=ptEMQJ9wcGHn8Y3e8b7dTbimCX2/D160Z9ziomc9eLzNI2egxKU0hugwHCLO4F78raSg&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.spacebymeghan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=Byxtzwy9R0GD0IyvX+TGY0P09qT9QyNZPQIOfaNvzxOEg7PFqVlYKXle2hnRLry+JL4w&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.akshayaasri.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=PktwisKIh9eqiZaZPdqfCAueqx7lopJ2FQkTMDOUcG0hgTiBceSgN5Z4VAFzyceEWpkB&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.morethanmummies.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /cxep/?oL08qf=PktwisKIh9eqiZaZPdqfCAueqx7lopJ2FQkTMDOUcG0hgTiBceSgN5Z4VAFzyceEWpkB&r4e=MFQPj4OXxHZ8i HTTP/1.1Host: www.morethanmummies.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00404F61 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_00404F61

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: HIRE SOA FOR DEC_2021.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 1_2_00403225
Detected potential crypto function
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_0040604C 1_2_0040604C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00404772 1_2_00404772
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_1AC70A17 1_2_1AC70A17
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041B8D6 3_2_0041B8D6
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041D2C0 3_2_0041D2C0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041CC12 3_2_0041CC12
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00408C90 3_2_00408C90
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00402D87 3_2_00402D87
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041BE25 3_2_0041BE25
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B720A0 3_2_00B720A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5B090 3_2_00B5B090
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C128EC 3_2_00C128EC
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C120A8 3_2_00C120A8
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01002 3_2_00C01002
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C1E824 3_2_00C1E824
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B64120 3_2_00B64120
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4F900 3_2_00B4F900
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C122AE 3_2_00C122AE
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BFFA2B 3_2_00BFFA2B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7EBB0 3_2_00B7EBB0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0DBD2 3_2_00C0DBD2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C003DA 3_2_00C003DA
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C12B28 3_2_00C12B28
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6AB40 3_2_00B6AB40
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0D466 3_2_00C0D466
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5841F 3_2_00B5841F
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C125DD 3_2_00C125DD
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72581 3_2_00B72581
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5D5E0 3_2_00B5D5E0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B40D20 3_2_00B40D20
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C11D55 3_2_00C11D55
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C12D07 3_2_00C12D07
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C12EF7 3_2_00C12EF7
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B66E30 3_2_00B66E30
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0D616 3_2_00C0D616
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C1DFCE 3_2_00C1DFCE
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C11FF1 3_2_00C11FF1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E122AE 8_2_02E122AE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DFFA2B 8_2_02DFFA2B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0DBD2 8_2_02E0DBD2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E003DA 8_2_02E003DA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7EBB0 8_2_02D7EBB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6AB40 8_2_02D6AB40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E12B28 8_2_02E12B28
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E128EC 8_2_02E128EC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5B090 8_2_02D5B090
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E120A8 8_2_02E120A8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D720A0 8_2_02D720A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E1E824 8_2_02E1E824
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E01002 8_2_02E01002
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A830 8_2_02D6A830
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4F900 8_2_02D4F900
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D64120 8_2_02D64120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E12EF7 8_2_02E12EF7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D66E30 8_2_02D66E30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0D616 8_2_02E0D616
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E11FF1 8_2_02E11FF1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E1DFCE 8_2_02E1DFCE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0D466 8_2_02E0D466
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5841F 8_2_02D5841F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5D5E0 8_2_02D5D5E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E125DD 8_2_02E125DD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D72581 8_2_02D72581
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E11D55 8_2_02E11D55
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E12D07 8_2_02E12D07
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D40D20 8_2_02D40D20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265B8D6 8_2_0265B8D6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265BE25 8_2_0265BE25
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02642FB0 8_2_02642FB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265CC12 8_2_0265CC12
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02648C90 8_2_02648C90
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02642D87 8_2_02642D87
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02642D90 8_2_02642D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 02D4B150 appears 72 times
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: String function: 00B4B150 appears 48 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_004185F0 NtCreateFile, 3_2_004185F0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_004186A0 NtReadFile, 3_2_004186A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00418720 NtClose, 3_2_00418720
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_004187D0 NtAllocateVirtualMemory, 3_2_004187D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041869A NtReadFile, 3_2_0041869A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041871A NtClose, 3_2_0041871A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_004187CA NtAllocateVirtualMemory, 3_2_004187CA
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B898F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_00B898F0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_00B89860
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89840 NtDelayExecution,LdrInitializeThunk, 3_2_00B89840
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B899A0 NtCreateSection,LdrInitializeThunk, 3_2_00B899A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_00B89910
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89A20 NtResumeThread,LdrInitializeThunk, 3_2_00B89A20
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_00B89A00
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89A50 NtCreateFile,LdrInitializeThunk, 3_2_00B89A50
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B895D0 NtClose,LdrInitializeThunk, 3_2_00B895D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89540 NtReadFile,LdrInitializeThunk, 3_2_00B89540
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B896E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_00B896E0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_00B89660
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B897A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_00B897A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89780 NtMapViewOfSection,LdrInitializeThunk, 3_2_00B89780
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89FE0 NtCreateMutant,LdrInitializeThunk, 3_2_00B89FE0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89710 NtQueryInformationToken,LdrInitializeThunk, 3_2_00B89710
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B898A0 NtWriteVirtualMemory, 3_2_00B898A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89820 NtEnumerateKey, 3_2_00B89820
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B8B040 NtSuspendThread, 3_2_00B8B040
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B899D0 NtCreateProcessEx, 3_2_00B899D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89950 NtQueueApcThread, 3_2_00B89950
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89A80 NtOpenDirectoryObject, 3_2_00B89A80
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89A10 NtQuerySection, 3_2_00B89A10
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B8A3B0 NtGetContextThread, 3_2_00B8A3B0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89B00 NtSetValueKey, 3_2_00B89B00
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B895F0 NtQueryInformationFile, 3_2_00B895F0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B8AD30 NtSetContextThread, 3_2_00B8AD30
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89520 NtWaitForSingleObject, 3_2_00B89520
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89560 NtWriteFile, 3_2_00B89560
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B896D0 NtCreateKey, 3_2_00B896D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89610 NtEnumerateValueKey, 3_2_00B89610
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89670 NtQueryInformationProcess, 3_2_00B89670
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89650 NtQueryValueKey, 3_2_00B89650
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89730 NtQueryVirtualMemory, 3_2_00B89730
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B8A710 NtOpenProcessToken, 3_2_00B8A710
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89770 NtSetInformationFile, 3_2_00B89770
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B8A770 NtOpenThread, 3_2_00B8A770
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B89760 NtOpenProcess, 3_2_00B89760
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89A50 NtCreateFile,LdrInitializeThunk, 8_2_02D89A50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89840 NtDelayExecution,LdrInitializeThunk, 8_2_02D89840
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89860 NtQuerySystemInformation,LdrInitializeThunk, 8_2_02D89860
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D899A0 NtCreateSection,LdrInitializeThunk, 8_2_02D899A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89910 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_02D89910
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D896D0 NtCreateKey,LdrInitializeThunk, 8_2_02D896D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D896E0 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_02D896E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89FE0 NtCreateMutant,LdrInitializeThunk, 8_2_02D89FE0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89780 NtMapViewOfSection,LdrInitializeThunk, 8_2_02D89780
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89710 NtQueryInformationToken,LdrInitializeThunk, 8_2_02D89710
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D895D0 NtClose,LdrInitializeThunk, 8_2_02D895D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89540 NtReadFile,LdrInitializeThunk, 8_2_02D89540
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89A80 NtOpenDirectoryObject, 8_2_02D89A80
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89A10 NtQuerySection, 8_2_02D89A10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89A00 NtProtectVirtualMemory, 8_2_02D89A00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89A20 NtResumeThread, 8_2_02D89A20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D8A3B0 NtGetContextThread, 8_2_02D8A3B0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89B00 NtSetValueKey, 8_2_02D89B00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D898F0 NtReadVirtualMemory, 8_2_02D898F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D898A0 NtWriteVirtualMemory, 8_2_02D898A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D8B040 NtSuspendThread, 8_2_02D8B040
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89820 NtEnumerateKey, 8_2_02D89820
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D899D0 NtCreateProcessEx, 8_2_02D899D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89950 NtQueueApcThread, 8_2_02D89950
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89650 NtQueryValueKey, 8_2_02D89650
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89670 NtQueryInformationProcess, 8_2_02D89670
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89660 NtAllocateVirtualMemory, 8_2_02D89660
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89610 NtEnumerateValueKey, 8_2_02D89610
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D897A0 NtUnmapViewOfSection, 8_2_02D897A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D8A770 NtOpenThread, 8_2_02D8A770
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89770 NtSetInformationFile, 8_2_02D89770
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89760 NtOpenProcess, 8_2_02D89760
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D8A710 NtOpenProcessToken, 8_2_02D8A710
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89730 NtQueryVirtualMemory, 8_2_02D89730
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D895F0 NtQueryInformationFile, 8_2_02D895F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89560 NtWriteFile, 8_2_02D89560
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D8AD30 NtSetContextThread, 8_2_02D8AD30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D89520 NtWaitForSingleObject, 8_2_02D89520
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_026586A0 NtReadFile, 8_2_026586A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02658720 NtClose, 8_2_02658720
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_026585F0 NtCreateFile, 8_2_026585F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265869A NtReadFile, 8_2_0265869A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265871A NtClose, 8_2_0265871A
Sample file is different than original file name gathered from version info
Source: HIRE SOA FOR DEC_2021.exe, 00000001.00000003.667915341.000000001ADD6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs HIRE SOA FOR DEC_2021.exe
Source: HIRE SOA FOR DEC_2021.exe, 00000001.00000003.663941940.000000001AF6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs HIRE SOA FOR DEC_2021.exe
Source: HIRE SOA FOR DEC_2021.exe, 00000003.00000002.728301001.0000000002617000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameipconfig.exej% vs HIRE SOA FOR DEC_2021.exe
Source: HIRE SOA FOR DEC_2021.exe, 00000003.00000002.728211881.0000000000DCF000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs HIRE SOA FOR DEC_2021.exe
Source: HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727845226.0000000000C3F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs HIRE SOA FOR DEC_2021.exe
Source: HIRE SOA FOR DEC_2021.exe Virustotal: Detection: 41%
Source: HIRE SOA FOR DEC_2021.exe ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe File read: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Jump to behavior
Source: HIRE SOA FOR DEC_2021.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe"
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Process created: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Process created: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe" Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe" Jump to behavior
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe File created: C:\Users\user\AppData\Local\Temp\nslEC77.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/4@11/6
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00402012 CoCreateInstance,MultiByteToWideChar, 1_2_00402012
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 1_2_00404275
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5736:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Binary string: ipconfig.pdb source: HIRE SOA FOR DEC_2021.exe, 00000003.00000002.728290163.0000000002610000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: ipconfig.pdbGCTL source: HIRE SOA FOR DEC_2021.exe, 00000003.00000002.728290163.0000000002610000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: HIRE SOA FOR DEC_2021.exe, 00000001.00000003.662712540.000000001AE50000.00000004.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000001.00000003.664381253.000000001ACC0000.00000004.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727670079.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727845226.0000000000C3F000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000008.00000002.924248760.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000008.00000002.924431470.0000000002E3F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: HIRE SOA FOR DEC_2021.exe, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727670079.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, HIRE SOA FOR DEC_2021.exe, 00000003.00000002.727845226.0000000000C3F000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, ipconfig.exe, 00000008.00000002.924248760.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, ipconfig.exe, 00000008.00000002.924431470.0000000002E3F000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041B048 push eax; iretd 3_2_0041B04B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041B832 push eax; ret 3_2_0041B838
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041B83B push eax; ret 3_2_0041B8A2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041B89C push eax; ret 3_2_0041B8A2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00415B24 push ecx; ret 3_2_00415B69
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00415E10 push ebx; retf 3_2_00415E13
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_0041B7E5 push eax; ret 3_2_0041B838
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B9D0D1 push ecx; ret 3_2_00B9D0E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D9D0D1 push ecx; ret 8_2_02D9D0E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02655B24 push ecx; ret 8_2_02655B69
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265B048 push eax; iretd 8_2_0265B04B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265B832 push eax; ret 8_2_0265B838
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265B83B push eax; ret 8_2_0265B8A2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265B89C push eax; ret 8_2_0265B8A2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02655E10 push ebx; retf 8_2_02655E13
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_0265B7E5 push eax; ret 8_2_0265B838
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress, 1_2_00405DA3

Persistence and Installation Behavior
barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Drops PE files
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe File created: C:\Users\user\AppData\Local\Temp\nslEC79.tmp\sdxajjgxerh.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: /c del "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe"
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: /c del "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe" Jump to behavior
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 0000000002648614 second address: 000000000264861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 00000000026489AE second address: 00000000026489B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 7116 Thread sleep time: -35000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe TID: 4228 Thread sleep time: -36000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_004088E0 rdtsc 3_2_004088E0
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe API coverage: 8.5 %
Source: C:\Windows\SysWOW64\ipconfig.exe API coverage: 7.5 %
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00405D7C FindFirstFileA,FindClose, 1_2_00405D7C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 1_2_004053AA
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00402630 FindFirstFileA, 1_2_00402630
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000005.00000000.679147166.000000000A60E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.708371216.0000000006650000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.679147166.000000000A60E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.673990651.0000000004710000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.688116349.0000000004791000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_SATA~
Source: explorer.exe, 00000005.00000000.679317249.000000000A716000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.679551971.000000000A784000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@

Anti Debugging
barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress, 1_2_00405DA3
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_004088E0 rdtsc 3_2_004088E0
Enables debug privileges
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_1AC70402 mov eax, dword ptr fs:[00000030h] 1_2_1AC70402
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_1AC706C7 mov eax, dword ptr fs:[00000030h] 1_2_1AC706C7
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_1AC70744 mov eax, dword ptr fs:[00000030h] 1_2_1AC70744
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_1AC70706 mov eax, dword ptr fs:[00000030h] 1_2_1AC70706
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_1AC70616 mov eax, dword ptr fs:[00000030h] 1_2_1AC70616
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7F0BF mov ecx, dword ptr fs:[00000030h] 3_2_00B7F0BF
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7F0BF mov eax, dword ptr fs:[00000030h] 3_2_00B7F0BF
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7F0BF mov eax, dword ptr fs:[00000030h] 3_2_00B7F0BF
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B890AF mov eax, dword ptr fs:[00000030h] 3_2_00B890AF
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B720A0 mov eax, dword ptr fs:[00000030h] 3_2_00B720A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B720A0 mov eax, dword ptr fs:[00000030h] 3_2_00B720A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B720A0 mov eax, dword ptr fs:[00000030h] 3_2_00B720A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B720A0 mov eax, dword ptr fs:[00000030h] 3_2_00B720A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B720A0 mov eax, dword ptr fs:[00000030h] 3_2_00B720A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B720A0 mov eax, dword ptr fs:[00000030h] 3_2_00B720A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49080 mov eax, dword ptr fs:[00000030h] 3_2_00B49080
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC3884 mov eax, dword ptr fs:[00000030h] 3_2_00BC3884
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC3884 mov eax, dword ptr fs:[00000030h] 3_2_00BC3884
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B440E1 mov eax, dword ptr fs:[00000030h] 3_2_00B440E1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B440E1 mov eax, dword ptr fs:[00000030h] 3_2_00B440E1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B440E1 mov eax, dword ptr fs:[00000030h] 3_2_00B440E1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B458EC mov eax, dword ptr fs:[00000030h] 3_2_00B458EC
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BDB8D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDB8D0 mov ecx, dword ptr fs:[00000030h] 3_2_00BDB8D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BDB8D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BDB8D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BDB8D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BDB8D0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7002D mov eax, dword ptr fs:[00000030h] 3_2_00B7002D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7002D mov eax, dword ptr fs:[00000030h] 3_2_00B7002D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7002D mov eax, dword ptr fs:[00000030h] 3_2_00B7002D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7002D mov eax, dword ptr fs:[00000030h] 3_2_00B7002D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7002D mov eax, dword ptr fs:[00000030h] 3_2_00B7002D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5B02A mov eax, dword ptr fs:[00000030h] 3_2_00B5B02A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5B02A mov eax, dword ptr fs:[00000030h] 3_2_00B5B02A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5B02A mov eax, dword ptr fs:[00000030h] 3_2_00B5B02A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5B02A mov eax, dword ptr fs:[00000030h] 3_2_00B5B02A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC7016 mov eax, dword ptr fs:[00000030h] 3_2_00BC7016
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC7016 mov eax, dword ptr fs:[00000030h] 3_2_00BC7016
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC7016 mov eax, dword ptr fs:[00000030h] 3_2_00BC7016
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C02073 mov eax, dword ptr fs:[00000030h] 3_2_00C02073
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C11074 mov eax, dword ptr fs:[00000030h] 3_2_00C11074
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C14015 mov eax, dword ptr fs:[00000030h] 3_2_00C14015
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C14015 mov eax, dword ptr fs:[00000030h] 3_2_00C14015
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B60050 mov eax, dword ptr fs:[00000030h] 3_2_00B60050
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B60050 mov eax, dword ptr fs:[00000030h] 3_2_00B60050
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC51BE mov eax, dword ptr fs:[00000030h] 3_2_00BC51BE
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC51BE mov eax, dword ptr fs:[00000030h] 3_2_00BC51BE
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC51BE mov eax, dword ptr fs:[00000030h] 3_2_00BC51BE
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC51BE mov eax, dword ptr fs:[00000030h] 3_2_00BC51BE
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B761A0 mov eax, dword ptr fs:[00000030h] 3_2_00B761A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B761A0 mov eax, dword ptr fs:[00000030h] 3_2_00B761A0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC69A6 mov eax, dword ptr fs:[00000030h] 3_2_00BC69A6
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72990 mov eax, dword ptr fs:[00000030h] 3_2_00B72990
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7A185 mov eax, dword ptr fs:[00000030h] 3_2_00B7A185
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6C182 mov eax, dword ptr fs:[00000030h] 3_2_00B6C182
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00B4B1E1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00B4B1E1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00B4B1E1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BD41E8 mov eax, dword ptr fs:[00000030h] 3_2_00BD41E8
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C049A4 mov eax, dword ptr fs:[00000030h] 3_2_00C049A4
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C049A4 mov eax, dword ptr fs:[00000030h] 3_2_00C049A4
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C049A4 mov eax, dword ptr fs:[00000030h] 3_2_00C049A4
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C049A4 mov eax, dword ptr fs:[00000030h] 3_2_00C049A4
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7513A mov eax, dword ptr fs:[00000030h] 3_2_00B7513A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7513A mov eax, dword ptr fs:[00000030h] 3_2_00B7513A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B64120 mov eax, dword ptr fs:[00000030h] 3_2_00B64120
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B64120 mov eax, dword ptr fs:[00000030h] 3_2_00B64120
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B64120 mov eax, dword ptr fs:[00000030h] 3_2_00B64120
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B64120 mov eax, dword ptr fs:[00000030h] 3_2_00B64120
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B64120 mov ecx, dword ptr fs:[00000030h] 3_2_00B64120
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49100 mov eax, dword ptr fs:[00000030h] 3_2_00B49100
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49100 mov eax, dword ptr fs:[00000030h] 3_2_00B49100
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49100 mov eax, dword ptr fs:[00000030h] 3_2_00B49100
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4B171 mov eax, dword ptr fs:[00000030h] 3_2_00B4B171
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4B171 mov eax, dword ptr fs:[00000030h] 3_2_00B4B171
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4C962 mov eax, dword ptr fs:[00000030h] 3_2_00B4C962
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6B944 mov eax, dword ptr fs:[00000030h] 3_2_00B6B944
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6B944 mov eax, dword ptr fs:[00000030h] 3_2_00B6B944
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5AAB0 mov eax, dword ptr fs:[00000030h] 3_2_00B5AAB0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5AAB0 mov eax, dword ptr fs:[00000030h] 3_2_00B5AAB0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7FAB0 mov eax, dword ptr fs:[00000030h] 3_2_00B7FAB0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B452A5 mov eax, dword ptr fs:[00000030h] 3_2_00B452A5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B452A5 mov eax, dword ptr fs:[00000030h] 3_2_00B452A5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B452A5 mov eax, dword ptr fs:[00000030h] 3_2_00B452A5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B452A5 mov eax, dword ptr fs:[00000030h] 3_2_00B452A5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B452A5 mov eax, dword ptr fs:[00000030h] 3_2_00B452A5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7D294 mov eax, dword ptr fs:[00000030h] 3_2_00B7D294
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7D294 mov eax, dword ptr fs:[00000030h] 3_2_00B7D294
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72AE4 mov eax, dword ptr fs:[00000030h] 3_2_00B72AE4
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72ACB mov eax, dword ptr fs:[00000030h] 3_2_00B72ACB
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B84A2C mov eax, dword ptr fs:[00000030h] 3_2_00B84A2C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B84A2C mov eax, dword ptr fs:[00000030h] 3_2_00B84A2C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0EA55 mov eax, dword ptr fs:[00000030h] 3_2_00C0EA55
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6A229 mov eax, dword ptr fs:[00000030h] 3_2_00B6A229
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4AA16 mov eax, dword ptr fs:[00000030h] 3_2_00B4AA16
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4AA16 mov eax, dword ptr fs:[00000030h] 3_2_00B4AA16
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C18A62 mov eax, dword ptr fs:[00000030h] 3_2_00C18A62
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B45210 mov eax, dword ptr fs:[00000030h] 3_2_00B45210
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B45210 mov ecx, dword ptr fs:[00000030h] 3_2_00B45210
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B45210 mov eax, dword ptr fs:[00000030h] 3_2_00B45210
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B45210 mov eax, dword ptr fs:[00000030h] 3_2_00B45210
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B63A1C mov eax, dword ptr fs:[00000030h] 3_2_00B63A1C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B58A0A mov eax, dword ptr fs:[00000030h] 3_2_00B58A0A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B8927A mov eax, dword ptr fs:[00000030h] 3_2_00B8927A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0AA16 mov eax, dword ptr fs:[00000030h] 3_2_00C0AA16
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0AA16 mov eax, dword ptr fs:[00000030h] 3_2_00C0AA16
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BFB260 mov eax, dword ptr fs:[00000030h] 3_2_00BFB260
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BFB260 mov eax, dword ptr fs:[00000030h] 3_2_00BFB260
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BD4257 mov eax, dword ptr fs:[00000030h] 3_2_00BD4257
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49240 mov eax, dword ptr fs:[00000030h] 3_2_00B49240
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49240 mov eax, dword ptr fs:[00000030h] 3_2_00B49240
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49240 mov eax, dword ptr fs:[00000030h] 3_2_00B49240
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B49240 mov eax, dword ptr fs:[00000030h] 3_2_00B49240
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B74BAD mov eax, dword ptr fs:[00000030h] 3_2_00B74BAD
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B74BAD mov eax, dword ptr fs:[00000030h] 3_2_00B74BAD
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B74BAD mov eax, dword ptr fs:[00000030h] 3_2_00B74BAD
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72397 mov eax, dword ptr fs:[00000030h] 3_2_00B72397
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7B390 mov eax, dword ptr fs:[00000030h] 3_2_00B7B390
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B51B8F mov eax, dword ptr fs:[00000030h] 3_2_00B51B8F
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B51B8F mov eax, dword ptr fs:[00000030h] 3_2_00B51B8F
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BFD380 mov ecx, dword ptr fs:[00000030h] 3_2_00BFD380
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0138A mov eax, dword ptr fs:[00000030h] 3_2_00C0138A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B703E2 mov eax, dword ptr fs:[00000030h] 3_2_00B703E2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B703E2 mov eax, dword ptr fs:[00000030h] 3_2_00B703E2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B703E2 mov eax, dword ptr fs:[00000030h] 3_2_00B703E2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B703E2 mov eax, dword ptr fs:[00000030h] 3_2_00B703E2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B703E2 mov eax, dword ptr fs:[00000030h] 3_2_00B703E2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B703E2 mov eax, dword ptr fs:[00000030h] 3_2_00B703E2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6DBE9 mov eax, dword ptr fs:[00000030h] 3_2_00B6DBE9
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C15BA5 mov eax, dword ptr fs:[00000030h] 3_2_00C15BA5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC53CA mov eax, dword ptr fs:[00000030h] 3_2_00BC53CA
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC53CA mov eax, dword ptr fs:[00000030h] 3_2_00BC53CA
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C18B58 mov eax, dword ptr fs:[00000030h] 3_2_00C18B58
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B73B7A mov eax, dword ptr fs:[00000030h] 3_2_00B73B7A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B73B7A mov eax, dword ptr fs:[00000030h] 3_2_00B73B7A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4DB60 mov ecx, dword ptr fs:[00000030h] 3_2_00B4DB60
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0131B mov eax, dword ptr fs:[00000030h] 3_2_00C0131B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4F358 mov eax, dword ptr fs:[00000030h] 3_2_00B4F358
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4DB40 mov eax, dword ptr fs:[00000030h] 3_2_00B4DB40
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C18CD6 mov eax, dword ptr fs:[00000030h] 3_2_00C18CD6
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5849B mov eax, dword ptr fs:[00000030h] 3_2_00B5849B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C014FB mov eax, dword ptr fs:[00000030h] 3_2_00C014FB
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6CF0 mov eax, dword ptr fs:[00000030h] 3_2_00BC6CF0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6CF0 mov eax, dword ptr fs:[00000030h] 3_2_00BC6CF0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6CF0 mov eax, dword ptr fs:[00000030h] 3_2_00BC6CF0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7BC2C mov eax, dword ptr fs:[00000030h] 3_2_00B7BC2C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6C0A mov eax, dword ptr fs:[00000030h] 3_2_00BC6C0A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6C0A mov eax, dword ptr fs:[00000030h] 3_2_00BC6C0A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6C0A mov eax, dword ptr fs:[00000030h] 3_2_00BC6C0A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6C0A mov eax, dword ptr fs:[00000030h] 3_2_00BC6C0A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01C06 mov eax, dword ptr fs:[00000030h] 3_2_00C01C06
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C1740D mov eax, dword ptr fs:[00000030h] 3_2_00C1740D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C1740D mov eax, dword ptr fs:[00000030h] 3_2_00C1740D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C1740D mov eax, dword ptr fs:[00000030h] 3_2_00C1740D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6746D mov eax, dword ptr fs:[00000030h] 3_2_00B6746D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDC450 mov eax, dword ptr fs:[00000030h] 3_2_00BDC450
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDC450 mov eax, dword ptr fs:[00000030h] 3_2_00BDC450
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7A44B mov eax, dword ptr fs:[00000030h] 3_2_00B7A44B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B71DB5 mov eax, dword ptr fs:[00000030h] 3_2_00B71DB5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B71DB5 mov eax, dword ptr fs:[00000030h] 3_2_00B71DB5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B71DB5 mov eax, dword ptr fs:[00000030h] 3_2_00B71DB5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B735A1 mov eax, dword ptr fs:[00000030h] 3_2_00B735A1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00C0FDE2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00C0FDE2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00C0FDE2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00C0FDE2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7FD9B mov eax, dword ptr fs:[00000030h] 3_2_00B7FD9B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7FD9B mov eax, dword ptr fs:[00000030h] 3_2_00B7FD9B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72581 mov eax, dword ptr fs:[00000030h] 3_2_00B72581
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72581 mov eax, dword ptr fs:[00000030h] 3_2_00B72581
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72581 mov eax, dword ptr fs:[00000030h] 3_2_00B72581
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B72581 mov eax, dword ptr fs:[00000030h] 3_2_00B72581
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B42D8A mov eax, dword ptr fs:[00000030h] 3_2_00B42D8A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B42D8A mov eax, dword ptr fs:[00000030h] 3_2_00B42D8A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B42D8A mov eax, dword ptr fs:[00000030h] 3_2_00B42D8A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B42D8A mov eax, dword ptr fs:[00000030h] 3_2_00B42D8A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B42D8A mov eax, dword ptr fs:[00000030h] 3_2_00B42D8A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BF8DF1 mov eax, dword ptr fs:[00000030h] 3_2_00BF8DF1
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5D5E0 mov eax, dword ptr fs:[00000030h] 3_2_00B5D5E0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5D5E0 mov eax, dword ptr fs:[00000030h] 3_2_00B5D5E0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C105AC mov eax, dword ptr fs:[00000030h] 3_2_00C105AC
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C105AC mov eax, dword ptr fs:[00000030h] 3_2_00C105AC
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_00BC6DC9
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_00BC6DC9
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_00BC6DC9
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6DC9 mov ecx, dword ptr fs:[00000030h] 3_2_00BC6DC9
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_00BC6DC9
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC6DC9 mov eax, dword ptr fs:[00000030h] 3_2_00BC6DC9
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B53D34 mov eax, dword ptr fs:[00000030h] 3_2_00B53D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4AD30 mov eax, dword ptr fs:[00000030h] 3_2_00B4AD30
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BCA537 mov eax, dword ptr fs:[00000030h] 3_2_00BCA537
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B74D3B mov eax, dword ptr fs:[00000030h] 3_2_00B74D3B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B74D3B mov eax, dword ptr fs:[00000030h] 3_2_00B74D3B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B74D3B mov eax, dword ptr fs:[00000030h] 3_2_00B74D3B
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6C577 mov eax, dword ptr fs:[00000030h] 3_2_00B6C577
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6C577 mov eax, dword ptr fs:[00000030h] 3_2_00B6C577
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B67D50 mov eax, dword ptr fs:[00000030h] 3_2_00B67D50
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C18D34 mov eax, dword ptr fs:[00000030h] 3_2_00C18D34
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0E539 mov eax, dword ptr fs:[00000030h] 3_2_00C0E539
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B83D43 mov eax, dword ptr fs:[00000030h] 3_2_00B83D43
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC3540 mov eax, dword ptr fs:[00000030h] 3_2_00BC3540
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BF3D40 mov eax, dword ptr fs:[00000030h] 3_2_00BF3D40
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C18ED6 mov eax, dword ptr fs:[00000030h] 3_2_00C18ED6
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC46A7 mov eax, dword ptr fs:[00000030h] 3_2_00BC46A7
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDFE87 mov eax, dword ptr fs:[00000030h] 3_2_00BDFE87
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B716E0 mov ecx, dword ptr fs:[00000030h] 3_2_00B716E0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B576E2 mov eax, dword ptr fs:[00000030h] 3_2_00B576E2
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C10EA5 mov eax, dword ptr fs:[00000030h] 3_2_00C10EA5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C10EA5 mov eax, dword ptr fs:[00000030h] 3_2_00C10EA5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C10EA5 mov eax, dword ptr fs:[00000030h] 3_2_00C10EA5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B736CC mov eax, dword ptr fs:[00000030h] 3_2_00B736CC
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BFFEC0 mov eax, dword ptr fs:[00000030h] 3_2_00BFFEC0
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B88EC7 mov eax, dword ptr fs:[00000030h] 3_2_00B88EC7
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BFFE3F mov eax, dword ptr fs:[00000030h] 3_2_00BFFE3F
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0AE44 mov eax, dword ptr fs:[00000030h] 3_2_00C0AE44
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C0AE44 mov eax, dword ptr fs:[00000030h] 3_2_00C0AE44
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4E620 mov eax, dword ptr fs:[00000030h] 3_2_00B4E620
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7A61C mov eax, dword ptr fs:[00000030h] 3_2_00B7A61C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7A61C mov eax, dword ptr fs:[00000030h] 3_2_00B7A61C
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4C600 mov eax, dword ptr fs:[00000030h] 3_2_00B4C600
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4C600 mov eax, dword ptr fs:[00000030h] 3_2_00B4C600
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B4C600 mov eax, dword ptr fs:[00000030h] 3_2_00B4C600
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B78E00 mov eax, dword ptr fs:[00000030h] 3_2_00B78E00
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6AE73 mov eax, dword ptr fs:[00000030h] 3_2_00B6AE73
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6AE73 mov eax, dword ptr fs:[00000030h] 3_2_00B6AE73
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6AE73 mov eax, dword ptr fs:[00000030h] 3_2_00B6AE73
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6AE73 mov eax, dword ptr fs:[00000030h] 3_2_00B6AE73
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6AE73 mov eax, dword ptr fs:[00000030h] 3_2_00B6AE73
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C01608 mov eax, dword ptr fs:[00000030h] 3_2_00C01608
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5766D mov eax, dword ptr fs:[00000030h] 3_2_00B5766D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B57E41 mov eax, dword ptr fs:[00000030h] 3_2_00B57E41
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B57E41 mov eax, dword ptr fs:[00000030h] 3_2_00B57E41
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B57E41 mov eax, dword ptr fs:[00000030h] 3_2_00B57E41
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B57E41 mov eax, dword ptr fs:[00000030h] 3_2_00B57E41
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B57E41 mov eax, dword ptr fs:[00000030h] 3_2_00B57E41
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B57E41 mov eax, dword ptr fs:[00000030h] 3_2_00B57E41
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B58794 mov eax, dword ptr fs:[00000030h] 3_2_00B58794
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC7794 mov eax, dword ptr fs:[00000030h] 3_2_00BC7794
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC7794 mov eax, dword ptr fs:[00000030h] 3_2_00BC7794
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BC7794 mov eax, dword ptr fs:[00000030h] 3_2_00BC7794
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B837F5 mov eax, dword ptr fs:[00000030h] 3_2_00B837F5
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7E730 mov eax, dword ptr fs:[00000030h] 3_2_00B7E730
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B44F2E mov eax, dword ptr fs:[00000030h] 3_2_00B44F2E
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B44F2E mov eax, dword ptr fs:[00000030h] 3_2_00B44F2E
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B6F716 mov eax, dword ptr fs:[00000030h] 3_2_00B6F716
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C18F6A mov eax, dword ptr fs:[00000030h] 3_2_00C18F6A
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDFF10 mov eax, dword ptr fs:[00000030h] 3_2_00BDFF10
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00BDFF10 mov eax, dword ptr fs:[00000030h] 3_2_00BDFF10
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7A70E mov eax, dword ptr fs:[00000030h] 3_2_00B7A70E
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B7A70E mov eax, dword ptr fs:[00000030h] 3_2_00B7A70E
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C1070D mov eax, dword ptr fs:[00000030h] 3_2_00C1070D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00C1070D mov eax, dword ptr fs:[00000030h] 3_2_00C1070D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5FF60 mov eax, dword ptr fs:[00000030h] 3_2_00B5FF60
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00B5EF40 mov eax, dword ptr fs:[00000030h] 3_2_00B5EF40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D72ACB mov eax, dword ptr fs:[00000030h] 8_2_02D72ACB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D72AE4 mov eax, dword ptr fs:[00000030h] 8_2_02D72AE4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7D294 mov eax, dword ptr fs:[00000030h] 8_2_02D7D294
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7D294 mov eax, dword ptr fs:[00000030h] 8_2_02D7D294
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5AAB0 mov eax, dword ptr fs:[00000030h] 8_2_02D5AAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5AAB0 mov eax, dword ptr fs:[00000030h] 8_2_02D5AAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7FAB0 mov eax, dword ptr fs:[00000030h] 8_2_02D7FAB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D452A5 mov eax, dword ptr fs:[00000030h] 8_2_02D452A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D452A5 mov eax, dword ptr fs:[00000030h] 8_2_02D452A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D452A5 mov eax, dword ptr fs:[00000030h] 8_2_02D452A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D452A5 mov eax, dword ptr fs:[00000030h] 8_2_02D452A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D452A5 mov eax, dword ptr fs:[00000030h] 8_2_02D452A5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E18A62 mov eax, dword ptr fs:[00000030h] 8_2_02E18A62
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DD4257 mov eax, dword ptr fs:[00000030h] 8_2_02DD4257
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49240 mov eax, dword ptr fs:[00000030h] 8_2_02D49240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49240 mov eax, dword ptr fs:[00000030h] 8_2_02D49240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49240 mov eax, dword ptr fs:[00000030h] 8_2_02D49240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49240 mov eax, dword ptr fs:[00000030h] 8_2_02D49240
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D8927A mov eax, dword ptr fs:[00000030h] 8_2_02D8927A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0EA55 mov eax, dword ptr fs:[00000030h] 8_2_02E0EA55
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DFB260 mov eax, dword ptr fs:[00000030h] 8_2_02DFB260
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DFB260 mov eax, dword ptr fs:[00000030h] 8_2_02DFB260
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4AA16 mov eax, dword ptr fs:[00000030h] 8_2_02D4AA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4AA16 mov eax, dword ptr fs:[00000030h] 8_2_02D4AA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D45210 mov eax, dword ptr fs:[00000030h] 8_2_02D45210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D45210 mov ecx, dword ptr fs:[00000030h] 8_2_02D45210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D45210 mov eax, dword ptr fs:[00000030h] 8_2_02D45210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D45210 mov eax, dword ptr fs:[00000030h] 8_2_02D45210
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D63A1C mov eax, dword ptr fs:[00000030h] 8_2_02D63A1C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D58A0A mov eax, dword ptr fs:[00000030h] 8_2_02D58A0A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D84A2C mov eax, dword ptr fs:[00000030h] 8_2_02D84A2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D84A2C mov eax, dword ptr fs:[00000030h] 8_2_02D84A2C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0AA16 mov eax, dword ptr fs:[00000030h] 8_2_02E0AA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0AA16 mov eax, dword ptr fs:[00000030h] 8_2_02E0AA16
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A229 mov eax, dword ptr fs:[00000030h] 8_2_02D6A229
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC53CA mov eax, dword ptr fs:[00000030h] 8_2_02DC53CA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC53CA mov eax, dword ptr fs:[00000030h] 8_2_02DC53CA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D703E2 mov eax, dword ptr fs:[00000030h] 8_2_02D703E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D703E2 mov eax, dword ptr fs:[00000030h] 8_2_02D703E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D703E2 mov eax, dword ptr fs:[00000030h] 8_2_02D703E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D703E2 mov eax, dword ptr fs:[00000030h] 8_2_02D703E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D703E2 mov eax, dword ptr fs:[00000030h] 8_2_02D703E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D703E2 mov eax, dword ptr fs:[00000030h] 8_2_02D703E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6DBE9 mov eax, dword ptr fs:[00000030h] 8_2_02D6DBE9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D72397 mov eax, dword ptr fs:[00000030h] 8_2_02D72397
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E15BA5 mov eax, dword ptr fs:[00000030h] 8_2_02E15BA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7B390 mov eax, dword ptr fs:[00000030h] 8_2_02D7B390
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D51B8F mov eax, dword ptr fs:[00000030h] 8_2_02D51B8F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D51B8F mov eax, dword ptr fs:[00000030h] 8_2_02D51B8F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DFD380 mov ecx, dword ptr fs:[00000030h] 8_2_02DFD380
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0138A mov eax, dword ptr fs:[00000030h] 8_2_02E0138A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D74BAD mov eax, dword ptr fs:[00000030h] 8_2_02D74BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D74BAD mov eax, dword ptr fs:[00000030h] 8_2_02D74BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D74BAD mov eax, dword ptr fs:[00000030h] 8_2_02D74BAD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4F358 mov eax, dword ptr fs:[00000030h] 8_2_02D4F358
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4DB40 mov eax, dword ptr fs:[00000030h] 8_2_02D4DB40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D73B7A mov eax, dword ptr fs:[00000030h] 8_2_02D73B7A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D73B7A mov eax, dword ptr fs:[00000030h] 8_2_02D73B7A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4DB60 mov ecx, dword ptr fs:[00000030h] 8_2_02D4DB60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E18B58 mov eax, dword ptr fs:[00000030h] 8_2_02E18B58
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0131B mov eax, dword ptr fs:[00000030h] 8_2_02E0131B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDB8D0 mov eax, dword ptr fs:[00000030h] 8_2_02DDB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDB8D0 mov ecx, dword ptr fs:[00000030h] 8_2_02DDB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDB8D0 mov eax, dword ptr fs:[00000030h] 8_2_02DDB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDB8D0 mov eax, dword ptr fs:[00000030h] 8_2_02DDB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDB8D0 mov eax, dword ptr fs:[00000030h] 8_2_02DDB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDB8D0 mov eax, dword ptr fs:[00000030h] 8_2_02DDB8D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6B8E4 mov eax, dword ptr fs:[00000030h] 8_2_02D6B8E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6B8E4 mov eax, dword ptr fs:[00000030h] 8_2_02D6B8E4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D440E1 mov eax, dword ptr fs:[00000030h] 8_2_02D440E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D440E1 mov eax, dword ptr fs:[00000030h] 8_2_02D440E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D440E1 mov eax, dword ptr fs:[00000030h] 8_2_02D440E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D458EC mov eax, dword ptr fs:[00000030h] 8_2_02D458EC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49080 mov eax, dword ptr fs:[00000030h] 8_2_02D49080
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC3884 mov eax, dword ptr fs:[00000030h] 8_2_02DC3884
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC3884 mov eax, dword ptr fs:[00000030h] 8_2_02DC3884
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7F0BF mov ecx, dword ptr fs:[00000030h] 8_2_02D7F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7F0BF mov eax, dword ptr fs:[00000030h] 8_2_02D7F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7F0BF mov eax, dword ptr fs:[00000030h] 8_2_02D7F0BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D890AF mov eax, dword ptr fs:[00000030h] 8_2_02D890AF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D720A0 mov eax, dword ptr fs:[00000030h] 8_2_02D720A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D720A0 mov eax, dword ptr fs:[00000030h] 8_2_02D720A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D720A0 mov eax, dword ptr fs:[00000030h] 8_2_02D720A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D720A0 mov eax, dword ptr fs:[00000030h] 8_2_02D720A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D720A0 mov eax, dword ptr fs:[00000030h] 8_2_02D720A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D720A0 mov eax, dword ptr fs:[00000030h] 8_2_02D720A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D60050 mov eax, dword ptr fs:[00000030h] 8_2_02D60050
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D60050 mov eax, dword ptr fs:[00000030h] 8_2_02D60050
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E02073 mov eax, dword ptr fs:[00000030h] 8_2_02E02073
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E11074 mov eax, dword ptr fs:[00000030h] 8_2_02E11074
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC7016 mov eax, dword ptr fs:[00000030h] 8_2_02DC7016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC7016 mov eax, dword ptr fs:[00000030h] 8_2_02DC7016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC7016 mov eax, dword ptr fs:[00000030h] 8_2_02DC7016
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A830 mov eax, dword ptr fs:[00000030h] 8_2_02D6A830
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A830 mov eax, dword ptr fs:[00000030h] 8_2_02D6A830
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A830 mov eax, dword ptr fs:[00000030h] 8_2_02D6A830
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6A830 mov eax, dword ptr fs:[00000030h] 8_2_02D6A830
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E14015 mov eax, dword ptr fs:[00000030h] 8_2_02E14015
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E14015 mov eax, dword ptr fs:[00000030h] 8_2_02E14015
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7002D mov eax, dword ptr fs:[00000030h] 8_2_02D7002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7002D mov eax, dword ptr fs:[00000030h] 8_2_02D7002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7002D mov eax, dword ptr fs:[00000030h] 8_2_02D7002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7002D mov eax, dword ptr fs:[00000030h] 8_2_02D7002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7002D mov eax, dword ptr fs:[00000030h] 8_2_02D7002D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5B02A mov eax, dword ptr fs:[00000030h] 8_2_02D5B02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5B02A mov eax, dword ptr fs:[00000030h] 8_2_02D5B02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5B02A mov eax, dword ptr fs:[00000030h] 8_2_02D5B02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5B02A mov eax, dword ptr fs:[00000030h] 8_2_02D5B02A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DD41E8 mov eax, dword ptr fs:[00000030h] 8_2_02DD41E8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4B1E1 mov eax, dword ptr fs:[00000030h] 8_2_02D4B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4B1E1 mov eax, dword ptr fs:[00000030h] 8_2_02D4B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4B1E1 mov eax, dword ptr fs:[00000030h] 8_2_02D4B1E1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E049A4 mov eax, dword ptr fs:[00000030h] 8_2_02E049A4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E049A4 mov eax, dword ptr fs:[00000030h] 8_2_02E049A4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E049A4 mov eax, dword ptr fs:[00000030h] 8_2_02E049A4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E049A4 mov eax, dword ptr fs:[00000030h] 8_2_02E049A4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D72990 mov eax, dword ptr fs:[00000030h] 8_2_02D72990
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7A185 mov eax, dword ptr fs:[00000030h] 8_2_02D7A185
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6C182 mov eax, dword ptr fs:[00000030h] 8_2_02D6C182
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC51BE mov eax, dword ptr fs:[00000030h] 8_2_02DC51BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC51BE mov eax, dword ptr fs:[00000030h] 8_2_02DC51BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC51BE mov eax, dword ptr fs:[00000030h] 8_2_02DC51BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC51BE mov eax, dword ptr fs:[00000030h] 8_2_02DC51BE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov eax, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov eax, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov eax, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov ecx, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D699BF mov eax, dword ptr fs:[00000030h] 8_2_02D699BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D761A0 mov eax, dword ptr fs:[00000030h] 8_2_02D761A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D761A0 mov eax, dword ptr fs:[00000030h] 8_2_02D761A0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC69A6 mov eax, dword ptr fs:[00000030h] 8_2_02DC69A6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6B944 mov eax, dword ptr fs:[00000030h] 8_2_02D6B944
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6B944 mov eax, dword ptr fs:[00000030h] 8_2_02D6B944
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4B171 mov eax, dword ptr fs:[00000030h] 8_2_02D4B171
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4B171 mov eax, dword ptr fs:[00000030h] 8_2_02D4B171
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4C962 mov eax, dword ptr fs:[00000030h] 8_2_02D4C962
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49100 mov eax, dword ptr fs:[00000030h] 8_2_02D49100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49100 mov eax, dword ptr fs:[00000030h] 8_2_02D49100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D49100 mov eax, dword ptr fs:[00000030h] 8_2_02D49100
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7513A mov eax, dword ptr fs:[00000030h] 8_2_02D7513A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7513A mov eax, dword ptr fs:[00000030h] 8_2_02D7513A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D64120 mov eax, dword ptr fs:[00000030h] 8_2_02D64120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D64120 mov eax, dword ptr fs:[00000030h] 8_2_02D64120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D64120 mov eax, dword ptr fs:[00000030h] 8_2_02D64120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D64120 mov eax, dword ptr fs:[00000030h] 8_2_02D64120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D64120 mov ecx, dword ptr fs:[00000030h] 8_2_02D64120
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D736CC mov eax, dword ptr fs:[00000030h] 8_2_02D736CC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DFFEC0 mov eax, dword ptr fs:[00000030h] 8_2_02DFFEC0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D88EC7 mov eax, dword ptr fs:[00000030h] 8_2_02D88EC7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E18ED6 mov eax, dword ptr fs:[00000030h] 8_2_02E18ED6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D716E0 mov ecx, dword ptr fs:[00000030h] 8_2_02D716E0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D576E2 mov eax, dword ptr fs:[00000030h] 8_2_02D576E2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E10EA5 mov eax, dword ptr fs:[00000030h] 8_2_02E10EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E10EA5 mov eax, dword ptr fs:[00000030h] 8_2_02E10EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E10EA5 mov eax, dword ptr fs:[00000030h] 8_2_02E10EA5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDFE87 mov eax, dword ptr fs:[00000030h] 8_2_02DDFE87
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC46A7 mov eax, dword ptr fs:[00000030h] 8_2_02DC46A7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D57E41 mov eax, dword ptr fs:[00000030h] 8_2_02D57E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D57E41 mov eax, dword ptr fs:[00000030h] 8_2_02D57E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D57E41 mov eax, dword ptr fs:[00000030h] 8_2_02D57E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D57E41 mov eax, dword ptr fs:[00000030h] 8_2_02D57E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D57E41 mov eax, dword ptr fs:[00000030h] 8_2_02D57E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D57E41 mov eax, dword ptr fs:[00000030h] 8_2_02D57E41
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0AE44 mov eax, dword ptr fs:[00000030h] 8_2_02E0AE44
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E0AE44 mov eax, dword ptr fs:[00000030h] 8_2_02E0AE44
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6AE73 mov eax, dword ptr fs:[00000030h] 8_2_02D6AE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6AE73 mov eax, dword ptr fs:[00000030h] 8_2_02D6AE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6AE73 mov eax, dword ptr fs:[00000030h] 8_2_02D6AE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6AE73 mov eax, dword ptr fs:[00000030h] 8_2_02D6AE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6AE73 mov eax, dword ptr fs:[00000030h] 8_2_02D6AE73
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5766D mov eax, dword ptr fs:[00000030h] 8_2_02D5766D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7A61C mov eax, dword ptr fs:[00000030h] 8_2_02D7A61C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7A61C mov eax, dword ptr fs:[00000030h] 8_2_02D7A61C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4C600 mov eax, dword ptr fs:[00000030h] 8_2_02D4C600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4C600 mov eax, dword ptr fs:[00000030h] 8_2_02D4C600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4C600 mov eax, dword ptr fs:[00000030h] 8_2_02D4C600
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D78E00 mov eax, dword ptr fs:[00000030h] 8_2_02D78E00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DFFE3F mov eax, dword ptr fs:[00000030h] 8_2_02DFFE3F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E01608 mov eax, dword ptr fs:[00000030h] 8_2_02E01608
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D4E620 mov eax, dword ptr fs:[00000030h] 8_2_02D4E620
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D837F5 mov eax, dword ptr fs:[00000030h] 8_2_02D837F5
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D58794 mov eax, dword ptr fs:[00000030h] 8_2_02D58794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC7794 mov eax, dword ptr fs:[00000030h] 8_2_02DC7794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC7794 mov eax, dword ptr fs:[00000030h] 8_2_02DC7794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DC7794 mov eax, dword ptr fs:[00000030h] 8_2_02DC7794
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E18F6A mov eax, dword ptr fs:[00000030h] 8_2_02E18F6A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5EF40 mov eax, dword ptr fs:[00000030h] 8_2_02D5EF40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D5FF60 mov eax, dword ptr fs:[00000030h] 8_2_02D5FF60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6F716 mov eax, dword ptr fs:[00000030h] 8_2_02D6F716
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDFF10 mov eax, dword ptr fs:[00000030h] 8_2_02DDFF10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02DDFF10 mov eax, dword ptr fs:[00000030h] 8_2_02DDFF10
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7A70E mov eax, dword ptr fs:[00000030h] 8_2_02D7A70E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7A70E mov eax, dword ptr fs:[00000030h] 8_2_02D7A70E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D7E730 mov eax, dword ptr fs:[00000030h] 8_2_02D7E730
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6B73D mov eax, dword ptr fs:[00000030h] 8_2_02D6B73D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02D6B73D mov eax, dword ptr fs:[00000030h] 8_2_02D6B73D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 8_2_02E1070D mov eax, dword ptr fs:[00000030h] 8_2_02E1070D
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 3_2_00409B50 LdrLoadDll, 3_2_00409B50

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.estateglobal.info
Source: C:\Windows\explorer.exe Network Connect: 212.1.210.76 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 160.153.136.3 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 104.21.86.185 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.com-weekly.email
Source: C:\Windows\explorer.exe Domain query: www.mmfirewood.net
Source: C:\Windows\explorer.exe Network Connect: 52.6.230.169 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.akshayaasri.com
Source: C:\Windows\explorer.exe Domain query: www.fjallravenz.online
Source: C:\Windows\explorer.exe Domain query: www.morethanmummies.com
Source: C:\Windows\explorer.exe Domain query: www.simonhaidomous.com
Source: C:\Windows\explorer.exe Network Connect: 154.212.212.21 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.spacebymeghan.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: 280000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Memory written: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Thread register set: target process: 3424 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Process created: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe" Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe" Jump to behavior
Source: explorer.exe, 00000005.00000000.686978439.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.704670462.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.672786767.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.687166646.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.704979510.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.672951369.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.687166646.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.675851677.0000000005E50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.704979510.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.672951369.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.687166646.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.704979510.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.672951369.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.687166646.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.704979510.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.672951369.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.712331473.000000000A716000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.698134921.000000000A716000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.679317249.000000000A716000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd5D
Source: C:\Users\user\Desktop\HIRE SOA FOR DEC_2021.exe Code function: 1_2_00405AA7 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 1_2_00405AA7

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.HIRE SOA FOR DEC_2021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.HIRE SOA FOR DEC_2021.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.HIRE SOA FOR DEC_2021.exe.1ac80000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.923922972.0000000002860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.678729198.000000001AC80000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.666927369.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727381922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.667732037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727546752.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923725449.0000000002340000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.923819595.0000000002640000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.727459456.00000000006C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.708836625.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.692391480.0000000006C10000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562107 Sample: HIRE SOA FOR DEC_2021.exe Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 31 www.toraportal.com 2->31 33 www.skworkforce.com 2->33 35 3 other IPs or domains 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 7 other signatures 2->49 11 HIRE SOA FOR DEC_2021.exe 19 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\sdxajjgxerh.dll, PE32 11->29 dropped 63 Injects a PE file into a foreign processes 11->63 15 HIRE SOA FOR DEC_2021.exe 11->15         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 15->65 67 Maps a DLL or memory area into another process 15->67 69 Sample uses process hollowing technique 15->69 71 Queues an APC in another process (thread injection) 15->71 18 explorer.exe 15->18 injected process9 dnsIp10 37 spacebymeghan.com 15.197.142.173, 49795, 80 TANDEMUS United States 18->37 39 mmfirewood.net 160.153.136.3, 49792, 80 GODADDY-AMSDE United States 18->39 41 11 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 53 Uses ipconfig to lookup or modify the Windows network settings 18->53 22 ipconfig.exe 18->22         started        signatures11 process12 signatures13 55 Self deletion via cmd delete 22->55 57 Modifies the context of a thread in another process (thread injection) 22->57 59 Maps a DLL or memory area into another process 22->59 61 Tries to detect virtualization through RDTSC time measurements 22->61 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
212.1.210.76
 akshayaasri.com United States
47583 AS-HOSTINGERLT true
160.153.136.3
 mmfirewood.net United States
21501 GODADDY-AMSDE true
15.197.142.173
 spacebymeghan.com United States
7430 TANDEMUS true
104.21.86.185
 www.fjallravenz.online United States
13335 CLOUDFLARENETUS true
154.212.212.21
 www.morethanmummies.com Seychelles
133201 COMING-ASABCDEGROUPCOMPANYLIMITEDHK true
52.6.230.169
 cdl-lb-1356093980.us-east-1.elb.amazonaws.com United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
mmfirewood.net 160.153.136.3 true
spacebymeghan.com 15.197.142.173 true
www.fjallravenz.online 104.21.86.185 true
akshayaasri.com 212.1.210.76 true
www.morethanmummies.com 154.212.212.21 true
ghs.googlehosted.com 142.250.203.115 true
cdl-lb-1356093980.us-east-1.elb.amazonaws.com 52.6.230.169 true
toraportal.com 34.102.136.180 true
www.skworkforce.com unknown unknown
www.akshayaasri.com unknown unknown
www.estateglobal.info unknown unknown
www.cefseguranca-app.com unknown unknown
www.toraportal.com unknown unknown
www.com-weekly.email unknown unknown
www.simonhaidomous.com unknown unknown
www.mmfirewood.net unknown unknown
www.spacebymeghan.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.fjallravenz.online/cxep/?oL08qf=sGuO4U2D4QpvxfM4Tie03jNQ5o3Udlnj3BRVJisDJxm1gCdwebUZDD2ARlBl478rs+gp&r4e=MFQPj4OXxHZ8i true
  • Avira URL Cloud: phishing
 unknown
http://www.simonhaidomous.com/cxep/?oL08qf=UgSNVuZrhE3Z8z0ZgFZcy2vBLKCwBFY+sTDX0qorCT9gsCOpfKa0UREUH3qfIqk5g45k&r4e=MFQPj4OXxHZ8i true
  • Avira URL Cloud: malware
 unknown
www.littlesportsacademy.com/cxep/ true
  • Avira URL Cloud: malware
 low
http://www.spacebymeghan.com/cxep/?oL08qf=ptEMQJ9wcGHn8Y3e8b7dTbimCX2/D160Z9ziomc9eLzNI2egxKU0hugwHCLO4F78raSg&r4e=MFQPj4OXxHZ8i true
  • Avira URL Cloud: malware
 unknown
http://www.akshayaasri.com/cxep/?oL08qf=Byxtzwy9R0GD0IyvX+TGY0P09qT9QyNZPQIOfaNvzxOEg7PFqVlYKXle2hnRLry+JL4w&r4e=MFQPj4OXxHZ8i true
  • Avira URL Cloud: malware
 unknown
http://www.morethanmummies.com/cxep/?oL08qf=PktwisKIh9eqiZaZPdqfCAueqx7lopJ2FQkTMDOUcG0hgTiBceSgN5Z4VAFzyceEWpkB&r4e=MFQPj4OXxHZ8i true
  • Avira URL Cloud: malware
 unknown
http://www.mmfirewood.net/cxep/?oL08qf=tKr7e/ysfkFa3UQ2/S4tB4cSlqebmf+Bdoeimz8jp9iwh3bj6jf6wnxNjQM++WQWQx0o&r4e=MFQPj4OXxHZ8i true
  • Avira URL Cloud: safe
 unknown